[Bug 6631] New: Unrestricted creation of lists by anonymous users
http://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=6631 Bug #: 6631 Summary: Unrestricted creation of lists by anonymous users Classification: Unclassified Change sponsored?: --- Product: Koha Version: rel_3_4 Platform: All OS/Version: All Status: NEW Severity: enhancement Priority: P5 Component: OPAC AssignedTo: oleonard@myacpl.org ReportedBy: semarie-koha@latrappe.fr QAContact: koha-bugs@lists.koha-community.org Using direct call to "/cgi-bin/koha/opac-addbybiblionumber.pl?biblionumber=xxx", an anonymous user is able to create Lists. The new created list is owner by kohaadmin (at least on my site). -- Configure bugmail: http://bugs.koha-community.org/bugzilla3/userprefs.cgi?tab=email ------- You are receiving this mail because: ------- You are the QA Contact for the bug.
http://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=6631 Owen Leonard <oleonard@myacpl.org> changed: What |Removed |Added ---------------------------------------------------------------------------- Component|OPAC |Virtual Shelves AssignedTo|oleonard@myacpl.org |gmcharlt@gmail.com Severity|enhancement |normal --- Comment #1 from Owen Leonard <oleonard@myacpl.org> 2011-09-20 15:11:10 UTC --- Confirmed, although it doesn't look to me like the kohaadmin user can manage it. In the virtualshelves table the owner is NULL. If someone used this method to create a private list the administrator wouldn't have any way to remove it via the interface (not that anyone could see that it had been created). -- Configure bugmail: http://bugs.koha-community.org/bugzilla3/userprefs.cgi?tab=email ------- You are receiving this mail because: ------- You are the QA Contact for the bug.
http://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=6631 Ian Walls <ian.walls@bywatersolutions.com> changed: What |Removed |Added ---------------------------------------------------------------------------- Blocks| |7310 -- Configure bugmail: http://bugs.koha-community.org/bugzilla3/userprefs.cgi?tab=email ------- You are receiving this mail because: ------- You are the QA Contact for the bug. You are watching all bug changes.
http://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=6631 Aleksa <aleksa@catalyst.net.nz> changed: What |Removed |Added ---------------------------------------------------------------------------- Status|NEW |Needs Signoff AssignedTo|gmcharlt@gmail.com |aleksa@catalyst.net.nz --- Comment #2 from Aleksa <aleksa@catalyst.net.nz> 2012-01-24 01:13:58 UTC --- Created attachment 7307 --> http://bugs.koha-community.org/bugzilla3/attachment.cgi?id=7307 Made page require authentication. -- Configure bugmail: http://bugs.koha-community.org/bugzilla3/userprefs.cgi?tab=email ------- You are receiving this mail because: ------- You are the QA Contact for the bug. You are watching all bug changes.
http://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=6631 Owen Leonard <oleonard@myacpl.org> changed: What |Removed |Added ---------------------------------------------------------------------------- See Also| |http://bugs.koha-community. | |org/bugzilla3/show_bug.cgi? | |id=7473 -- Configure bugmail: http://bugs.koha-community.org/bugzilla3/userprefs.cgi?tab=email ------- You are receiving this mail because: ------- You are the QA Contact for the bug. You are watching all bug changes.
http://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=6631 Jared Camins-Esakov <jcamins@cpbibliography.com> changed: What |Removed |Added ---------------------------------------------------------------------------- Attachment #7307|0 |1 is obsolete| | --- Comment #3 from Jared Camins-Esakov <jcamins@cpbibliography.com> 2012-01-29 14:31:57 UTC --- Created attachment 7380 --> http://bugs.koha-community.org/bugzilla3/attachment.cgi?id=7380 Bug 6631: Anonymous users can create lists in OPAC Made opac-addbybiblionumber.pl page require authentication. Signed-off-by: Jared Camins-Esakov <jcamins@cpbibliography.com> -- Configure bugmail: http://bugs.koha-community.org/bugzilla3/userprefs.cgi?tab=email ------- You are receiving this mail because: ------- You are the QA Contact for the bug. You are watching all bug changes.
http://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=6631 Jared Camins-Esakov <jcamins@cpbibliography.com> changed: What |Removed |Added ---------------------------------------------------------------------------- Status|Needs Signoff |Signed Off CC| |jcamins@cpbibliography.com -- Configure bugmail: http://bugs.koha-community.org/bugzilla3/userprefs.cgi?tab=email ------- You are receiving this mail because: ------- You are the QA Contact for the bug. You are watching all bug changes.
http://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=6631 M. de Rooy <m.de.rooy@rijksmuseum.nl> changed: What |Removed |Added ---------------------------------------------------------------------------- CC| |m.de.rooy@rijksmuseum.nl --- Comment #4 from M. de Rooy <m.de.rooy@rijksmuseum.nl> 2012-02-01 14:51:57 UTC --- I would propose to solve this issue in connection with report 7310 (working on it ..) We should not allow anonymous to create a list. Another related issue is if you should allow anonymous to add a biblio to a public list. I think that we should not allow it either. Making a list or adding an entry is the privilege of known users. -- Configure bugmail: http://bugs.koha-community.org/bugzilla3/userprefs.cgi?tab=email ------- You are receiving this mail because: ------- You are the QA Contact for the bug. You are watching all bug changes.
http://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=6631 Paul Poulain <paul.poulain@biblibre.com> changed: What |Removed |Added ---------------------------------------------------------------------------- Status|Signed Off |Passed QA CC| |paul.poulain@biblibre.com Version|rel_3_4 |rel_3_6 Severity|normal |major --- Comment #5 from Paul Poulain <paul.poulain@biblibre.com> 2012-02-01 16:56:54 UTC --- QA comment: * tiny patch, everything OK * upgrading severity * welcome Aleksa Vujicic to the list of contributors, you're 172th ! -- Configure bugmail: http://bugs.koha-community.org/bugzilla3/userprefs.cgi?tab=email ------- You are receiving this mail because: ------- You are the QA Contact for the bug. You are watching all bug changes.
http://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=6631 Paul Poulain <paul.poulain@biblibre.com> changed: What |Removed |Added ---------------------------------------------------------------------------- Status|Passed QA |Pushed to Master -- Configure bugmail: http://bugs.koha-community.org/bugzilla3/userprefs.cgi?tab=email ------- You are receiving this mail because: ------- You are the QA Contact for the bug. You are watching all bug changes.
http://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=6631 Jared Camins-Esakov <jcamins@cpbibliography.com> changed: What |Removed |Added ---------------------------------------------------------------------------- Status|Pushed to Master |Pushed to Stable --- Comment #6 from Jared Camins-Esakov <jcamins@cpbibliography.com> --- This fix was included in the 3.6.x branch prior to 3.6.4. -- You are receiving this mail because: You are the QA Contact for the bug. You are watching all bug changes.
http://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=6631 Adrien SAURAT <adrien.saurat@biblibre.com> changed: What |Removed |Added ---------------------------------------------------------------------------- CC| |adrien.saurat@biblibre.com --- Comment #7 from Adrien SAURAT <adrien.saurat@biblibre.com> --- *** Bug 7473 has been marked as a duplicate of this bug. *** -- You are receiving this mail because: You are the QA Contact for the bug. You are watching all bug changes.
participants (1)
-
bugzilla-daemon＠bugs.koha-community.org