Bug 8706 - Private lists can be accessed by anyone
Summary: Private lists can be accessed by anyone
Status: CLOSED FIXED
Alias: None
Product: Koha
Classification: Unclassified
Component: Lists (show other bugs)
Version: 3.8
Hardware: All All
: P5 - low critical (vote)
Assignee: Marcel de Rooy
QA Contact: Jonathan Druart
URL:
Keywords:
Depends on:
Blocks:
 
Reported: 2012-08-30 20:03 UTC by Owen Leonard
Modified: 2019-06-27 09:24 UTC (History)
5 users (show)

See Also:
Change sponsored?: ---
Patch complexity: ---
Documentation contact:
Documentation submission:
Text to go in the release notes:
Version(s) released in:


Attachments
Patch 8706 (976 bytes, patch)
2012-08-31 09:53 UTC, Marcel de Rooy
Details | Diff | Splinter Review
Bug 8706 - Private lists can be accessed by anyone (1.15 KB, patch)
2012-08-31 11:38 UTC, Kyle M Hall
Details | Diff | Splinter Review

Note You need to log in before you can comment on or make changes to this bug.
Description Owen Leonard 2012-08-30 20:03:32 UTC
Any private list can be accessed by any user by typing the shelf number in the URL:

/cgi-bin/koha/opac-shelves.pl?viewshelf=XXX
Comment 1 Owen Leonard 2012-08-30 20:14:38 UTC
git bisect blames Bug 7310
Comment 2 Marcel de Rooy 2012-08-31 09:46:15 UTC
I checked the code (that I changed sometime ago) and I tested again in 3.8.2.

When I am logged in and want to access a list from another, I get:
ERROR: You do not have adequate permission for that action on list 135.
This is the behavior expected.

When I logged out and tried again, this message did not come up. That is indeed an error!
Will submit a quick fix for that. Please test and sign off, if you can.
Comment 3 Marcel de Rooy 2012-08-31 09:53:17 UTC Comment hidden (obsolete)
Comment 4 Kyle M Hall 2012-08-31 11:38:13 UTC
Created attachment 11905 [details] [review]
Bug 8706 - Private lists can be accessed by anyone

Signed-off-by: Kyle M Hall <kyle@bywatersolutions.com>

Confirmed private lists can be accessed directly before patch is
applied. After applying patch, I can no longer access the list
via the same url.
Comment 5 Owen Leonard 2012-08-31 12:52:49 UTC
Thanks for the quick work Marcel! I can also confirm the fix works.
Comment 6 Jonathan Druart 2012-09-04 12:21:29 UTC
The patch seems good but I can't reproduce the issue without the patch :)

I log in with user1, show his lists and click on one.
log out, relog with user2
I refresh the previous page (opac-shelves.pl?viewshelf=18) and I get an error : 
"ERROR: You do not have adequate permission for that action on list 18."

What I missed ?
Comment 7 Owen Leonard 2012-09-04 12:37:04 UTC
To observe the bug, you must not be logged in to the OPAC.
Comment 8 Jonathan Druart 2012-09-04 13:09:35 UTC
(In reply to comment #7)
> To observe the bug, you must not be logged in to the OPAC.

Ho ok ! :) Thanks Owen.

Marked as Passed QA
Comment 9 Paul Poulain 2012-09-05 13:36:54 UTC
mmm... testing this patch (with plack, as usual), I got strange things once, that I can't reproduce:

 * go to shelves.pl page on staff interface = no list displayed (I have 4 in my database)
 * Add a new shelf. I got a nasty = ERROR: You do not have adequate permission for that action on list 42488.
 * kill plack & reload it = everything is OK

patch pushed, if someone face strange things, it means there is a problem, not related to some cache/plack/...
Comment 10 Chris Cormack 2012-09-06 05:14:32 UTC
Pushed to 3.8.x will be in 3.8.5