Bug 4517

Summary:	serials routing list member reordering can be done without staff authentication
Product:	Koha	Reporter:	Galen Charlton <gmcharlt>
Component:	Serials	Assignee:	Colin Campbell <colin.campbell>
Status:	CLOSED FIXED	QA Contact:	Bugs List <koha-bugs>
Severity:	normal
Priority:	PATCH-Sent (DO NOT USE)
Version:	Main
Hardware:	All
OS:	All
URL:	serials/reorder_members.pl
Change sponsored?:	---	Patch complexity:	---
Documentation contact:		Documentation submission:
Text to go in the release notes:		Version(s) released in:
Circulation function:
Attachments:	Oroposed patch

Description Chris Cormack 2010-05-21 01:28:06 UTC



---- Reported by gmcharlt@gmail.com 2010-05-17 12:51:02 ----

serials/reorder_members.pl does not do an authentication check, thus allowing somebody to construct a URL to manipulate the order of members in a serials routing list without authorization.



---- Additional Comments From colin.campbell@ptfs-europe.com 2010-05-19 09:27:12 ----

Created an attachment
Oroposed patch





--- Bug imported by chris@bigballofwax.co.nz 2010-05-21 01:28 UTC  ---

This bug was previously known as _bug_ 4517 at http://bugs.koha.org/cgi-bin/bugzilla3/show_bug.cgi?id=4517
Imported an attachment (id=2137)

Actual time not defined. Setting to 0.0
Setting qa contact to the default for this product.
   This bug either had no qa contact or an invalid one.
The original submitter of attachment 2137 [details] [review] is unknown.
   Reassigning to the person who moved it here: chris@bigballofwax.co.nz.

Comment 1 Galen Charlton 2010-05-24 13:11:53 UTC

Pushed patch.