Bug 4517

Summary: serials routing list member reordering can be done without staff authentication
Product: Koha Reporter: Galen Charlton <gmcharlt>
Component: SerialsAssignee: Colin Campbell <colin.campbell>
Status: CLOSED FIXED QA Contact: Bugs List <koha-bugs>
Severity: normal    
Priority: PATCH-Sent (DO NOT USE)    
Version: Main   
Hardware: All   
OS: All   
URL: serials/reorder_members.pl
Change sponsored?: --- Patch complexity: ---
Documentation contact: Documentation submission:
Text to go in the release notes:
Version(s) released in:
Attachments: Oroposed patch

Description Chris Cormack 2010-05-21 01:28:06 UTC


---- Reported by gmcharlt@gmail.com 2010-05-17 12:51:02 ----

serials/reorder_members.pl does not do an authentication check, thus allowing somebody to construct a URL to manipulate the order of members in a serials routing list without authorization.



---- Additional Comments From colin.campbell@ptfs-europe.com 2010-05-19 09:27:12 ----

Created an attachment
Oroposed patch





--- Bug imported by chris@bigballofwax.co.nz 2010-05-21 01:28 UTC  ---

This bug was previously known as _bug_ 4517 at http://bugs.koha.org/cgi-bin/bugzilla3/show_bug.cgi?id=4517
Imported an attachment (id=2137)

Actual time not defined. Setting to 0.0
Setting qa contact to the default for this product.
   This bug either had no qa contact or an invalid one.
The original submitter of attachment 2137 [details] [review] is unknown.
   Reassigning to the person who moved it here: chris@bigballofwax.co.nz.

Comment 1 Galen Charlton 2010-05-24 13:11:53 UTC
Pushed patch.