Bug 9270 - Web-based SCO requires superlibrarian privileges
Summary: Web-based SCO requires superlibrarian privileges
Status: CLOSED WORKSFORME
Alias: None
Product: Koha
Classification: Unclassified
Component: Self checkout (show other bugs)
Version: Main
Hardware: All All
: P5 - low critical (vote)
Assignee: Bugs List
QA Contact:
URL:
Keywords:
Depends on:
Blocks:
 
Reported: 2012-12-12 12:58 UTC by Jared Camins-Esakov
Modified: 2019-06-27 09:24 UTC (History)
1 user (show)

See Also:
Change sponsored?: ---
Patch complexity: ---
Documentation contact:
Documentation submission:
Text to go in the release notes:
Version(s) released in:


Attachments

Note You need to log in before you can comment on or make changes to this bug.
Description Jared Camins-Esakov 2012-12-12 12:58:07 UTC
It would seem that the self-check user must have superlibrarian privileges, rather than the more safe-seeming circulation privileges. This is a bit of a security issue, since the cookies used on the self-checkout machine could then be modified for use with the staff client.
Comment 1 Galen Charlton 2014-05-06 15:22:15 UTC
This doesn't appear to be the case:

opac/sco/help.pl:      flagsrequired => {circulate => "circulate_remaining_permissions"},
opac/sco/sco-main.pl:    flagsrequired => { circulate => "circulate_remaining_permissions" },
opac/sco/sco-patron-image.pl:my ($query, $response) = C4::Service->init(circulate => 'circulate_remaining_permissions');

I've also tested this directly -- a normal staff user with just the circulation permission works fine.