[Bug 9270] New: Web-based SCO requires superlibrarian privileges
http://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=9270 Bug ID: 9270 Summary: Web-based SCO requires superlibrarian privileges Classification: Unclassified Change sponsored?: --- Product: Koha Version: master Hardware: All OS: All Status: NEW Severity: critical Priority: P5 - low Component: Self checkout Assignee: koha-bugs@lists.koha-community.org Reporter: jcamins@cpbibliography.com It would seem that the self-check user must have superlibrarian privileges, rather than the more safe-seeming circulation privileges. This is a bit of a security issue, since the cookies used on the self-checkout machine could then be modified for use with the staff client. -- You are receiving this mail because: You are the assignee for the bug. You are watching all bug changes.
http://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=9270 Galen Charlton <gmcharlt@gmail.com> changed: What |Removed |Added ---------------------------------------------------------------------------- Status|NEW |RESOLVED CC| |gmcharlt@gmail.com Resolution|--- |WORKSFORME --- Comment #1 from Galen Charlton <gmcharlt@gmail.com> --- This doesn't appear to be the case: opac/sco/help.pl: flagsrequired => {circulate => "circulate_remaining_permissions"}, opac/sco/sco-main.pl: flagsrequired => { circulate => "circulate_remaining_permissions" }, opac/sco/sco-patron-image.pl:my ($query, $response) = C4::Service->init(circulate => 'circulate_remaining_permissions'); I've also tested this directly -- a normal staff user with just the circulation permission works fine. -- You are receiving this mail because: You are the assignee for the bug. You are watching all bug changes.
participants (1)
-
bugzilla-daemon＠bugs.koha-community.org