|Summary:||Private lists can be accessed by anyone|
|Product:||Koha||Reporter:||Owen Leonard <oleonard>|
|Component:||Lists||Assignee:||Marcel de Rooy <m.de.rooy>|
|Status:||CLOSED FIXED||QA Contact:||Jonathan Druart <jonathan.druart+koha>|
|Priority:||P5 - low||CC:||chris, jonathan.druart+koha, kyle, m.de.rooy, paul.poulain|
|Change sponsored?:||---||Patch complexity:||---|
|Documentation contact:||Documentation submission:|
|Text to go in the release notes:||Version(s) released in:|
Bug 8706 - Private lists can be accessed by anyone
Description Owen Leonard 2012-08-30 20:03:32 UTC
Any private list can be accessed by any user by typing the shelf number in the URL: /cgi-bin/koha/opac-shelves.pl?viewshelf=XXX
Comment 2 Marcel de Rooy 2012-08-31 09:46:15 UTC
I checked the code (that I changed sometime ago) and I tested again in 3.8.2. When I am logged in and want to access a list from another, I get: ERROR: You do not have adequate permission for that action on list 135. This is the behavior expected. When I logged out and tried again, this message did not come up. That is indeed an error! Will submit a quick fix for that. Please test and sign off, if you can.
Comment 3 Marcel de Rooy 2012-08-31 09:53:17 UTC Comment hidden (obsolete)
Created attachment 11904 [details] [review] Patch 8706
Comment 4 Kyle M Hall 2012-08-31 11:38:13 UTC
Created attachment 11905 [details] [review] Bug 8706 - Private lists can be accessed by anyone Signed-off-by: Kyle M Hall <email@example.com> Confirmed private lists can be accessed directly before patch is applied. After applying patch, I can no longer access the list via the same url.
Comment 5 Owen Leonard 2012-08-31 12:52:49 UTC
Thanks for the quick work Marcel! I can also confirm the fix works.
Comment 6 Jonathan Druart 2012-09-04 12:21:29 UTC
The patch seems good but I can't reproduce the issue without the patch :) I log in with user1, show his lists and click on one. log out, relog with user2 I refresh the previous page (opac-shelves.pl?viewshelf=18) and I get an error : "ERROR: You do not have adequate permission for that action on list 18." What I missed ?
Comment 7 Owen Leonard 2012-09-04 12:37:04 UTC
To observe the bug, you must not be logged in to the OPAC.
Comment 8 Jonathan Druart 2012-09-04 13:09:35 UTC
(In reply to comment #7) > To observe the bug, you must not be logged in to the OPAC. Ho ok ! :) Thanks Owen. Marked as Passed QA
Comment 9 Paul Poulain 2012-09-05 13:36:54 UTC
mmm... testing this patch (with plack, as usual), I got strange things once, that I can't reproduce: * go to shelves.pl page on staff interface = no list displayed (I have 4 in my database) * Add a new shelf. I got a nasty = ERROR: You do not have adequate permission for that action on list 42488. * kill plack & reload it = everything is OK patch pushed, if someone face strange things, it means there is a problem, not related to some cache/plack/...
Comment 10 Chris Cormack 2012-09-06 05:14:32 UTC
Pushed to 3.8.x will be in 3.8.5