Bug 6653 - [security] Rotating collections pages can be accessed without being logged in
Summary: [security] Rotating collections pages can be accessed without being logged in
Status: CLOSED FIXED
Alias: None
Product: Koha
Classification: Unclassified
Component: Authentication (show other bugs)
Version: Main
Hardware: All All
: PATCH-Sent (DO NOT USE) critical
Assignee: Galen Charlton
QA Contact: Bugs List
URL:
Keywords:
Depends on:
Blocks: 6654
  Show dependency tree / graph
 
Reported: 2011-08-01 09:07 UTC by Katrin Fischer
Modified: 2019-06-27 09:24 UTC (History)
5 users (show)

See Also:
Change sponsored?: ---
Patch complexity: ---
Documentation contact:
Documentation submission:
Text to go in the release notes:
Version(s) released in:
Circulation function:

Attachments
Bug 6553 : Fixing authentication issue, there is no reason we should be able to use these without authentication (2.80 KB, patch)
2011-08-01 09:54 UTC, Chris Cormack 		Details | Diff | Splinter Review
Bug 6553 : Follow up adding license statements (4.67 KB, patch)
2011-08-01 09:55 UTC, Chris Cormack 		Details | Diff | Splinter Review
Signed off patch (2.92 KB, patch)
2011-08-01 10:04 UTC, Katrin Fischer 		Details | Diff | Splinter Review
Signed follow up patch (4.81 KB, patch)
2011-08-04 08:12 UTC, Marcel de Rooy 		Details | Diff | Splinter Review
Show Obsolete (2) View All Add an attachment (proposed patch, testcase, etc.)

Note You need to log in before you can comment on or make changes to this bug.
Description Katrin Fischer 2011-08-01 09:07:54 UTC 
Following URLs in staff can be accessed withoug being logged in:

.../cgi-bin/koha/rotating_collections/editCollections.pl
.../cgi-bin/koha/rotating_collections/rotatingCollections.pl
.../cgi-bin/koha/rotating_collections/addItems.pl
.../cgi-bin/koha/rotating_collections/transferCollection.pl
Comment 1 Chris Cormack 2011-08-01 09:54:54 UTC Comment hidden (obsolete)
Comment 2 Chris Cormack 2011-08-01 09:55:14 UTC Comment hidden (obsolete)
Comment 3 Katrin Fischer 2011-08-01 10:04:07 UTC 
Created attachment 4792 [details] [review]
Signed off patch
Comment 4 Marcel de Rooy 2011-08-04 08:09:46 UTC 
Followup signed (only text)
Comment 5 Marcel de Rooy 2011-08-04 08:12:34 UTC 
Created attachment 4834 [details] [review]
Signed follow up patch
Comment 6 Ian Walls 2011-08-12 19:06:26 UTC 
Simple change to known parameter (1 => 0), then addition of consistent Licensing text... marking as Passed QA
Comment 7 Chris Cormack 2011-08-13 08:03:40 UTC 
Pushed, please test