Bug 3140

Summary: It is possible to email someone else's private list
Product: Koha Reporter: Owen Leonard <oleonard>
Component: ListsAssignee: Owen Leonard <oleonard>
Status: CLOSED FIXED QA Contact:
Severity: major    
Priority: PATCH-Sent (DO NOT USE) CC: chris, koha.sekjal, nengard, paul.poulain
Version: Main   
Hardware: All   
OS: All   
Change sponsored?: --- Patch complexity: ---
Documentation contact: Documentation submission:
Text to go in the release notes:
Version(s) released in:
Circulation function:
Attachments: Proposed fix for the OPAC
proposed fix signed-off

Description Chris Cormack 2010-05-21 01:06:56 UTC

---- Reported by oleonard@myacpl.org 2009-04-18 22:05:39 ----

If you copy the URL of the "send list" popup window you can change the shelfid value and send yourself any list regardless of who owns it.



---- Additional Comments From joe.atzberger@liblime.com 2009-05-28 16:04:26 ----

Note that you can see the list, but you don't know whose list it is.  So there isn't as much privacy concern as there otherwise might be.



--- Bug imported by chris@bigballofwax.co.nz 2010-05-21 01:06 UTC  ---

This bug was previously known as _bug_ 3140 at http://bugs.koha.org/cgi-bin/bugzilla3/show_bug.cgi?id=3140

Actual time not defined. Setting to 0.0
CC member joe.atzberger@liblime.com does not have an account here

Comment 1 Owen Leonard 2011-05-17 14:19:32 UTC
This bug still exists in master.
[+] Comment 2 Owen Leonard 2011-05-17 15:25:32 UTC Comment hidden (obsolete)
Comment 3 Paul Poulain 2011-05-19 09:41:04 UTC
Created attachment 4189 [details] [review]
proposed fix signed-off
Comment 4 Ian Walls 2011-05-25 21:07:12 UTC
tested, confirmed, marking as Passed QA
Comment 5 Chris Cormack 2011-05-25 21:54:49 UTC
Permission works, pushed please test and mark resolved
Comment 6 Ian Walls 2011-12-02 14:27:21 UTC
Working in master since May.  Closing.