---- Reported by nahuel.angelinetti@biblibre.com 2009-05-20 15:01:59 ---- If a user in opac is not logged in, he can modify any of the shelves. ---- Additional Comments From nahuel.angelinetti@biblibre.com 2009-05-20 15:06:28 ---- Created an attachment bugfix --- Bug imported by chris@bigballofwax.co.nz 2010-05-21 01:08 UTC --- This bug was previously known as _bug_ 3238 at http://bugs.koha.org/cgi-bin/bugzilla3/show_bug.cgi?id=3238 Imported an attachment (id=1174) Actual time not defined. Setting to 0.0 The original submitter of attachment 1174 [details] [review] is unknown. Reassigning to the person who moved it here: chris@bigballofwax.co.nz.
The proposed patch changes one line from this: return 1 if (($category >= 2) and defined($user) and ($borrower->{authflags}->{superlibrarian} || $user == 0)); # public list, superlibrarian can edit/delete to this: return 1 if (($category >= 2) and defined($user) and ($borrower->{authflags}->{superlibrarian})); # public list, superlibrarian can edit/delete In current HEAD this line still looks like the original line: return 1 if (($category >= 2) and defined($user) and ($borrower->{authflags}->{superlibrarian} || $user == 0)); # public list, superlibrarian can edit/delete but I can not replicate the problem with non-logged in users editing public lists. The bug did not have a "patch sent" status. I'm setting it to "Needs signoff" - maybe someone can verify if the patch is still needed or the problem has been solved another way.
OK, I did many tests, I tried to forge an URL while not being authentified, I can't reproduce the error. Nahuel has left BibLibre, so can't ask him (and he would have forgotten probably, patch is 2 years old !) So closing this bug