| Summary: | Any logged-in OPAC user can renew items for others using a properly constructed URL | ||
|---|---|---|---|
| Product: | Koha | Reporter: | Owen Leonard <oleonard> |
| Component: | OPAC | Assignee: | Owen Leonard <oleonard> |
| Status: | CLOSED FIXED | QA Contact: | Ian Walls <koha.sekjal> |
| Severity: | critical | ||
| Priority: | P1 - high | CC: | chris, jwagner, paul.poulain |
| Version: | 3.6 | ||
| Hardware: | All | ||
| OS: | All | ||
| GIT URL: | Initiative type: | --- | |
| Sponsorship status: | --- | Comma delimited list of Sponsors: | |
| Crowdfunding goal: | 0 | Patch complexity: | --- |
| Documentation contact: | Documentation submission: | ||
| Text to go in the release notes: | Version(s) released in: | ||
| Circulation function: | |||
| Attachments: |
Bug 7551 : Can only renew for the user you are logged in as now
[SIGNED-OFF] Bug 7551 : Can only renew for the user you are logged in as now |
||
|
Description
Owen Leonard
2012-02-16 20:19:22 UTC
Created attachment 7704 [details] [review] Bug 7551 : Can only renew for the user you are logged in as now Created attachment 7705 [details] [review] [SIGNED-OFF] Bug 7551 : Can only renew for the user you are logged in as now Signed-off-by: Owen Leonard <oleonard@myacpl.org> Okay, this line has been in here since Koha 3.0, when the built-in SCO used to use opac-renew to do it's renewals. Hence the need to use a different borrowernumber than your own. Now that SCO handles it's own renewals, this is just a security risk. Marking Passed QA. Follow up patch can be written to update opac-user.tt to no longer transmit the borrowernumber, but that's just cleanup. |