Bug 3651

Summary:	Require patron login to send shelves and baskets
Product:	Koha	Reporter:	Nahuel Angelinetti <nahuel.angelinetti>
Component:	OPAC	Assignee:	Owen Leonard <oleonard>
Status:	CLOSED FIXED	QA Contact:
Severity:	critical
Priority:	P1 - high	CC:	chris, gmcharlt, paul.poulain, ruth
Version:	3.6
Hardware:	All
OS:	All
Change sponsored?:	---	Patch complexity:	---
Documentation contact:		Documentation submission:
Text to go in the release notes:		Version(s) released in:
Circulation function:
Bug Depends on:
Bug Blocks:	7383
Attachments:	bugfix Follow-up fix [SIGNED-OFF] Bug 3651 Follow-up, Require patron login to send shelves and baskets

Description Chris Cormack 2010-05-21 01:13:19 UTC



---- Reported by nahuel.angelinetti@biblibre.com 2009-09-21 13:07:59 ----

Atm, sending shelves and baskets via OPAC can be used to SPAM or spoof the kohaadminemailaddress, it's really bad.
Only logged in user must be able to send shelves and baskets, and their name must appear in the sent email.



---- Additional Comments From nahuel.angelinetti@biblibre.com 2009-09-21 13:10:21 ----

Created an attachment
bugfix





---- Additional Comments From gmcharlt@gmail.com 2010-02-18 18:02:39 ----

Patch pushed to HEAD.  Please test and close.



--- Bug imported by chris@bigballofwax.co.nz 2010-05-21 01:13 UTC  ---

This bug was previously known as _bug_ 3651 at http://bugs.koha.org/cgi-bin/bugzilla3/show_bug.cgi?id=3651
Imported an attachment (id=1481)

Actual time not defined. Setting to 0.0
The original submitter of attachment 1481 [details] [review] is unknown.
   Reassigning to the person who moved it here: chris@bigballofwax.co.nz.

Comment 1 Owen Leonard 2011-12-29 16:20:35 UTC

This appears to have been undone by the fix for Bug 4289.

Comment 2 Owen Leonard 2011-12-29 17:49:38 UTC Comment hidden (obsolete)

Created attachment 6955 [details] [review]
Follow-up fix

    The fix for Bug 4289, "Add a syspref 'OpacPublic', to hide OPAC
    search-bar and force authentication on all OPAC pages" incorrectly
    made some page permissions dependent on the value of the OpacPublic
    setting. Some pages should require authentication no matter what.
    
    This patch returns opac-sendbasket.pl to the state it was in before
    Bug 4289, Bug 4274 notwithstanding. I have added the authentication
    requirement to opac-sendshelf.pl to match.

Comment 3 Katrin Fischer 2011-12-30 08:26:05 UTC

Created attachment 6968 [details] [review]
[SIGNED-OFF] Bug 3651 Follow-up, Require patron login to send shelves and baskets

The fix for Bug 4289, "Add a syspref 'OpacPublic', to hide OPAC
search-bar and force authentication on all OPAC pages" incorrectly
made some page permissions dependent on the value of the OpacPublic
setting. Some pages should require authentication no matter what.

This patch returns opac-sendbasket.pl to the state it was in before
Bug 4289, Bug 4274 notwithstanding. I have added the authentication
requirement to opac-sendshelf.pl to match.

Signed-off-by: Katrin Fischer <Katrin.Fischer.83@web.de>
1) sending cart requires login
2) sending shelf requires login
3) updating personal details requires login

Comment 4 Chris Cormack 2012-01-05 16:55:57 UTC

This patch also fixes opac-userupdate.pl so is a more serious patch. Without this, you don't need to be logged in to craft a url to request an update to anyones record.

Comment 5 Paul Poulain 2012-01-06 14:58:53 UTC

patch pushed again, please test