Bug 8706 - Private lists can be accessed by anyone
Summary: Private lists can be accessed by anyone
Status: CLOSED FIXED
Alias: None
Product: Koha
Classification: Unclassified
Component: Lists (show other bugs)
Version: 3.8
Hardware: All All
: P5 - low critical
Assignee: Marcel de Rooy
QA Contact: Jonathan Druart
URL:
Keywords:
Depends on:
Blocks:
 
Reported: 2012-08-30 20:03 UTC by Owen Leonard
Modified: 2019-06-27 09:24 UTC (History)
5 users (show)

See Also:
Change sponsored?: ---
Patch complexity: ---
Documentation contact:
Documentation submission:
Text to go in the release notes:
Version(s) released in:
Circulation function:

Attachments
Patch 8706 (976 bytes, patch)
2012-08-31 09:53 UTC, Marcel de Rooy 		Details | Diff | Splinter Review
Bug 8706 - Private lists can be accessed by anyone (1.15 KB, patch)
2012-08-31 11:38 UTC, Kyle M Hall (khall) 		Details | Diff | Splinter Review
Show Obsolete (1) View All Add an attachment (proposed patch, testcase, etc.)

Note You need to log in before you can comment on or make changes to this bug.
Description Owen Leonard 2012-08-30 20:03:32 UTC 
Any private list can be accessed by any user by typing the shelf number in the URL:

/cgi-bin/koha/opac-shelves.pl?viewshelf=XXX
Comment 1 Owen Leonard 2012-08-30 20:14:38 UTC 
git bisect blames Bug 7310
Comment 2 Marcel de Rooy 2012-08-31 09:46:15 UTC 
I checked the code (that I changed sometime ago) and I tested again in 3.8.2.

When I am logged in and want to access a list from another, I get:
ERROR: You do not have adequate permission for that action on list 135.
This is the behavior expected.

When I logged out and tried again, this message did not come up. That is indeed an error!
Will submit a quick fix for that. Please test and sign off, if you can.
Comment 3 Marcel de Rooy 2012-08-31 09:53:17 UTC Comment hidden (obsolete)
Comment 4 Kyle M Hall (khall) 2012-08-31 11:38:13 UTC 
Created attachment 11905 [details] [review]
Bug 8706 - Private lists can be accessed by anyone

Signed-off-by: Kyle M Hall <kyle@bywatersolutions.com>

Confirmed private lists can be accessed directly before patch is
applied. After applying patch, I can no longer access the list
via the same url.
Comment 5 Owen Leonard 2012-08-31 12:52:49 UTC 
Thanks for the quick work Marcel! I can also confirm the fix works.
Comment 6 Jonathan Druart 2012-09-04 12:21:29 UTC 
The patch seems good but I can't reproduce the issue without the patch :)

I log in with user1, show his lists and click on one.
log out, relog with user2
I refresh the previous page (opac-shelves.pl?viewshelf=18) and I get an error : 
"ERROR: You do not have adequate permission for that action on list 18."

What I missed ?
Comment 7 Owen Leonard 2012-09-04 12:37:04 UTC 
To observe the bug, you must not be logged in to the OPAC.
Comment 8 Jonathan Druart 2012-09-04 13:09:35 UTC 
(In reply to comment #7)
> To observe the bug, you must not be logged in to the OPAC.

Ho ok ! :) Thanks Owen.

Marked as Passed QA
Comment 9 Paul Poulain 2012-09-05 13:36:54 UTC 
mmm... testing this patch (with plack, as usual), I got strange things once, that I can't reproduce:

 * go to shelves.pl page on staff interface = no list displayed (I have 4 in my database)
 * Add a new shelf. I got a nasty = ERROR: You do not have adequate permission for that action on list 42488.
 * kill plack & reload it = everything is OK

patch pushed, if someone face strange things, it means there is a problem, not related to some cache/plack/...
Comment 10 Chris Cormack 2012-09-06 05:14:32 UTC 
Pushed to 3.8.x will be in 3.8.5