| Summary: | Unrestricted creation of lists by anonymous users | ||
|---|---|---|---|
| Product: | Koha | Reporter: | Sébastien Marie <semarie> |
| Component: | Lists | Assignee: | Aleksa Vujicic <aleksa> |
| Status: | CLOSED FIXED | QA Contact: | Bugs List <koha-bugs> |
| Severity: | major | ||
| Priority: | P5 - low | CC: | adrien.saurat, jcamins, m.de.rooy, paul.poulain |
| Version: | 3.6 | ||
| Hardware: | All | ||
| OS: | All | ||
| See Also: | http://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=7473 | ||
| Change sponsored?: | --- | Patch complexity: | --- |
| Documentation contact: | Documentation submission: | ||
| Text to go in the release notes: | Version(s) released in: | ||
| Circulation function: | |||
| Bug Depends on: | |||
| Bug Blocks: | 7310 | ||
| Attachments: |
Made page require authentication.
Bug 6631: Anonymous users can create lists in OPAC |
||
|
Description
Sébastien Marie
2011-07-26 09:12:04 UTC
Confirmed, although it doesn't look to me like the kohaadmin user can manage it. In the virtualshelves table the owner is NULL. If someone used this method to create a private list the administrator wouldn't have any way to remove it via the interface (not that anyone could see that it had been created). Created attachment 7307 [details] [review] Made page require authentication. Created attachment 7380 [details] [review] Bug 6631: Anonymous users can create lists in OPAC Made opac-addbybiblionumber.pl page require authentication. Signed-off-by: Jared Camins-Esakov <jcamins@cpbibliography.com> I would propose to solve this issue in connection with report 7310 (working on it ..) We should not allow anonymous to create a list. Another related issue is if you should allow anonymous to add a biblio to a public list. I think that we should not allow it either. Making a list or adding an entry is the privilege of known users. QA comment: * tiny patch, everything OK * upgrading severity * welcome Aleksa Vujicic to the list of contributors, you're 172th ! This fix was included in the 3.6.x branch prior to 3.6.4. |