Bug 6643

Summary: Able to download patron card batches as an unauthorized user
Product: Koha Reporter: Liz Rea <wizzyrea>
Component: ToolsAssignee: Galen Charlton <gmcharlt>
Status: CLOSED FIXED QA Contact: Bugs List <koha-bugs>
Severity: critical    
Priority: PATCH-Sent (DO NOT USE) CC: chris, wizzyrea
Version: 3.6   
Hardware: All   
OS: All   
Change sponsored?: --- Patch complexity: ---
Documentation contact: Documentation submission:
Text to go in the release notes:
Version(s) released in:
Attachments: Bug 6643 -- Able to download patron card batches as an unauthorized user
Bug 6643 -- Able to download patron card batches as an unauthorized user

Description Liz Rea 2011-07-28 16:15:04 UTC
http://staff.client.url/cgi-bin/koha/patroncards/create-pdf.pl?batch_id=3&template_id=23&layout_id=20&start_card=1

This requires knowledge of the batch, template, layout, and start_card id's, but it is still possible to download a generated batch of patron cards as an unauthorized user.
Comment 1 Liz Rea 2011-07-28 21:19:34 UTC Comment hidden (obsolete)
Comment 2 Chris Cormack 2011-08-01 08:42:19 UTC
Created attachment 4785 [details] [review]
Bug 6643 -- Able to download patron card batches as an unauthorized user

Making sure permissions are checked on label creator

Signed-off-by: Chris Cormack <chrisc@catalyst.net.nz>
Comment 3 Chris Cormack 2011-08-01 09:18:46 UTC
Security issue, patch pushed please test
Comment 4 Liz Rea 2011-08-04 16:45:40 UTC
Tested, works!