Bug 3140 - It is possible to email someone else's private list
Summary: It is possible to email someone else's private list
Status: CLOSED FIXED
Alias: None
Product: Koha
Classification: Unclassified
Component: Lists (show other bugs)
Version: Main
Hardware: All All
: PATCH-Sent (DO NOT USE) major (vote)
Assignee: Owen Leonard
QA Contact:
URL:
Keywords:
Depends on:
Blocks:
 
Reported: 2009-04-18 10:05 UTC by Owen Leonard
Modified: 2012-10-25 23:09 UTC (History)
4 users (show)

See Also:
Change sponsored?: ---
Patch complexity: ---
Documentation contact:
Documentation submission:
Text to go in the release notes:
Version(s) released in:


Attachments
Proposed fix for the OPAC (9.79 KB, patch)
2011-05-17 15:25 UTC, Owen Leonard
Details | Diff | Splinter Review
proposed fix signed-off (9.79 KB, patch)
2011-05-19 09:41 UTC, Paul Poulain
Details | Diff | Splinter Review

Note You need to log in before you can comment on or make changes to this bug.
Description Chris Cormack 2010-05-21 01:06:56 UTC


---- Reported by oleonard@myacpl.org 2009-04-18 22:05:39 ----

If you copy the URL of the "send list" popup window you can change the shelfid value and send yourself any list regardless of who owns it.



---- Additional Comments From joe.atzberger@liblime.com 2009-05-28 16:04:26 ----

Note that you can see the list, but you don't know whose list it is.  So there isn't as much privacy concern as there otherwise might be.



--- Bug imported by chris@bigballofwax.co.nz 2010-05-21 01:06 UTC  ---

This bug was previously known as _bug_ 3140 at http://bugs.koha.org/cgi-bin/bugzilla3/show_bug.cgi?id=3140

Actual time not defined. Setting to 0.0
CC member joe.atzberger@liblime.com does not have an account here

Comment 1 Owen Leonard 2011-05-17 14:19:32 UTC
This bug still exists in master.
Comment 2 Owen Leonard 2011-05-17 15:25:32 UTC Comment hidden (obsolete)
Comment 3 Paul Poulain 2011-05-19 09:41:04 UTC
Created attachment 4189 [details] [review]
proposed fix signed-off
Comment 4 Ian Walls 2011-05-25 21:07:12 UTC
tested, confirmed, marking as Passed QA
Comment 5 Chris Cormack 2011-05-25 21:54:49 UTC
Permission works, pushed please test and mark resolved
Comment 6 Ian Walls 2011-12-02 14:27:21 UTC
Working in master since May.  Closing.