Summary: | Private lists can be accessed by anyone | ||
---|---|---|---|
Product: | Koha | Reporter: | Owen Leonard <oleonard> |
Component: | Lists | Assignee: | Marcel de Rooy <m.de.rooy> |
Status: | CLOSED FIXED | QA Contact: | Jonathan Druart <jonathan.druart> |
Severity: | critical | ||
Priority: | P5 - low | CC: | chris, jonathan.druart, kyle, m.de.rooy, paul.poulain |
Version: | 3.8 | ||
Hardware: | All | ||
OS: | All | ||
Change sponsored?: | --- | Patch complexity: | --- |
Documentation contact: | Documentation submission: | ||
Text to go in the release notes: | Version(s) released in: | ||
Circulation function: | |||
Attachments: |
Patch 8706
Bug 8706 - Private lists can be accessed by anyone |
Description
Owen Leonard
2012-08-30 20:03:32 UTC
I checked the code (that I changed sometime ago) and I tested again in 3.8.2. When I am logged in and want to access a list from another, I get: ERROR: You do not have adequate permission for that action on list 135. This is the behavior expected. When I logged out and tried again, this message did not come up. That is indeed an error! Will submit a quick fix for that. Please test and sign off, if you can. Created attachment 11904 [details] [review] Patch 8706 Created attachment 11905 [details] [review] Bug 8706 - Private lists can be accessed by anyone Signed-off-by: Kyle M Hall <kyle@bywatersolutions.com> Confirmed private lists can be accessed directly before patch is applied. After applying patch, I can no longer access the list via the same url. Thanks for the quick work Marcel! I can also confirm the fix works. The patch seems good but I can't reproduce the issue without the patch :) I log in with user1, show his lists and click on one. log out, relog with user2 I refresh the previous page (opac-shelves.pl?viewshelf=18) and I get an error : "ERROR: You do not have adequate permission for that action on list 18." What I missed ? To observe the bug, you must not be logged in to the OPAC. (In reply to comment #7) > To observe the bug, you must not be logged in to the OPAC. Ho ok ! :) Thanks Owen. Marked as Passed QA mmm... testing this patch (with plack, as usual), I got strange things once, that I can't reproduce: * go to shelves.pl page on staff interface = no list displayed (I have 4 in my database) * Add a new shelf. I got a nasty = ERROR: You do not have adequate permission for that action on list 42488. * kill plack & reload it = everything is OK patch pushed, if someone face strange things, it means there is a problem, not related to some cache/plack/... Pushed to 3.8.x will be in 3.8.5 |