| Summary: | VirtualShelves are editable by anyone who is not logged in | ||
|---|---|---|---|
| Product: | Koha | Reporter: | Nahuel Angelinetti <nahuel.angelinetti> |
| Component: | Lists | Assignee: | Nahuel Angelinetti <nahuel.angelinetti> |
| Status: | CLOSED INVALID | QA Contact: | |
| Severity: | enhancement | ||
| Priority: | PATCH-Sent (DO NOT USE) | CC: | magnus, paul.poulain |
| Version: | unspecified | ||
| Hardware: | PC | ||
| OS: | All | ||
| GIT URL: | Initiative type: | --- | |
| Sponsorship status: | --- | Comma delimited list of Sponsors: | |
| Crowdfunding goal: | 0 | Patch complexity: | --- |
| Documentation contact: | Documentation submission: | ||
| Text to go in the release notes: | Version(s) released in: | ||
| Circulation function: | |||
| Attachments: | bugfix | ||
|
Description
Chris Cormack
2010-05-21 01:08:10 UTC
The proposed patch changes one line from this:
return 1 if (($category >= 2) and defined($user) and ($borrower->{authflags}->{superlibrarian} || $user == 0)); # public list, superlibrarian can edit/delete
to this:
return 1 if (($category >= 2) and defined($user) and ($borrower->{authflags}->{superlibrarian})); # public list, superlibrarian can edit/delete
In current HEAD this line still looks like the original line:
return 1 if (($category >= 2) and defined($user) and ($borrower->{authflags}->{superlibrarian} || $user == 0)); # public list, superlibrarian can edit/delete
but I can not replicate the problem with non-logged in users editing public lists. The bug did not have a "patch sent" status. I'm setting it to "Needs signoff" - maybe someone can verify if the patch is still needed or the problem has been solved another way.
OK, I did many tests, I tried to forge an URL while not being authentified, I can't reproduce the error. Nahuel has left BibLibre, so can't ask him (and he would have forgotten probably, patch is 2 years old !) So closing this bug |