Any private list can be accessed by any user by typing the shelf number in the URL:
git bisect blames Bug 7310
I checked the code (that I changed sometime ago) and I tested again in 3.8.2.
When I am logged in and want to access a list from another, I get:
ERROR: You do not have adequate permission for that action on list 135.
This is the behavior expected.
When I logged out and tried again, this message did not come up. That is indeed an error!
Will submit a quick fix for that. Please test and sign off, if you can.
Created attachment 11904 [details] [review]
Created attachment 11905 [details] [review]
Bug 8706 - Private lists can be accessed by anyone
Signed-off-by: Kyle M Hall <firstname.lastname@example.org>
Confirmed private lists can be accessed directly before patch is
applied. After applying patch, I can no longer access the list
via the same url.
Thanks for the quick work Marcel! I can also confirm the fix works.
The patch seems good but I can't reproduce the issue without the patch :)
I log in with user1, show his lists and click on one.
log out, relog with user2
I refresh the previous page (opac-shelves.pl?viewshelf=18) and I get an error :
"ERROR: You do not have adequate permission for that action on list 18."
What I missed ?
To observe the bug, you must not be logged in to the OPAC.
(In reply to comment #7)
> To observe the bug, you must not be logged in to the OPAC.
Ho ok ! :) Thanks Owen.
Marked as Passed QA
mmm... testing this patch (with plack, as usual), I got strange things once, that I can't reproduce:
* go to shelves.pl page on staff interface = no list displayed (I have 4 in my database)
* Add a new shelf. I got a nasty = ERROR: You do not have adequate permission for that action on list 42488.
* kill plack & reload it = everything is OK
patch pushed, if someone face strange things, it means there is a problem, not related to some cache/plack/...
Pushed to 3.8.x will be in 3.8.5