Bug 6631 - Unrestricted creation of lists by anonymous users
Summary: Unrestricted creation of lists by anonymous users
Status: CLOSED FIXED
Alias: None
Product: Koha
Classification: Unclassified
Component: Lists (show other bugs)
Version: 3.6
Hardware: All All
: P5 - low major (vote)
Assignee: Aleksa Vujicic
QA Contact: Bugs List
URL:
Keywords:
: 7473 (view as bug list)
Depends on:
Blocks: 7310
  Show dependency treegraph
 
Reported: 2011-07-26 09:12 UTC by Sébastien Marie
Modified: 2013-12-05 19:57 UTC (History)
4 users (show)

See Also:
Change sponsored?: ---
Patch complexity: ---
Text to go in the release notes:
Version(s) released in:


Attachments
Made page require authentication. (844 bytes, patch)
2012-01-24 01:13 UTC, Aleksa Vujicic
Details | Diff | Splinter Review
Bug 6631: Anonymous users can create lists in OPAC (1017 bytes, patch)
2012-01-29 14:31 UTC, Jared Camins-Esakov
Details | Diff | Splinter Review

Note You need to log in before you can comment on or make changes to this bug.
Description Sébastien Marie 2011-07-26 09:12:04 UTC
Using direct call to "/cgi-bin/koha/opac-addbybiblionumber.pl?biblionumber=xxx", an anonymous user is able to create Lists.

The new created list is owner by kohaadmin (at least on my site).
Comment 1 Owen Leonard 2011-09-20 15:11:10 UTC
Confirmed, although it doesn't look to me like the kohaadmin user can manage it. In the virtualshelves table the owner is NULL. If someone used this method to create a private list the administrator wouldn't have any way to remove it via the interface (not that anyone could see that it had been created).
Comment 2 Aleksa Vujicic 2012-01-24 01:13:58 UTC Comment hidden (obsolete)
Comment 3 Jared Camins-Esakov 2012-01-29 14:31:57 UTC
Created attachment 7380 [details] [review]
Bug 6631: Anonymous users can create lists in OPAC

Made opac-addbybiblionumber.pl page require authentication.

Signed-off-by: Jared Camins-Esakov <jcamins@cpbibliography.com>
Comment 4 Marcel de Rooy 2012-02-01 14:51:57 UTC
I would propose to solve this issue in connection with report 7310 (working on it ..)
We should not allow anonymous to create a list. Another related issue is if you should allow anonymous to add a biblio to a public list. I think that we should not allow it either. Making a list or adding an entry is the privilege of known users.
Comment 5 Paul Poulain 2012-02-01 16:56:54 UTC
QA comment:
 * tiny patch, everything OK
 * upgrading severity
 * welcome Aleksa Vujicic to the list of contributors, you're 172th !
Comment 6 Jared Camins-Esakov 2012-05-23 12:57:30 UTC
This fix was included in the 3.6.x branch prior to 3.6.4.
Comment 7 Adrien SAURAT 2012-09-20 10:02:45 UTC
*** Bug 7473 has been marked as a duplicate of this bug. ***