Bug 6643 - Able to download patron card batches as an unauthorized user
Summary: Able to download patron card batches as an unauthorized user
Status: CLOSED FIXED
Alias: None
Product: Koha
Classification: Unclassified
Component: Tools (show other bugs)
Version: 3.6
Hardware: All All
: PATCH-Sent (DO NOT USE) critical
Assignee: Galen Charlton
QA Contact: Bugs List
URL:
Keywords:
Depends on:
Blocks:
 
Reported: 2011-07-28 16:15 UTC by Liz Rea
Modified: 2019-06-27 09:24 UTC (History)
2 users (show)

See Also:
Change sponsored?: ---
Patch complexity: ---
Documentation contact:
Documentation submission:
Text to go in the release notes:
Version(s) released in:
Circulation function:

Attachments
Bug 6643 -- Able to download patron card batches as an unauthorized user (1.71 KB, patch)
2011-07-28 21:19 UTC, Liz Rea 		Details | Diff | Splinter Review
Bug 6643 -- Able to download patron card batches as an unauthorized user (1.72 KB, patch)
2011-08-01 08:42 UTC, Chris Cormack 		Details | Diff | Splinter Review
Show Obsolete (1) View All Add an attachment (proposed patch, testcase, etc.)

Note You need to log in before you can comment on or make changes to this bug.
Description Liz Rea 2011-07-28 16:15:04 UTC 
http://staff.client.url/cgi-bin/koha/patroncards/create-pdf.pl?batch_id=3&template_id=23&layout_id=20&start_card=1

This requires knowledge of the batch, template, layout, and start_card id's, but it is still possible to download a generated batch of patron cards as an unauthorized user.
Comment 1 Liz Rea 2011-07-28 21:19:34 UTC Comment hidden (obsolete)
Comment 2 Chris Cormack 2011-08-01 08:42:19 UTC 
Created attachment 4785 [details] [review]
Bug 6643 -- Able to download patron card batches as an unauthorized user

Making sure permissions are checked on label creator

Signed-off-by: Chris Cormack <chrisc@catalyst.net.nz>
Comment 3 Chris Cormack 2011-08-01 09:18:46 UTC 
Security issue, patch pushed please test
Comment 4 Liz Rea 2011-08-04 16:45:40 UTC 
Tested, works!