Summary: | 404 error page for Intranet may leak information | ||
---|---|---|---|
Product: | Koha | Reporter: | Isaac Brodsky <isaacbrodsky> |
Component: | Staff interface | Assignee: | Bugs List <koha-bugs> |
Status: | NEW --- | QA Contact: | Testopia <testopia> |
Severity: | normal | ||
Priority: | P5 - low | CC: | dcook, gmcharlt |
Version: | Main | ||
Hardware: | All | ||
OS: | All | ||
See Also: | https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=11581 | ||
GIT URL: | Change sponsored?: | --- | |
Patch complexity: | --- | Documentation contact: | |
Documentation submission: | Text to go in the release notes: | ||
Version(s) released in: | Circulation function: |
Description
Isaac Brodsky
2014-01-26 23:01:06 UTC
Still valid in master. Agreed with Isaac. Unauthenticated users shouldn't be able to see anything other than 401 or the login screen. Since we're using Plack::App::CGIBin, I think the only way to deal with this might be to add a Middleware to check if the user is authenticated before returning the 404. Something to think about but certainly relevant. |