Using direct call to "/cgi-bin/koha/opac-addbybiblionumber.pl?biblionumber=xxx", an anonymous user is able to create Lists. The new created list is owner by kohaadmin (at least on my site).
Confirmed, although it doesn't look to me like the kohaadmin user can manage it. In the virtualshelves table the owner is NULL. If someone used this method to create a private list the administrator wouldn't have any way to remove it via the interface (not that anyone could see that it had been created).
Created attachment 7307 [details] [review] Made page require authentication.
Created attachment 7380 [details] [review] Bug 6631: Anonymous users can create lists in OPAC Made opac-addbybiblionumber.pl page require authentication. Signed-off-by: Jared Camins-Esakov <jcamins@cpbibliography.com>
I would propose to solve this issue in connection with report 7310 (working on it ..) We should not allow anonymous to create a list. Another related issue is if you should allow anonymous to add a biblio to a public list. I think that we should not allow it either. Making a list or adding an entry is the privilege of known users.
QA comment: * tiny patch, everything OK * upgrading severity * welcome Aleksa Vujicic to the list of contributors, you're 172th !
This fix was included in the 3.6.x branch prior to 3.6.4.
*** Bug 7473 has been marked as a duplicate of this bug. ***