Bug 4517 - serials routing list member reordering can be done without staff authentication
Summary: serials routing list member reordering can be done without staff authentication
Status: CLOSED FIXED
Alias: None
Product: Koha
Classification: Unclassified
Component: Serials (show other bugs)
Version: Main
Hardware: All All
: PATCH-Sent (DO NOT USE) normal (vote)
Assignee: Colin Campbell
QA Contact: Bugs List
URL: serials/reorder_members.pl
Keywords:
Depends on:
Blocks:
 
Reported: 2010-05-17 12:51 UTC by Galen Charlton
Modified: 2012-10-25 22:52 UTC (History)
0 users

See Also:
Change sponsored?: ---
Patch complexity: ---
Documentation contact:
Documentation submission:
Text to go in the release notes:
Version(s) released in:


Attachments
Oroposed patch (1.03 KB, patch)
2010-05-19 09:27 UTC, Chris Cormack
Details | Diff | Splinter Review

Note You need to log in before you can comment on or make changes to this bug.
Description Chris Cormack 2010-05-21 01:28:06 UTC


---- Reported by gmcharlt@gmail.com 2010-05-17 12:51:02 ----

serials/reorder_members.pl does not do an authentication check, thus allowing somebody to construct a URL to manipulate the order of members in a serials routing list without authorization.



---- Additional Comments From colin.campbell@ptfs-europe.com 2010-05-19 09:27:12 ----

Created an attachment
Oroposed patch





--- Bug imported by chris@bigballofwax.co.nz 2010-05-21 01:28 UTC  ---

This bug was previously known as _bug_ 4517 at http://bugs.koha.org/cgi-bin/bugzilla3/show_bug.cgi?id=4517
Imported an attachment (id=2137)

Actual time not defined. Setting to 0.0
Setting qa contact to the default for this product.
   This bug either had no qa contact or an invalid one.
The original submitter of attachment 2137 [details] [review] is unknown.
   Reassigning to the person who moved it here: chris@bigballofwax.co.nz.

Comment 1 Galen Charlton 2010-05-24 13:11:53 UTC
Pushed patch.