From 8a5e529fc685da75d043b22f0375efe4503a9ab0 Mon Sep 17 00:00:00 2001 From: Liz Rea Date: Thu, 28 Jul 2011 16:14:05 -0500 Subject: [PATCH] Bug 6641 -- Specially crafted URL can allow unauthorized download of MARC files from staff client Making sure permissions are checked on download of MARC files from staff client Signed-off-by: Chris Cormack --- catalogue/export.pl | 12 +++++++++++- 1 files changed, 11 insertions(+), 1 deletions(-) diff --git a/catalogue/export.pl b/catalogue/export.pl index 9bd49de..3efdb21 100755 --- a/catalogue/export.pl +++ b/catalogue/export.pl @@ -8,9 +8,19 @@ use C4::Auth; use C4::Output; use C4::Biblio; use CGI; -use C4::Auth; + + my $query = new CGI; +my ( $template, $loggedinuser, $cookie ) = get_template_and_user({ + template_name => "tools/export.tt", + query => $query, + type => "intranet", + authnotrequired => 0, + flagsrequired => { tools => 'export_catalog' }, + debug => 1, + }); + my $op=$query->param("op"); my $format=$query->param("format"); if ($op eq "export") { -- 1.7.4.1