Bug 3651

Summary: Require patron login to send shelves and baskets
Product: Koha Reporter: Nahuel Angelinetti <nahuel.angelinetti>
Component: OPACAssignee: Owen Leonard <oleonard>
Status: CLOSED FIXED QA Contact:
Severity: critical    
Priority: P1 - high CC: chris, druthb, gmcharlt, katrin.fischer, paul.poulain
Version: 3.6   
Hardware: All   
OS: All   
Change sponsored?: --- Patch complexity: ---
Who signed the patch off: Text to go in the release notes:
Version(s) released in:
Bug Depends on:    
Bug Blocks: 7383    
Attachments: bugfix
Follow-up fix
[SIGNED-OFF] Bug 3651 Follow-up, Require patron login to send shelves and baskets

Description Chris Cormack 2010-05-21 01:13:19 UTC

---- Reported by nahuel.angelinetti@biblibre.com 2009-09-21 13:07:59 ----

Atm, sending shelves and baskets via OPAC can be used to SPAM or spoof the kohaadminemailaddress, it's really bad.
Only logged in user must be able to send shelves and baskets, and their name must appear in the sent email.

---- Additional Comments From nahuel.angelinetti@biblibre.com 2009-09-21 13:10:21 ----

Created an attachment

---- Additional Comments From gmcharlt@gmail.com 2010-02-18 18:02:39 ----

Patch pushed to HEAD.  Please test and close.

--- Bug imported by chris@bigballofwax.co.nz 2010-05-21 01:13 UTC  ---

This bug was previously known as _bug_ 3651 at http://bugs.koha.org/cgi-bin/bugzilla3/show_bug.cgi?id=3651
Imported an attachment (id=1481)

Actual time not defined. Setting to 0.0
The original submitter of attachment 1481 [details] [review] is unknown.
   Reassigning to the person who moved it here: chris@bigballofwax.co.nz.

Comment 1 Owen Leonard 2011-12-29 16:20:35 UTC
This appears to have been undone by the fix for Bug 4289.
Comment 2 Owen Leonard 2011-12-29 17:49:38 UTC Comment hidden (obsolete)
Comment 3 Katrin Fischer 2011-12-30 08:26:05 UTC
Created attachment 6968 [details] [review]
[SIGNED-OFF] Bug 3651 Follow-up, Require patron login to send shelves and baskets

The fix for Bug 4289, "Add a syspref 'OpacPublic', to hide OPAC
search-bar and force authentication on all OPAC pages" incorrectly
made some page permissions dependent on the value of the OpacPublic
setting. Some pages should require authentication no matter what.

This patch returns opac-sendbasket.pl to the state it was in before
Bug 4289, Bug 4274 notwithstanding. I have added the authentication
requirement to opac-sendshelf.pl to match.

Signed-off-by: Katrin Fischer <Katrin.Fischer.83@web.de>
1) sending cart requires login
2) sending shelf requires login
3) updating personal details requires login
Comment 4 Chris Cormack 2012-01-05 16:55:57 UTC
This patch also fixes opac-userupdate.pl so is a more serious patch. Without this, you don't need to be logged in to craft a url to request an update to anyones record.
Comment 5 Paul Poulain 2012-01-06 14:58:53 UTC
patch pushed again, please test