Bug 7551 - Any logged-in OPAC user can renew items for others using a properly constructed URL
Summary: Any logged-in OPAC user can renew items for others using a properly construct...
Status: CLOSED FIXED
Alias: None
Product: Koha
Classification: Unclassified
Component: OPAC (show other bugs)
Version: 3.6
Hardware: All All
: P1 - high critical
Assignee: Owen Leonard
QA Contact: Ian Walls
URL:
Keywords:
Depends on:
Blocks:
 
Reported: 2012-02-16 20:19 UTC by Owen Leonard
Modified: 2019-06-27 09:24 UTC (History)
3 users (show)

See Also:
Change sponsored?: ---
Patch complexity: ---
Documentation contact:
Documentation submission:
Text to go in the release notes:
Version(s) released in:
Circulation function:


Attachments
Bug 7551 : Can only renew for the user you are logged in as now (774 bytes, patch)
2012-02-16 20:24 UTC, Chris Cormack
Details | Diff | Splinter Review
[SIGNED-OFF] Bug 7551 : Can only renew for the user you are logged in as now (876 bytes, patch)
2012-02-16 20:40 UTC, Owen Leonard
Details | Diff | Splinter Review

Note You need to log in before you can comment on or make changes to this bug.
Description Owen Leonard 2012-02-16 20:19:22 UTC
opac-renew.pl takes whatever borrowernumber you give it, so if you know the borrowernumber and itemnumber of the patron and item you can renew items for anyone from the OPAC. In my test all that was required was a valid OPAC login.

To reproduce:

1. Log in to the OPAC as any valid user.
2. Point the browser to the URL of opac-renew.pl:

http://koha.example.com/cgi-bin/koha/opac-renew.pl?borrowernumber=X&item=Y

Where X is a Koha patron and Y is the itemnumber of something checked out to X.
Comment 1 Chris Cormack 2012-02-16 20:24:38 UTC Comment hidden (obsolete)
Comment 2 Owen Leonard 2012-02-16 20:40:36 UTC
Created attachment 7705 [details] [review]
[SIGNED-OFF] Bug 7551 : Can only renew for the user you are logged in as now

Signed-off-by: Owen Leonard <oleonard@myacpl.org>
Comment 3 Ian Walls 2012-02-16 21:23:56 UTC
Okay, this line has been in here since Koha 3.0, when the built-in SCO used to use opac-renew to do it's renewals.  Hence the need to use a different borrowernumber than your own.  Now that SCO handles it's own renewals, this is just a security risk.  Marking Passed QA.

Follow up patch can be written to update opac-user.tt to no longer transmit the borrowernumber, but that's just cleanup.