[Bug 17316] New: Possible to see name of lists you don't own
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=17316 Bug ID: 17316 Summary: Possible to see name of lists you don't own Change sponsored?: --- Product: Koha Version: unspecified Hardware: All OS: All Status: NEW Severity: normal Priority: P5 - low Component: Lists Assignee: gmcharlt@gmail.com Reporter: katrin.fischer@bsz-bw.de QA Contact: testopia@bugs.koha-community.org CC: m.de.rooy@rijksmuseum.nl When you try to access a list you haven't created/you are not the owner of by manipulating the URL, you can't see the entries, but you can see the name of the list: ../cgi-bin/koha/opac-shelves.pl?op=view&shelfnumber=1&sortfield=title -- You are receiving this mail because: You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=17316 Marc Véron <veron@veron.ch> changed: What |Removed |Added ---------------------------------------------------------------------------- CC| |veron@veron.ch --- Comment #1 from Marc Véron <veron@veron.ch> --- Confirmed. Name of list is visible in breadcrumbs as well... -- You are receiving this mail because: You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=17316 Jonathan Druart <jonathan.druart@bugs.koha-community.org> changed: What |Removed |Added ---------------------------------------------------------------------------- Status|NEW |Needs Signoff -- You are receiving this mail because: You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=17316 --- Comment #2 from Jonathan Druart <jonathan.druart@bugs.koha-community.org> --- Created attachment 55707 --> https://bugs.koha-community.org/bugzilla3/attachment.cgi?id=55707&action=edit Bug 17316: Do not display the list's name if the user does not have permission At the OPAC, if a user manipulate the URL to show a list (s)he is not allowed to view, the list's name will be displayed anyway. Test plan: - Create a private list with user A - Copy the op=view URL and access it with user B logged in => Without this patch, you will see the rss icon, the list's name and the "add list" button => Without this patch, only the "unauthorized" box will be displayed -- You are receiving this mail because: You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=17316 Jonathan Druart <jonathan.druart@bugs.koha-community.org> changed: What |Removed |Added ---------------------------------------------------------------------------- CC| |jonathan.druart@bugs.koha-c | |ommunity.org Assignee|gmcharlt@gmail.com |jonathan.druart@bugs.koha-c | |ommunity.org Depends on| |14544 Referenced Bugs: https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=14544 [Bug 14544] Move the list related code to Koha::Virtualshelves -- You are receiving this mail because: You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=17316 Jonathan Druart <jonathan.druart@bugs.koha-community.org> changed: What |Removed |Added ---------------------------------------------------------------------------- Status|Needs Signoff |ASSIGNED --- Comment #3 from Jonathan Druart <jonathan.druart@bugs.koha-community.org> --- Same problem on the staff interface. -- You are receiving this mail because: You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=17316 Jonathan Druart <jonathan.druart@bugs.koha-community.org> changed: What |Removed |Added ---------------------------------------------------------------------------- Status|ASSIGNED |Needs Signoff -- You are receiving this mail because: You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=17316 Jonathan Druart <jonathan.druart@bugs.koha-community.org> changed: What |Removed |Added ---------------------------------------------------------------------------- Attachment #55707|0 |1 is obsolete| | --- Comment #4 from Jonathan Druart <jonathan.druart@bugs.koha-community.org> --- Created attachment 55708 --> https://bugs.koha-community.org/bugzilla3/attachment.cgi?id=55708&action=edit Bug 17316: Do not display the list's name if the user does not have permission - Staff Same as previous patch but for the staff interface -- You are receiving this mail because: You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=17316 Jonathan Druart <jonathan.druart@bugs.koha-community.org> changed: What |Removed |Added ---------------------------------------------------------------------------- Attachment #55708|0 |1 is obsolete| | --- Comment #5 from Jonathan Druart <jonathan.druart@bugs.koha-community.org> --- Created attachment 55709 --> https://bugs.koha-community.org/bugzilla3/attachment.cgi?id=55709&action=edit Bug 17316: Do not display the list's name if the user does not have permission - OPAC At the OPAC, if a user manipulate the URL to show a list (s)he is not allowed to view, the list's name will be displayed anyway. Test plan: - Create a private list with user A - Copy the op=view URL and access it with user B logged in => Without this patch, you will see the rss icon, the list's name and the "add list" button => Without this patch, only the "unauthorized" box will be displayed -- You are receiving this mail because: You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=17316 --- Comment #6 from Jonathan Druart <jonathan.druart@bugs.koha-community.org> --- Created attachment 55710 --> https://bugs.koha-community.org/bugzilla3/attachment.cgi?id=55710&action=edit Bug 17316: Do not display the list's name if the user does not have permission - Staff Same as previous patch but for the staff