Bookmarks for anonymous users are shared

[Jun Omae]

Only username column in the bookmarks table identifies a user. Therefore, a anonymous user can remove bookmarks for other anonymous users.

My proposals:

1. Refuse the access to bookmarks by anonymous user
2. Add sid and authenticated columns (are similar to session table)

sqlite> select * from bookmarks;
resource    name        username
----------  ----------  ----------
/                       anonymous
/timeline               anonymous
/roadmap                anonymous
/milestone              anonymous
/wiki/Came              anonymous
/wiki/Came              anonymous
/timeline?              anonymous
/ticket/6               anonymous
/bookmark               anonymous
/ticket/1               foobar
/ticket/2               foobar
/wiki                   foobar

[Ryan J Ollos]

Replying to jun66j5:

My proposals:

1. Refuse the access to bookmarks by anonymous user
2. Add sid and authenticated columns (are similar to session table)

I favor refusing bookmarks access to anonymous users. I'd have to look more closely at the other issue to fully understand it, but I trust its the right thing to do.

[Jun Omae]

(In [11900]) bookmarkplugin: fixed #10218: refuses anonymous access to bookmarks feature