opac-renew.pl takes whatever borrowernumber you give it, so if you know the borrowernumber and itemnumber of the patron and item you can renew items for anyone from the OPAC. In my test all that was required was a valid OPAC login. To reproduce: 1. Log in to the OPAC as any valid user. 2. Point the browser to the URL of opac-renew.pl: http://koha.example.com/cgi-bin/koha/opac-renew.pl?borrowernumber=X&item=Y Where X is a Koha patron and Y is the itemnumber of something checked out to X.
Created attachment 7704 [details] [review] Bug 7551 : Can only renew for the user you are logged in as now
Created attachment 7705 [details] [review] [SIGNED-OFF] Bug 7551 : Can only renew for the user you are logged in as now Signed-off-by: Owen Leonard <oleonard@myacpl.org>
Okay, this line has been in here since Koha 3.0, when the built-in SCO used to use opac-renew to do it's renewals. Hence the need to use a different borrowernumber than your own. Now that SCO handles it's own renewals, this is just a security risk. Marking Passed QA. Follow up patch can be written to update opac-user.tt to no longer transmit the borrowernumber, but that's just cleanup.