[Bug 8706] New: Private lists can be accessed by anyone
http://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=8706 Priority: P5 - low Change sponsored?: --- Bug ID: 8706 CC: m.de.rooy@rijksmuseum.nl Assignee: gmcharlt@gmail.com Summary: Private lists can be accessed by anyone Severity: critical Classification: Unclassified OS: All Reporter: oleonard@myacpl.org Hardware: All Status: NEW Version: master Component: Virtual Shelves Product: Koha Any private list can be accessed by any user by typing the shelf number in the URL: /cgi-bin/koha/opac-shelves.pl?viewshelf=XXX -- You are receiving this mail because: You are watching all bug changes.
http://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=8706 --- Comment #1 from Owen Leonard <oleonard@myacpl.org> --- git bisect blames Bug 7310 -- You are receiving this mail because: You are watching all bug changes.
http://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=8706 M. de Rooy <m.de.rooy@rijksmuseum.nl> changed: What |Removed |Added ---------------------------------------------------------------------------- Status|NEW |ASSIGNED Assignee|gmcharlt@gmail.com |m.de.rooy@rijksmuseum.nl --- Comment #2 from M. de Rooy <m.de.rooy@rijksmuseum.nl> --- I checked the code (that I changed sometime ago) and I tested again in 3.8.2. When I am logged in and want to access a list from another, I get: ERROR: You do not have adequate permission for that action on list 135. This is the behavior expected. When I logged out and tried again, this message did not come up. That is indeed an error! Will submit a quick fix for that. Please test and sign off, if you can. -- You are receiving this mail because: You are watching all bug changes.
http://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=8706 --- Comment #3 from M. de Rooy <m.de.rooy@rijksmuseum.nl> --- Created attachment 11904 --> http://bugs.koha-community.org/bugzilla3/attachment.cgi?id=11904&action=edit Patch 8706 -- You are receiving this mail because: You are watching all bug changes.
http://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=8706 M. de Rooy <m.de.rooy@rijksmuseum.nl> changed: What |Removed |Added ---------------------------------------------------------------------------- Status|ASSIGNED |Needs Signoff -- You are receiving this mail because: You are watching all bug changes.
http://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=8706 Kyle M Hall <kyle@bywatersolutions.com> changed: What |Removed |Added ---------------------------------------------------------------------------- Attachment #11904|0 |1 is obsolete| | --- Comment #4 from Kyle M Hall <kyle@bywatersolutions.com> --- Created attachment 11905 --> http://bugs.koha-community.org/bugzilla3/attachment.cgi?id=11905&action=edit Bug 8706 - Private lists can be accessed by anyone Signed-off-by: Kyle M Hall <kyle@bywatersolutions.com> Confirmed private lists can be accessed directly before patch is applied. After applying patch, I can no longer access the list via the same url. -- You are receiving this mail because: You are watching all bug changes.
http://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=8706 Kyle M Hall <kyle@bywatersolutions.com> changed: What |Removed |Added ---------------------------------------------------------------------------- Status|Needs Signoff |Signed Off CC| |kyle@bywatersolutions.com -- You are receiving this mail because: You are watching all bug changes.
http://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=8706 --- Comment #5 from Owen Leonard <oleonard@myacpl.org> --- Thanks for the quick work Marcel! I can also confirm the fix works. -- You are receiving this mail because: You are watching all bug changes.
http://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=8706 Jonathan Druart <jonathan.druart@biblibre.com> changed: What |Removed |Added ---------------------------------------------------------------------------- CC| |jonathan.druart@biblibre.co | |m --- Comment #6 from Jonathan Druart <jonathan.druart@biblibre.com> --- The patch seems good but I can't reproduce the issue without the patch :) I log in with user1, show his lists and click on one. log out, relog with user2 I refresh the previous page (opac-shelves.pl?viewshelf=18) and I get an error : "ERROR: You do not have adequate permission for that action on list 18." What I missed ? -- You are receiving this mail because: You are watching all bug changes.
http://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=8706 --- Comment #7 from Owen Leonard <oleonard@myacpl.org> --- To observe the bug, you must not be logged in to the OPAC. -- You are receiving this mail because: You are watching all bug changes.
http://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=8706 Jonathan Druart <jonathan.druart@biblibre.com> changed: What |Removed |Added ---------------------------------------------------------------------------- Status|Signed Off |Passed QA --- Comment #8 from Jonathan Druart <jonathan.druart@biblibre.com> --- (In reply to comment #7)
To observe the bug, you must not be logged in to the OPAC.
Ho ok ! :) Thanks Owen. Marked as Passed QA -- You are receiving this mail because: You are watching all bug changes.
http://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=8706 Jonathan Druart <jonathan.druart@biblibre.com> changed: What |Removed |Added ---------------------------------------------------------------------------- QA Contact| |jonathan.druart@biblibre.co | |m -- You are receiving this mail because: You are watching all bug changes.
http://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=8706 Paul Poulain <paul.poulain@biblibre.com> changed: What |Removed |Added ---------------------------------------------------------------------------- Status|Passed QA |Pushed to Master CC| |paul.poulain@biblibre.com Version|master |rel_3_8 --- Comment #9 from Paul Poulain <paul.poulain@biblibre.com> --- mmm... testing this patch (with plack, as usual), I got strange things once, that I can't reproduce: * go to shelves.pl page on staff interface = no list displayed (I have 4 in my database) * Add a new shelf. I got a nasty = ERROR: You do not have adequate permission for that action on list 42488. * kill plack & reload it = everything is OK patch pushed, if someone face strange things, it means there is a problem, not related to some cache/plack/... -- You are receiving this mail because: You are watching all bug changes.
http://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=8706 Chris Cormack <chris@bigballofwax.co.nz> changed: What |Removed |Added ---------------------------------------------------------------------------- Status|Pushed to Master |Pushed to Stable CC| |chris@bigballofwax.co.nz --- Comment #10 from Chris Cormack <chris@bigballofwax.co.nz> --- Pushed to 3.8.x will be in 3.8.5 -- You are receiving this mail because: You are watching all bug changes.
participants (1)
-
bugzilla-daemon＠bugs.koha-community.org