| Summary: | 404 error page for Intranet may leak information | ||
|---|---|---|---|
| Product: | Koha | Reporter: | Isaac Brodsky <isaacbrodsky> |
| Component: | Staff interface | Assignee: | Bugs List <koha-bugs> |
| Status: | NEW --- | QA Contact: | Testopia <testopia> |
| Severity: | normal | ||
| Priority: | P5 - low | CC: | dcook, gmcharlt |
| Version: | Main | ||
| Hardware: | All | ||
| OS: | All | ||
| See Also: | https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=11581 | ||
| GIT URL: | Initiative type: | --- | |
| Sponsorship status: | --- | Comma delimited list of Sponsors: | |
| Crowdfunding goal: | 0 | Patch complexity: | --- |
| Documentation contact: | Documentation submission: | ||
| Text to go in the release notes: | Version(s) released in: | ||
| Circulation function: | |||
|
Description
Isaac Brodsky
2014-01-26 23:01:06 UTC
Still valid in master. Agreed with Isaac. Unauthenticated users shouldn't be able to see anything other than 401 or the login screen. Since we're using Plack::App::CGIBin, I think the only way to deal with this might be to add a Middleware to check if the user is authenticated before returning the 404. Something to think about but certainly relevant. |