[Bug 12873] New: Reserve can be cancelled by any logged in user
http://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=12873 Bug ID: 12873 Summary: Reserve can be cancelled by any logged in user Change sponsored?: --- Product: Koha Version: master Hardware: All OS: All Status: NEW Severity: trivial Priority: P3 Component: OPAC Assignee: rkopaczka@afm.edu.pl Reporter: rkopaczka@afm.edu.pl QA Contact: testopia@bugs.koha-community.org It is possible to cancel reservations through simply running opac-modreserve.pl with existing reserve_id number. This may provide remove even all reservations from system. The only limitation is that user have to be logged in. Simplest solution is to check whether reserve belongs to user or not. A patch will follow. -- You are receiving this mail because: You are watching all bug changes.
http://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=12873 --- Comment #1 from Rafal Kopaczka <rkopaczka@afm.edu.pl> --- Created attachment 31377 --> http://bugs.koha-community.org/bugzilla3/attachment.cgi?id=31377&action=edit [PATCH] Bug 12873 - Reserve can be cancelled by any logged in user It is possible to cancel reservations through simply running opac-modreserve.pl with existing reserve_id number. This may provide remove even all reservations from system. The only limitat Test plan: 1. Create reserves by 2 different users, and get their ID's 2. Before patch, hold may by cancelled by anyone who run site: http://example.com/cgi-bin/koha/opac-modrequest.pl?reserve_id=XXX 3. After patch hold may by cancelled only by user whose reserve is. -- You are receiving this mail because: You are watching all bug changes.
http://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=12873 Rafal Kopaczka <rkopaczka@afm.edu.pl> changed: What |Removed |Added ---------------------------------------------------------------------------- Status|NEW |Needs Signoff -- You are receiving this mail because: You are watching all bug changes.
http://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=12873 Jacek Ablewicz <abl@biblos.pk.edu.pl> changed: What |Removed |Added ---------------------------------------------------------------------------- CC| |abl@biblos.pk.edu.pl -- You are receiving this mail because: You are watching all bug changes.
http://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=12873 Jonathan Druart <jonathan.druart@biblibre.com> changed: What |Removed |Added ---------------------------------------------------------------------------- CC| |jonathan.druart@biblibre.co | |m Severity|trivial |critical --- Comment #2 from Jonathan Druart <jonathan.druart@biblibre.com> --- This one smells critical. -- You are receiving this mail because: You are watching all bug changes.
http://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=12873 Jonathan Druart <jonathan.druart@biblibre.com> changed: What |Removed |Added ---------------------------------------------------------------------------- Status|Needs Signoff |Signed Off -- You are receiving this mail because: You are watching all bug changes.
http://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=12873 --- Comment #3 from Jonathan Druart <jonathan.druart@biblibre.com> --- Created attachment 31378 --> http://bugs.koha-community.org/bugzilla3/attachment.cgi?id=31378&action=edit Bug 12873 - Reserve can be cancelled by any logged in user It is possible to cancel reservations through simply running opac-modreserve.pl with existing reserve_id number. This may provide remove even all reservations from system. The only limitation is that user have to be logged in. Simplest solution is to check whether reserve belongs to user or not. Test plan: 1. Create reserves by 2 different users, and get their ID's 2. Before patch, hold may by cancelled by anyone who run site: http://example.com/cgi-bin/koha/opac-modrequest.pl?reserve_id=XXX 3. After patch hold may by cancelled only by user whose reserve is. Signed-off-by: Jonathan Druart <jonathan.druart@biblibre.com> -- You are receiving this mail because: You are watching all bug changes.
http://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=12873 Tomás Cohen Arazi <tomascohen@gmail.com> changed: What |Removed |Added ---------------------------------------------------------------------------- CC| |tomascohen@gmail.com -- You are receiving this mail because: You are watching all bug changes.
http://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=12873 Galen Charlton <gmcharlt@gmail.com> changed: What |Removed |Added ---------------------------------------------------------------------------- Status|Pushed to Master |Pushed to Stable Group|Koha security | CC| |gmcharlt@gmail.com Component|Koha |Hold requests Version|unspecified |master Product|Koha security |Koha QA Contact| |testopia@bugs.koha-communit | |y.org --- Comment #12 from Galen Charlton <gmcharlt@gmail.com> --- Pushed to 3.16.x for inclusion in 3.16.4. -- You are receiving this mail because: You are watching all bug changes.
http://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=12873 Fridolin SOMERS <fridolyn.somers@biblibre.com> changed: What |Removed |Added ---------------------------------------------------------------------------- CC| |fridolyn.somers@biblibre.co | |m --- Comment #13 from Fridolin SOMERS <fridolyn.somers@biblibre.com> --- Pushed to 3.14.x, will be in 3.14.11 -- You are receiving this mail because: You are watching all bug changes.
participants (1)
-
bugzilla-daemon＠bugs.koha-community.org