Bug 17316 - Possible to see name of lists you don't own
Summary: Possible to see name of lists you don't own
Status: CLOSED FIXED
Alias: None
Product: Koha
Classification: Unclassified
Component: Lists (show other bugs)
Version: unspecified
Hardware: All All
: P5 - low normal (vote)
Assignee: Jonathan Druart
QA Contact: Testopia
URL:
Keywords:
Depends on: 14544
Blocks:
  Show dependency treegraph
 
Reported: 2016-09-18 19:40 UTC by Katrin Fischer
Modified: 2017-06-14 22:14 UTC (History)
6 users (show)

See Also:
Change sponsored?: ---
Patch complexity: Small patch
Who signed the patch off:
Text to go in the release notes:
Version(s) released in:


Attachments
Bug 17316: Do not display the list's name if the user does not have permission (1.96 KB, patch)
2016-09-20 08:58 UTC, Jonathan Druart
Details | Diff | Splinter Review
Bug 17316: Do not display the list's name if the user does not have permission - Staff (2.55 KB, patch)
2016-09-20 09:05 UTC, Jonathan Druart
Details | Diff | Splinter Review
Bug 17316: Do not display the list's name if the user does not have permission - OPAC (1.96 KB, patch)
2016-09-20 09:05 UTC, Jonathan Druart
Details | Diff | Splinter Review
Bug 17316: Do not display the list's name if the user does not have permission - Staff (2.55 KB, patch)
2016-09-20 09:05 UTC, Jonathan Druart
Details | Diff | Splinter Review
Bug 17316: Do not display the list's name if the user does not have permission - OPAC (2.13 KB, patch)
2016-09-20 09:17 UTC, Marc Véron
Details | Diff | Splinter Review
Bug 17316: Do not display the list's name if the user does not have permission - Staff (2.69 KB, patch)
2016-09-20 09:19 UTC, Marc Véron
Details | Diff | Splinter Review
[PASSED QA] Bug 17316: Do not display the list's name if the user does not have permission - OPAC (2.20 KB, patch)
2016-09-25 16:32 UTC, Katrin Fischer
Details | Diff | Splinter Review
[PASSED QA] Bug 17316: Do not display the list's name if the user does not have permission - Staff (2.76 KB, patch)
2016-09-25 16:33 UTC, Katrin Fischer
Details | Diff | Splinter Review

Note You need to log in before you can comment on or make changes to this bug.
Description Katrin Fischer 2016-09-18 19:40:27 UTC
When you try to access a list you haven't created/you are not the owner of by manipulating the URL, you can't see the entries, but you can see the name of the list:

../cgi-bin/koha/opac-shelves.pl?op=view&shelfnumber=1&sortfield=title
Comment 1 Marc Véron 2016-09-19 08:13:38 UTC
Confirmed.
Name of list is visible in breadcrumbs as well...
Comment 2 Jonathan Druart 2016-09-20 08:58:52 UTC
Created attachment 55707 [details] [review]
Bug 17316: Do not display the list's name if the user does not have permission

At the OPAC, if a user manipulate the URL to show a list (s)he is not
allowed to view, the list's name will be displayed anyway.

Test plan:
- Create a private list with user A
- Copy the op=view URL and access it with user B logged in
=> Without this patch, you will see the rss icon, the list's name and
the "add list" button
=> Without this patch, only the "unauthorized" box will be displayed
Comment 3 Jonathan Druart 2016-09-20 09:01:11 UTC
Same problem on the staff interface.
Comment 4 Jonathan Druart 2016-09-20 09:05:15 UTC
Created attachment 55708 [details] [review]
Bug 17316: Do not display the list's name if the user does not have permission - Staff

Same as previous patch but for the staff interface
Comment 5 Jonathan Druart 2016-09-20 09:05:37 UTC
Created attachment 55709 [details] [review]
Bug 17316: Do not display the list's name if the user does not have permission - OPAC

At the OPAC, if a user manipulate the URL to show a list (s)he is not
allowed to view, the list's name will be displayed anyway.

Test plan:
- Create a private list with user A
- Copy the op=view URL and access it with user B logged in
=> Without this patch, you will see the rss icon, the list's name and
the "add list" button
=> Without this patch, only the "unauthorized" box will be displayed
Comment 6 Jonathan Druart 2016-09-20 09:05:40 UTC
Created attachment 55710 [details] [review]
Bug 17316: Do not display the list's name if the user does not have permission - Staff

Same as previous patch but for the staff interface
Comment 7 Marc Véron 2016-09-20 09:17:21 UTC
Created attachment 55711 [details] [review]
Bug 17316: Do not display the list's name if the user does not have permission - OPAC

At the OPAC, if a user manipulate the URL to show a list (s)he is not
allowed to view, the list's name will be displayed anyway.

Test plan:
- Create a private list with user A
- Copy the op=view URL and access it with user B logged in
=> Without this patch, you will see the rss icon, the list's name and
the "add list" button
=> Without this patch, only the "unauthorized" box will be displayed

Followed test plan, works as expected.
Signed-off-by: Marc Véron <veron@veron.ch>
Comment 8 Marc Véron 2016-09-20 09:19:37 UTC
Created attachment 55712 [details] [review]
Bug 17316: Do not display the list's name if the user does not have permission - Staff

Same as previous patch but for the staff interface

Signed-off-by: Marc Véron <veron@veron.ch>
Comment 9 Katrin Fischer 2016-09-25 16:31:02 UTC
Much better, thx for fixing!
Comment 10 Katrin Fischer 2016-09-25 16:32:08 UTC
Created attachment 55802 [details] [review]
[PASSED QA] Bug 17316: Do not display the list's name if the user does not have permission - OPAC

At the OPAC, if a user manipulate the URL to show a list (s)he is not
allowed to view, the list's name will be displayed anyway.

Test plan:
- Create a private list with user A
- Copy the op=view URL and access it with user B logged in
=> Without this patch, you will see the rss icon, the list's name and
the "add list" button
=> Without this patch, only the "unauthorized" box will be displayed

Followed test plan, works as expected.
Signed-off-by: Marc Véron <veron@veron.ch>

Signed-off-by: Katrin Fischer  <katrin.fischer@bsz-bw.de>
Comment 11 Katrin Fischer 2016-09-25 16:33:23 UTC
Created attachment 55803 [details] [review]
[PASSED QA] Bug 17316: Do not display the list's name if the user does not have permission - Staff

Same as previous patch but for the staff interface

Signed-off-by: Marc Véron <veron@veron.ch>

Signed-off-by: Katrin Fischer  <katrin.fischer@bsz-bw.de>
Comment 12 Kyle M Hall 2016-09-27 10:37:25 UTC
Pushed to master for 16.11, thanks Jonathan!
Comment 13 Frédéric Demians 2016-09-30 08:12:01 UTC
Pushed in 16.05. Will be in 16.05.05.
Comment 14 Julian Maurice 2016-10-14 10:30:35 UTC
Pushed to 3.22.x, will be in 3.22.12