---- Reported by firstname.lastname@example.org 2009-04-07 17:47:44 ----
A Public Virtual Shelf can be Modified / Deleted by any non-logged in patron just like an 'Open' shelf regardless of ownership.
If I log in, then the security takes over and users cannot edit shelves they don't own.
When not logged in, any guest user can delete / modify any shelf. This is a new bug as far as I can see. Problem is in all browsers and makes public virtual shelves not secure because an anonymous user can change the NAME of a public virtual shelf to something else, perhaps something not so good!
---- Additional Comments From email@example.com 2009-05-15 17:09:56 ----
There definitely needs to be a SYSPREF either allowing a patron to create (or not be allowed to create) PUBLIC shelves because if it is allowed, patrons can create a public shelf with *any* type of wording - i.e., think bad words!
Also, there should be control over the public shelves because some libraries will want to limit this.
---- Additional Comments From firstname.lastname@example.org 2009-07-02 15:45:26 ----
I changed the bug priory to major mainly because this nullifies the option of using the shelves.
--- Bug imported by email@example.com 2010-05-21 01:06 UTC ---
This bug was previously known as _bug_ 3094 at http://bugs.koha.org/cgi-bin/bugzilla3/show_bug.cgi?id=3094
Actual time not defined. Setting to 0.0
The original reporter of this bug does not have
an account here. Reassigning to the person who moved
it here: firstname.lastname@example.org.
Previous reporter was email@example.com.
CC member firstname.lastname@example.org does not have an account here
I see no way for a non-logged-in patron to edit a shelf. I also tried opening up a list edit page as a logged-in patron, logging out in another browser tab, and trying to submit the open edit page. I was told "You do not have adequate permission for that action."
Can anyone reproduce this in an up-to-date installation?