gitea
/
Koha-clms
1
0
Fork 0
Code Issues Pull Requests Packages Projects Releases Wiki Activity

Bug 8706 - Private lists can be accessed by anyone 

Signed-off-by: Kyle M Hall <kyle@bywatersolutions.com>

Confirmed private lists can be accessed directly before patch is
applied. After applying patch, I can no longer access the list
via the same url.

Signed-off-by: Paul Poulain <paul.poulain@biblibre.com>
Signed-off-by: Chris Cormack <chrisc@catalyst.net.nz>
This commit is contained in:
Marcel de Rooy 2012-08-31 11:48:51 +02:00 committed by Chris Cormack
parent 66fcd5fd6b
commit 6ff6bcde0d
1 changed files with 1 additions and 1 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

2
C4/VirtualShelves.pm
View File

@ -465,7 +465,7 @@ sub ShelfPossibleAction {
$sth->execute($user, $shelfnumber);
my $shelf= $sth->fetchrow_hashref;
return 0 unless $shelf && ($shelf->{category}==2 || $shelf->{owner}==$user || $shelf->{borrowernumber}==$user);
return 0 unless $shelf && ($shelf->{category}==2 || $shelf->{owner}==$user || ($user && $shelf->{borrowernumber}==$user));
if($action eq 'view') {
#already handled in the above condition
return 1;