Bug 4816 - placerequest.pl does not require staff authentication
Summary: placerequest.pl does not require staff authentication
Status: CLOSED FIXED
Alias: None
Product: Koha
Classification: Unclassified
Component: Hold requests (show other bugs)
Version: rel_3_2
Hardware: All All
: P5 - low critical (vote)
Assignee: Galen Charlton
QA Contact: Bugs List
URL:
Keywords:
Depends on:
Blocks:
 
Reported: 2010-05-26 02:36 UTC by Galen Charlton
Modified: 2019-06-27 09:24 UTC (History)
0 users

See Also:
Change sponsored?: ---
Patch complexity: ---
Documentation contact:
Documentation submission:
Text to go in the release notes:
Version(s) released in:


Attachments

Note You need to log in before you can comment on or make changes to this bug.
Description Galen Charlton 2010-05-26 02:36:02 UTC
The reserve/placerequest.pl web service does not do an authorization check, thereby allowing anybody to construct a URL that could place a hold request on any item on behalf of anybody else.
Comment 1 Galen Charlton 2010-05-26 03:31:39 UTC
Pushed fix.