Bug 3651 - Require patron login to send shelves and baskets
Summary: Require patron login to send shelves and baskets
Alias: None
Product: Koha
Classification: Unclassified
Component: OPAC (show other bugs)
Version: 3.6
Hardware: All All
: P1 - high critical (vote)
Assignee: Owen Leonard
QA Contact:
Depends on:
Blocks: 7383
  Show dependency treegraph
Reported: 2009-09-21 01:07 UTC by Nahuel Angelinetti
Modified: 2019-06-27 09:24 UTC (History)
5 users (show)

See Also:
Change sponsored?: ---
Patch complexity: ---
Text to go in the release notes:
Version(s) released in:

bugfix (3.87 KB, patch)
2009-09-21 13:10 UTC, Chris Cormack
Details | Diff | Splinter Review
Follow-up fix (2.41 KB, patch)
2011-12-29 17:49 UTC, Owen Leonard
Details | Diff | Splinter Review
[SIGNED-OFF] Bug 3651 Follow-up, Require patron login to send shelves and baskets (2.54 KB, patch)
2011-12-30 08:26 UTC, Katrin Fischer
Details | Diff | Splinter Review

Note You need to log in before you can comment on or make changes to this bug.
Description Chris Cormack 2010-05-21 01:13:19 UTC

---- Reported by nahuel.angelinetti@biblibre.com 2009-09-21 13:07:59 ----

Atm, sending shelves and baskets via OPAC can be used to SPAM or spoof the kohaadminemailaddress, it's really bad.
Only logged in user must be able to send shelves and baskets, and their name must appear in the sent email.

---- Additional Comments From nahuel.angelinetti@biblibre.com 2009-09-21 13:10:21 ----

Created an attachment

---- Additional Comments From gmcharlt@gmail.com 2010-02-18 18:02:39 ----

Patch pushed to HEAD.  Please test and close.

--- Bug imported by chris@bigballofwax.co.nz 2010-05-21 01:13 UTC  ---

This bug was previously known as _bug_ 3651 at http://bugs.koha.org/cgi-bin/bugzilla3/show_bug.cgi?id=3651
Imported an attachment (id=1481)

Actual time not defined. Setting to 0.0
The original submitter of attachment 1481 [details] [review] is unknown.
   Reassigning to the person who moved it here: chris@bigballofwax.co.nz.

Comment 1 Owen Leonard 2011-12-29 16:20:35 UTC
This appears to have been undone by the fix for Bug 4289.
Comment 2 Owen Leonard 2011-12-29 17:49:38 UTC Comment hidden (obsolete)
Comment 3 Katrin Fischer 2011-12-30 08:26:05 UTC
Created attachment 6968 [details] [review]
[SIGNED-OFF] Bug 3651 Follow-up, Require patron login to send shelves and baskets

The fix for Bug 4289, "Add a syspref 'OpacPublic', to hide OPAC
search-bar and force authentication on all OPAC pages" incorrectly
made some page permissions dependent on the value of the OpacPublic
setting. Some pages should require authentication no matter what.

This patch returns opac-sendbasket.pl to the state it was in before
Bug 4289, Bug 4274 notwithstanding. I have added the authentication
requirement to opac-sendshelf.pl to match.

Signed-off-by: Katrin Fischer <Katrin.Fischer.83@web.de>
1) sending cart requires login
2) sending shelf requires login
3) updating personal details requires login
Comment 4 Chris Cormack 2012-01-05 16:55:57 UTC
This patch also fixes opac-userupdate.pl so is a more serious patch. Without this, you don't need to be logged in to craft a url to request an update to anyones record.
Comment 5 Paul Poulain 2012-01-06 14:58:53 UTC
patch pushed again, please test