Bug 3094

---- Reported by drdrulm@yahoo.com 2009-04-07 17:47:44 ----

A Public Virtual Shelf can be Modified / Deleted by any non-logged in patron just like an 'Open' shelf regardless of ownership. 

If I log in, then the security takes over and users cannot edit shelves they don't own. 

When not logged in, any guest user can delete / modify any shelf. This is a new bug as far as I can see. Problem is in all browsers and makes public virtual shelves not secure because an anonymous user can change the NAME of a public virtual shelf to something else, perhaps something not so good!



---- Additional Comments From darrellulm@smfpl.org 2009-05-15 17:09:56 ----

There definitely needs to be a SYSPREF either allowing a patron to create (or not be allowed to create) PUBLIC shelves because if it is allowed, patrons can create a public shelf with *any* type of wording - i.e., think bad words!

Also, there should be control over the public shelves because some libraries will want to limit this. 



---- Additional Comments From drdrulm@yahoo.com 2009-07-02 15:45:26 ----

I changed the bug priory to major mainly because this nullifies the option of using the shelves. 



--- Bug imported by chris@bigballofwax.co.nz 2010-05-21 01:06 UTC  ---

This bug was previously known as _bug_ 3094 at http://bugs.koha.org/cgi-bin/bugzilla3/show_bug.cgi?id=3094

Actual time not defined. Setting to 0.0
The original reporter of this bug does not have
   an account here. Reassigning to the person who moved
   it here: chris@bigballofwax.co.nz.
   Previous reporter was drdrulm@yahoo.com.
CC member darrellulm@smfpl.org does not have an account here