[Koha-bugs] [Bug 12873] New: Reserve can be cancelled by any logged in user

[bugzilla-daemon at bugs.koha-community.org]

http://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=12873

            Bug ID: 12873
           Summary: Reserve can be cancelled by any logged in user
 Change sponsored?: ---
           Product: Koha
           Version: master
          Hardware: All
                OS: All
            Status: NEW
          Severity: trivial
          Priority: P3
         Component: OPAC
          Assignee: rkopaczka at afm.edu.pl
          Reporter: rkopaczka at afm.edu.pl
        QA Contact: testopia at bugs.koha-community.org

It is possible to cancel reservations through simply running opac-modreserve.pl
with existing reserve_id number. This may provide remove even all reservations
from system. 
The only limitation is that user have to be logged in. 
Simplest solution is to check whether reserve belongs to user or not. 
A patch will follow.

-- 
You are receiving this mail because:
You are watching all bug changes.