[Bug 7551] New: Any logged-in OPAC user can renew items for others using a properly constructed URL
http://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=7551 Bug #: 7551 Summary: Any logged-in OPAC user can renew items for others using a properly constructed URL Classification: Unclassified Change sponsored?: --- Product: Koha Version: master Platform: All OS/Version: All Status: NEW Severity: blocker Priority: P1 - high Component: OPAC AssignedTo: oleonard@myacpl.org ReportedBy: oleonard@myacpl.org QAContact: koha.sekjal@gmail.com opac-renew.pl takes whatever borrowernumber you give it, so if you know the borrowernumber and itemnumber of the patron and item you can renew items for anyone from the OPAC. In my test all that was required was a valid OPAC login. To reproduce: 1. Log in to the OPAC as any valid user. 2. Point the browser to the URL of opac-renew.pl: http://koha.example.com/cgi-bin/koha/opac-renew.pl?borrowernumber=X&item=Y Where X is a Koha patron and Y is the itemnumber of something checked out to X. -- Configure bugmail: http://bugs.koha-community.org/bugzilla3/userprefs.cgi?tab=email ------- You are receiving this mail because: ------- You are watching all bug changes.
http://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=7551 Jane Wagner <jwagner@ptfs.com> changed: What |Removed |Added ---------------------------------------------------------------------------- CC| |jwagner@ptfs.com -- Configure bugmail: http://bugs.koha-community.org/bugzilla3/userprefs.cgi?tab=email ------- You are receiving this mail because: ------- You are watching all bug changes.
http://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=7551 --- Comment #1 from Chris Cormack <chris@bigballofwax.co.nz> 2012-02-16 20:24:38 UTC --- Created attachment 7704 --> http://bugs.koha-community.org/bugzilla3/attachment.cgi?id=7704 Bug 7551 : Can only renew for the user you are logged in as now -- Configure bugmail: http://bugs.koha-community.org/bugzilla3/userprefs.cgi?tab=email ------- You are receiving this mail because: ------- You are watching all bug changes.
http://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=7551 Chris Cormack <chris@bigballofwax.co.nz> changed: What |Removed |Added ---------------------------------------------------------------------------- Status|NEW |Needs Signoff CC| |chris@bigballofwax.co.nz -- Configure bugmail: http://bugs.koha-community.org/bugzilla3/userprefs.cgi?tab=email ------- You are receiving this mail because: ------- You are watching all bug changes.
http://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=7551 Owen Leonard <oleonard@myacpl.org> changed: What |Removed |Added ---------------------------------------------------------------------------- Attachment #7704|0 |1 is obsolete| | --- Comment #2 from Owen Leonard <oleonard@myacpl.org> 2012-02-16 20:40:36 UTC --- Created attachment 7705 --> http://bugs.koha-community.org/bugzilla3/attachment.cgi?id=7705 [SIGNED-OFF] Bug 7551 : Can only renew for the user you are logged in as now Signed-off-by: Owen Leonard <oleonard@myacpl.org> -- Configure bugmail: http://bugs.koha-community.org/bugzilla3/userprefs.cgi?tab=email ------- You are receiving this mail because: ------- You are watching all bug changes.
http://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=7551 Owen Leonard <oleonard@myacpl.org> changed: What |Removed |Added ---------------------------------------------------------------------------- Status|Needs Signoff |Signed Off -- Configure bugmail: http://bugs.koha-community.org/bugzilla3/userprefs.cgi?tab=email ------- You are receiving this mail because: ------- You are watching all bug changes.
http://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=7551 Ian Walls <koha.sekjal@gmail.com> changed: What |Removed |Added ---------------------------------------------------------------------------- Status|Signed Off |Passed QA --- Comment #3 from Ian Walls <koha.sekjal@gmail.com> 2012-02-16 21:23:56 UTC --- Okay, this line has been in here since Koha 3.0, when the built-in SCO used to use opac-renew to do it's renewals. Hence the need to use a different borrowernumber than your own. Now that SCO handles it's own renewals, this is just a security risk. Marking Passed QA. Follow up patch can be written to update opac-user.tt to no longer transmit the borrowernumber, but that's just cleanup. -- Configure bugmail: http://bugs.koha-community.org/bugzilla3/userprefs.cgi?tab=email ------- You are receiving this mail because: ------- You are watching all bug changes.
http://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=7551 Paul Poulain <paul.poulain@biblibre.com> changed: What |Removed |Added ---------------------------------------------------------------------------- Status|Passed QA |Pushed to Master CC| |paul.poulain@biblibre.com -- Configure bugmail: http://bugs.koha-community.org/bugzilla3/userprefs.cgi?tab=email ------- You are receiving this mail because: ------- You are watching all bug changes.
http://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=7551 Paul Poulain <paul.poulain@biblibre.com> changed: What |Removed |Added ---------------------------------------------------------------------------- Version|master |rel_3_6 Severity|blocker |critical -- Configure bugmail: http://bugs.koha-community.org/bugzilla3/userprefs.cgi?tab=email ------- You are receiving this mail because: ------- You are watching all bug changes.
http://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=7551 Jared Camins-Esakov <jcamins@cpbibliography.com> changed: What |Removed |Added ---------------------------------------------------------------------------- Status|Pushed to Master |RESOLVED Resolution|--- |FIXED -- You are receiving this mail because: You are watching all bug changes.
participants (1)
-
bugzilla-daemon＠bugs.koha-community.org