Bug 4816

Summary: placerequest.pl does not require staff authentication
Product: Koha Reporter: Galen Charlton <gmcharlt>
Component: Hold requestsAssignee: Galen Charlton <gmcharlt>
Status: CLOSED FIXED QA Contact: Bugs List <koha-bugs>
Severity: critical    
Priority: P5 - low    
Version: rel_3_2   
Hardware: All   
OS: All   
Change sponsored?: --- Patch complexity: ---
Documentation contact: Documentation submission:
Text to go in the release notes:
Version(s) released in:

Description Galen Charlton 2010-05-26 02:36:02 UTC
The reserve/placerequest.pl web service does not do an authorization check, thereby allowing anybody to construct a URL that could place a hold request on any item on behalf of anybody else.
Comment 1 Galen Charlton 2010-05-26 03:31:39 UTC
Pushed fix.