Bug 3238 - VirtualShelves are editable by anyone who is not logged in
Summary: VirtualShelves are editable by anyone who is not logged in
Status: CLOSED INVALID
Alias: None
Product: Koha
Classification: Unclassified
Component: Lists (show other bugs)
Version: unspecified
Hardware: PC All
: PATCH-Sent (DO NOT USE) enhancement (vote)
Assignee: Nahuel Angelinetti
QA Contact:
URL:
Keywords:
Depends on:
Blocks:
 
Reported: 2009-05-20 03:01 UTC by Nahuel Angelinetti
Modified: 2012-10-26 00:41 UTC (History)
2 users (show)

See Also:
Change sponsored?: ---
Patch complexity: ---
Documentation contact:
Documentation submission:
Text to go in the release notes:
Version(s) released in:


Attachments
bugfix (1.21 KB, patch)
2009-05-20 15:06 UTC, Chris Cormack
Details | Diff | Splinter Review

Note You need to log in before you can comment on or make changes to this bug.
Description Chris Cormack 2010-05-21 01:08:10 UTC


---- Reported by nahuel.angelinetti@biblibre.com 2009-05-20 15:01:59 ----

If a user in opac is not logged in, he can modify any of the shelves.



---- Additional Comments From nahuel.angelinetti@biblibre.com 2009-05-20 15:06:28 ----

Created an attachment
bugfix





--- Bug imported by chris@bigballofwax.co.nz 2010-05-21 01:08 UTC  ---

This bug was previously known as _bug_ 3238 at http://bugs.koha.org/cgi-bin/bugzilla3/show_bug.cgi?id=3238
Imported an attachment (id=1174)

Actual time not defined. Setting to 0.0
The original submitter of attachment 1174 [details] [review] is unknown.
   Reassigning to the person who moved it here: chris@bigballofwax.co.nz.

Comment 1 Magnus Enger 2011-05-06 13:22:16 UTC
The proposed patch changes one line from this: 

return 1 if (($category >= 2) and defined($user) and ($borrower->{authflags}->{superlibrarian} || $user == 0));	# public list, superlibrarian can edit/delete

to this: 

return 1 if (($category >= 2) and defined($user) and ($borrower->{authflags}->{superlibrarian}));	# public list, superlibrarian can edit/delete

In current HEAD this line still looks like the original line: 

return 1 if (($category >= 2) and defined($user) and ($borrower->{authflags}->{superlibrarian} || $user == 0));     # public list, superlibrarian can edit/delete

but I can not replicate the problem with non-logged in users editing public lists. The bug did not have a "patch sent" status. I'm setting it to "Needs signoff" - maybe someone can verify if the patch is still needed or the problem has been solved another way.
Comment 2 Paul Poulain 2011-05-11 15:50:18 UTC
OK, I did many tests, I tried to forge an URL while not being authentified, I can't reproduce the error.
Nahuel has left BibLibre, so can't ask him (and he would have forgotten probably, patch is 2 years old !)

So closing this bug