Bug 6631

Summary: Unrestricted creation of lists by anonymous users
Product: Koha Reporter: Sébastien Marie <semarie>
Component: ListsAssignee: Aleksa Vujicic <aleksa>
Status: CLOSED FIXED QA Contact: Bugs List <koha-bugs>
Severity: major    
Priority: P5 - low CC: adrien.saurat, jcamins, m.de.rooy, paul.poulain
Version: 3.6   
Hardware: All   
OS: All   
See Also: http://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=7473
Change sponsored?: --- Patch complexity: ---
Documentation contact: Documentation submission:
Text to go in the release notes:
Version(s) released in:
Bug Depends on:    
Bug Blocks: 7310    
Attachments: Made page require authentication.
Bug 6631: Anonymous users can create lists in OPAC

Description Sébastien Marie 2011-07-26 09:12:04 UTC
Using direct call to "/cgi-bin/koha/opac-addbybiblionumber.pl?biblionumber=xxx", an anonymous user is able to create Lists.

The new created list is owner by kohaadmin (at least on my site).
Comment 1 Owen Leonard 2011-09-20 15:11:10 UTC
Confirmed, although it doesn't look to me like the kohaadmin user can manage it. In the virtualshelves table the owner is NULL. If someone used this method to create a private list the administrator wouldn't have any way to remove it via the interface (not that anyone could see that it had been created).
Comment 2 Aleksa Vujicic 2012-01-24 01:13:58 UTC Comment hidden (obsolete)
Comment 3 Jared Camins-Esakov 2012-01-29 14:31:57 UTC
Created attachment 7380 [details] [review]
Bug 6631: Anonymous users can create lists in OPAC

Made opac-addbybiblionumber.pl page require authentication.

Signed-off-by: Jared Camins-Esakov <jcamins@cpbibliography.com>
Comment 4 Marcel de Rooy 2012-02-01 14:51:57 UTC
I would propose to solve this issue in connection with report 7310 (working on it ..)
We should not allow anonymous to create a list. Another related issue is if you should allow anonymous to add a biblio to a public list. I think that we should not allow it either. Making a list or adding an entry is the privilege of known users.
Comment 5 Paul Poulain 2012-02-01 16:56:54 UTC
QA comment:
 * tiny patch, everything OK
 * upgrading severity
 * welcome Aleksa Vujicic to the list of contributors, you're 172th !
Comment 6 Jared Camins-Esakov 2012-05-23 12:57:30 UTC
This fix was included in the 3.6.x branch prior to 3.6.4.
Comment 7 Adrien SAURAT 2012-09-20 10:02:45 UTC
*** Bug 7473 has been marked as a duplicate of this bug. ***