Bug 3094 - Public Virtual Shelf can be Modified / Deleted by any non-logged in patron
Summary: Public Virtual Shelf can be Modified / Deleted by any non-logged in patron
Alias: None
Product: Koha
Classification: Unclassified
Component: Lists (show other bugs)
Version: master
Hardware: All All
: P3 major (vote)
Assignee: Galen Charlton
QA Contact: Bugs List
Depends on:
Reported: 2009-04-07 05:47 UTC by Chris Cormack
Modified: 2012-10-26 00:40 UTC (History)
1 user (show)

See Also:
Change sponsored?: ---
Patch complexity: ---
Who signed the patch off:
Text to go in the release notes:
Version(s) released in:


Note You need to log in before you can comment on or make changes to this bug.
Description Chris Cormack 2010-05-21 01:06:19 UTC

---- Reported by drdrulm@yahoo.com 2009-04-07 17:47:44 ----

A Public Virtual Shelf can be Modified / Deleted by any non-logged in patron just like an 'Open' shelf regardless of ownership. 

If I log in, then the security takes over and users cannot edit shelves they don't own. 

When not logged in, any guest user can delete / modify any shelf. This is a new bug as far as I can see. Problem is in all browsers and makes public virtual shelves not secure because an anonymous user can change the NAME of a public virtual shelf to something else, perhaps something not so good!

---- Additional Comments From darrellulm@smfpl.org 2009-05-15 17:09:56 ----

There definitely needs to be a SYSPREF either allowing a patron to create (or not be allowed to create) PUBLIC shelves because if it is allowed, patrons can create a public shelf with *any* type of wording - i.e., think bad words!

Also, there should be control over the public shelves because some libraries will want to limit this. 

---- Additional Comments From drdrulm@yahoo.com 2009-07-02 15:45:26 ----

I changed the bug priory to major mainly because this nullifies the option of using the shelves. 

--- Bug imported by chris@bigballofwax.co.nz 2010-05-21 01:06 UTC  ---

This bug was previously known as _bug_ 3094 at http://bugs.koha.org/cgi-bin/bugzilla3/show_bug.cgi?id=3094

Actual time not defined. Setting to 0.0
The original reporter of this bug does not have
   an account here. Reassigning to the person who moved
   it here: chris@bigballofwax.co.nz.
   Previous reporter was drdrulm@yahoo.com.
CC member darrellulm@smfpl.org does not have an account here

Comment 1 Owen Leonard 2010-09-14 16:34:49 UTC
I see no way for a non-logged-in patron to edit a shelf. I also tried opening up a list edit page as a logged-in patron, logging out in another browser tab, and trying to submit the open edit page. I was told "You do not have adequate permission for that action."

Can anyone reproduce this in an up-to-date installation?