interface -- You are receiving this mail because: You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=17316 Marc Véron <veron@veron.ch> changed: What |Removed |Added ---------------------------------------------------------------------------- Attachment #55709|0 |1 is obsolete| | --- Comment #7 from Marc Véron <veron@veron.ch> --- Created attachment 55711 --> https://bugs.koha-community.org/bugzilla3/attachment.cgi?id=55711&action=edit Bug 17316: Do not display the list's name if the user does not have permission - OPAC At the OPAC, if a user manipulate the URL to show a list (s)he is not allowed to view, the list's name will be displayed anyway. Test plan: - Create a private list with user A - Copy the op=view URL and access it with user B logged in => Without this patch, you will see the rss icon, the list's name and the "add list" button => Without this patch, only the "unauthorized" box will be displayed Followed test plan, works as expected. Signed-off-by: Marc Véron <veron@veron.ch> -- You are receiving this mail because: You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=17316 Marc Véron <veron@veron.ch> changed: What |Removed |Added ---------------------------------------------------------------------------- Attachment #55710|0 |1 is obsolete| | --- Comment #8 from Marc Véron <veron@veron.ch> --- Created attachment 55712 --> https://bugs.koha-community.org/bugzilla3/attachment.cgi?id=55712&action=edit Bug 17316: Do not display the list's name if the user does not have permission - Staff Same as previous patch but for the staff interface Signed-off-by: Marc Véron <veron@veron.ch> -- You are receiving this mail because: You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=17316 Marc Véron <veron@veron.ch> changed: What |Removed |Added ---------------------------------------------------------------------------- Status|Needs Signoff |Signed Off -- You are receiving this mail because: You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=17316 --- Comment #9 from Katrin Fischer <katrin.fischer@bsz-bw.de> --- Much better, thx for fixing! -- You are receiving this mail because: You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=17316 Katrin Fischer <katrin.fischer@bsz-bw.de> changed: What |Removed |Added ---------------------------------------------------------------------------- Status|Signed Off |Passed QA Patch complexity|--- |Small patch -- You are receiving this mail because: You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=17316 Katrin Fischer <katrin.fischer@bsz-bw.de> changed: What |Removed |Added ---------------------------------------------------------------------------- Attachment #55711|0 |1 is obsolete| | Attachment #55712|0 |1 is obsolete| | --- Comment #10 from Katrin Fischer <katrin.fischer@bsz-bw.de> --- Created attachment 55802 --> https://bugs.koha-community.org/bugzilla3/attachment.cgi?id=55802&action=edit [PASSED QA] Bug 17316: Do not display the list's name if the user does not have permission - OPAC At the OPAC, if a user manipulate the URL to show a list (s)he is not allowed to view, the list's name will be displayed anyway. Test plan: - Create a private list with user A - Copy the op=view URL and access it with user B logged in => Without this patch, you will see the rss icon, the list's name and the "add list" button => Without this patch, only the "unauthorized" box will be displayed Followed test plan, works as expected. Signed-off-by: Marc Véron <veron@veron.ch> Signed-off-by: Katrin Fischer <katrin.fischer@bsz-bw.de> -- You are receiving this mail because: You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=17316 --- Comment #11 from Katrin Fischer <katrin.fischer@bsz-bw.de> --- Created attachment 55803 --> https://bugs.koha-community.org/bugzilla3/attachment.cgi?id=55803&action=edit [PASSED QA] Bug 17316: Do not display the list's name if the user does not have permission - Staff Same as previous patch but for the staff interface Signed-off-by: Marc Véron <veron@veron.ch> Signed-off-by: Katrin Fischer <katrin.fischer@bsz-bw.de> -- You are receiving this mail because: You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=17316 Kyle M Hall <kyle@bywatersolutions.com> changed: What |Removed |Added ---------------------------------------------------------------------------- Status|Passed QA |Pushed to Master CC| |kyle@bywatersolutions.com --- Comment #12 from Kyle M Hall <kyle@bywatersolutions.com> --- Pushed to master for 16.11, thanks Jonathan! -- You are receiving this mail because: You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=17316 Frédéric Demians <frederic@tamil.fr> changed: What |Removed |Added ---------------------------------------------------------------------------- Status|Pushed to Master |Pushed to Stable CC| |frederic@tamil.fr --- Comment #13 from Frédéric Demians <frederic@tamil.fr> --- Pushed in 16.05. Will be in 16.05.05. -- You are receiving this mail because: You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=17316 Julian Maurice <julian.maurice@biblibre.com> changed: What |Removed |Added ---------------------------------------------------------------------------- CC| |julian.maurice@biblibre.com --- Comment #14 from Julian Maurice <julian.maurice@biblibre.com> --- Pushed to 3.22.x, will be in 3.22.12 -- You are receiving this mail because: You are watching all bug changes.
participants (1)
-
bugzilla-daemon＠bugs.koha-community.org