Bug 7551

Summary: Any logged-in OPAC user can renew items for others using a properly constructed URL
Product: Koha Reporter: Owen Leonard <oleonard>
Component: OPACAssignee: Owen Leonard <oleonard>
Status: CLOSED FIXED QA Contact: Ian Walls <koha.sekjal>
Severity: critical    
Priority: P1 - high CC: chris, jwagner, paul.poulain
Version: 3.6   
Hardware: All   
OS: All   
Change sponsored?: --- Patch complexity: ---
Documentation contact: Documentation submission:
Text to go in the release notes:
Version(s) released in:
Circulation function:
Attachments: Bug 7551 : Can only renew for the user you are logged in as now
[SIGNED-OFF] Bug 7551 : Can only renew for the user you are logged in as now

Description Owen Leonard 2012-02-16 20:19:22 UTC 
opac-renew.pl takes whatever borrowernumber you give it, so if you know the borrowernumber and itemnumber of the patron and item you can renew items for anyone from the OPAC. In my test all that was required was a valid OPAC login.

To reproduce:

1. Log in to the OPAC as any valid user.
2. Point the browser to the URL of opac-renew.pl:

http://koha.example.com/cgi-bin/koha/opac-renew.pl?borrowernumber=X&item=Y

Where X is a Koha patron and Y is the itemnumber of something checked out to X.
Comment 1 Chris Cormack 2012-02-16 20:24:38 UTC Comment hidden (obsolete)
Comment 2 Owen Leonard 2012-02-16 20:40:36 UTC 
Created attachment 7705 [details] [review]
[SIGNED-OFF] Bug 7551 : Can only renew for the user you are logged in as now

Signed-off-by: Owen Leonard <oleonard@myacpl.org>
Comment 3 Ian Walls 2012-02-16 21:23:56 UTC 
Okay, this line has been in here since Koha 3.0, when the built-in SCO used to use opac-renew to do it's renewals.  Hence the need to use a different borrowernumber than your own.  Now that SCO handles it's own renewals, this is just a security risk.  Marking Passed QA.

Follow up patch can be written to update opac-user.tt to no longer transmit the borrowernumber, but that's just cleanup.