---- Reported by nahuel.angelinetti@biblibre.com 2009-09-21 13:07:59 ---- Atm, sending shelves and baskets via OPAC can be used to SPAM or spoof the kohaadminemailaddress, it's really bad. Only logged in user must be able to send shelves and baskets, and their name must appear in the sent email. ---- Additional Comments From nahuel.angelinetti@biblibre.com 2009-09-21 13:10:21 ---- Created an attachment bugfix ---- Additional Comments From gmcharlt@gmail.com 2010-02-18 18:02:39 ---- Patch pushed to HEAD. Please test and close. --- Bug imported by chris@bigballofwax.co.nz 2010-05-21 01:13 UTC --- This bug was previously known as _bug_ 3651 at http://bugs.koha.org/cgi-bin/bugzilla3/show_bug.cgi?id=3651 Imported an attachment (id=1481) Actual time not defined. Setting to 0.0 The original submitter of attachment 1481 [details] [review] is unknown. Reassigning to the person who moved it here: chris@bigballofwax.co.nz.
This appears to have been undone by the fix for Bug 4289.
Created attachment 6955 [details] [review] Follow-up fix The fix for Bug 4289, "Add a syspref 'OpacPublic', to hide OPAC search-bar and force authentication on all OPAC pages" incorrectly made some page permissions dependent on the value of the OpacPublic setting. Some pages should require authentication no matter what. This patch returns opac-sendbasket.pl to the state it was in before Bug 4289, Bug 4274 notwithstanding. I have added the authentication requirement to opac-sendshelf.pl to match.
Created attachment 6968 [details] [review] [SIGNED-OFF] Bug 3651 Follow-up, Require patron login to send shelves and baskets The fix for Bug 4289, "Add a syspref 'OpacPublic', to hide OPAC search-bar and force authentication on all OPAC pages" incorrectly made some page permissions dependent on the value of the OpacPublic setting. Some pages should require authentication no matter what. This patch returns opac-sendbasket.pl to the state it was in before Bug 4289, Bug 4274 notwithstanding. I have added the authentication requirement to opac-sendshelf.pl to match. Signed-off-by: Katrin Fischer <Katrin.Fischer.83@web.de> 1) sending cart requires login 2) sending shelf requires login 3) updating personal details requires login
This patch also fixes opac-userupdate.pl so is a more serious patch. Without this, you don't need to be logged in to craft a url to request an update to anyones record.
patch pushed again, please test