Hi, there is an 'insecure' system preference. Supposedly this could grant access to staff interface without logging in. But the feature is broken, if you set 'insecure' to allow then staff interface becomes unavailable. So, it's not only dangerous as the syspref legends said, the only way to revert is altering the system preference in the database. Do you consider that this feature could be removed, or someone is planning to fix it? Regards, Bernardo -- Bernardo Gonzalez Kriegel bgkriegel@gmail.com
Bernardo, there is an 'insecure' system preference.
Supposedly this could grant access to staff interface without logging in.
But the feature is broken, if you set 'insecure' to allow then staff interface becomes unavailable.
So, it's not only dangerous as the syspref legends said, the only way to revert is altering the system preference in the database.
Do you consider that this feature could be removed, or someone is planning to fix it?
It should be removed, and a patch doing so will not be subject to the feature slush, since the fact that the syspref exists at all is a definite bug. Regards, Jared -- Jared Camins-Esakov Bibliographer, C & P Bibliography Services, LLC (phone) +1 (917) 727-3445 (e-mail) jcamins@cpbibliography.com (web) http://www.cpbibliography.com/
It should be removed, and a patch doing so will not be subject to the feature slush, since the fact that the syspref exists at all is a definite bug.
A proposed patch is on Bug 9827 ( http://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=9827) I didn't make use of Bug 9562 because this patch does not fix that problem. Regards, Bernardo
Le 15/03/2013 21:53, Jared Camins-Esakov a écrit :
there is an 'insecure' system preference. Supposedly this could grant access to staff interface without logging in. It should be removed, and a patch doing so will not be subject to the feature slush, since the fact that the syspref exists at all is a definite bug.
No Biblibre customers use it. But I know/remember a library using this feature. iirc, it was a lawyer library, and the staff interface was available only on intranet, thus no need to log-in. (but I've nothing against removing the syspref itself, just warning it must be clearly announced in the release notes !) -- Paul POULAIN - BibLibre http://www.biblibre.com Free & Open Source Softwares for libraries Koha, Drupal, Piwik, Jasper
participants (3)
-
Bernardo Gonzalez Kriegel -
Jared Camins-Esakov -
Paul Poulain