Bug 3238

Summary: VirtualShelves are editable by anyone who is not logged in
Product: Koha Reporter: Nahuel Angelinetti <nahuel.angelinetti>
Component: ListsAssignee: Nahuel Angelinetti <nahuel.angelinetti>
Status: CLOSED INVALID QA Contact:
Severity: enhancement    
Priority: PATCH-Sent (DO NOT USE) CC: magnus, paul.poulain
Version: unspecified   
Hardware: PC   
OS: All   
Change sponsored?: --- Patch complexity: ---
Documentation contact: Documentation submission:
Text to go in the release notes:
Version(s) released in:
Circulation function:
Attachments: bugfix

Description Chris Cormack 2010-05-21 01:08:10 UTC 


---- Reported by nahuel.angelinetti@biblibre.com 2009-05-20 15:01:59 ----

If a user in opac is not logged in, he can modify any of the shelves.



---- Additional Comments From nahuel.angelinetti@biblibre.com 2009-05-20 15:06:28 ----

Created an attachment
bugfix





--- Bug imported by chris@bigballofwax.co.nz 2010-05-21 01:08 UTC  ---

This bug was previously known as _bug_ 3238 at http://bugs.koha.org/cgi-bin/bugzilla3/show_bug.cgi?id=3238
Imported an attachment (id=1174)

Actual time not defined. Setting to 0.0
The original submitter of attachment 1174 [details] [review] is unknown.
   Reassigning to the person who moved it here: chris@bigballofwax.co.nz.
Comment 1 Magnus Enger 2011-05-06 13:22:16 UTC 
The proposed patch changes one line from this: 

return 1 if (($category >= 2) and defined($user) and ($borrower->{authflags}->{superlibrarian} || $user == 0));	# public list, superlibrarian can edit/delete

to this: 

return 1 if (($category >= 2) and defined($user) and ($borrower->{authflags}->{superlibrarian}));	# public list, superlibrarian can edit/delete

In current HEAD this line still looks like the original line: 

return 1 if (($category >= 2) and defined($user) and ($borrower->{authflags}->{superlibrarian} || $user == 0));     # public list, superlibrarian can edit/delete

but I can not replicate the problem with non-logged in users editing public lists. The bug did not have a "patch sent" status. I'm setting it to "Needs signoff" - maybe someone can verify if the patch is still needed or the problem has been solved another way.
Comment 2 Paul Poulain 2011-05-11 15:50:18 UTC 
OK, I did many tests, I tried to forge an URL while not being authentified, I can't reproduce the error.
Nahuel has left BibLibre, so can't ask him (and he would have forgotten probably, patch is 2 years old !)

So closing this bug