Bug 6642

Summary: Able to download label batches as an unauthorized user
Product: Koha Reporter: Liz Rea <wizzyrea>
Component: Label/patron card printingAssignee: Chris Nighswonger <cnighswonger>
Status: CLOSED FIXED QA Contact: Bugs List <koha-bugs>
Severity: major    
Priority: PATCH-Sent (DO NOT USE) CC: chris, wizzyrea
Version: 3.6   
Hardware: All   
OS: All   
Change sponsored?: --- Patch complexity: ---
Documentation contact: Documentation submission:
Text to go in the release notes:
Version(s) released in:
Circulation function:
Bug Depends on:    
Bug Blocks: 6654    
Attachments: Bug 6642 : Making sure permissions are checked on label creator
Signed off patch

Description Liz Rea 2011-07-28 16:11:42 UTC 
http://staff.client.url/cgi-bin/koha/labels/label-create-pdf.pl?batch_id=1&template_id=1&layout_id=17&start_label=1  (as an example) would allow unauthorized users to download generated PDF files from the
staff side of the ILS. It might be possible to DOS the staff client using this.
Comment 1 Chris Cormack 2011-07-28 21:04:21 UTC Comment hidden (obsolete)
Comment 2 Katrin Fischer 2011-08-01 08:57:51 UTC 
Created attachment 4787 [details] [review]
Signed off patch
Comment 3 Chris Cormack 2011-08-01 09:12:37 UTC 
Security issue, pushed to master, please test
Comment 4 Liz Rea 2011-08-04 16:43:52 UTC 
Works. Thanks!