Bug 6653

Summary: [security] Rotating collections pages can be accessed without being logged in
Product: Koha Reporter: Katrin Fischer <katrin.fischer>
Component: AuthenticationAssignee: Galen Charlton <gmcharlt>
Status: CLOSED FIXED QA Contact: Bugs List <koha-bugs>
Severity: critical    
Priority: PATCH-Sent (DO NOT USE) CC: chris, dpavlin, koha.sekjal, m.de.rooy, paul.poulain
Version: Main   
Hardware: All   
OS: All   
Change sponsored?: --- Patch complexity: ---
Documentation contact: Documentation submission:
Text to go in the release notes:
Version(s) released in:
Bug Depends on:    
Bug Blocks: 6654    
Attachments: Bug 6553 : Fixing authentication issue, there is no reason we should be able to use these without authentication
Bug 6553 : Follow up adding license statements
Signed off patch
Signed follow up patch

Description Katrin Fischer 2011-08-01 09:07:54 UTC
Following URLs in staff can be accessed withoug being logged in:

.../cgi-bin/koha/rotating_collections/editCollections.pl
.../cgi-bin/koha/rotating_collections/rotatingCollections.pl
.../cgi-bin/koha/rotating_collections/addItems.pl
.../cgi-bin/koha/rotating_collections/transferCollection.pl
Comment 1 Chris Cormack 2011-08-01 09:54:54 UTC Comment hidden (obsolete)
Comment 2 Chris Cormack 2011-08-01 09:55:14 UTC Comment hidden (obsolete)
Comment 3 Katrin Fischer 2011-08-01 10:04:07 UTC
Created attachment 4792 [details] [review]
Signed off patch
Comment 4 Marcel de Rooy 2011-08-04 08:09:46 UTC
Followup signed (only text)
Comment 5 Marcel de Rooy 2011-08-04 08:12:34 UTC
Created attachment 4834 [details] [review]
Signed follow up patch
Comment 6 Ian Walls 2011-08-12 19:06:26 UTC
Simple change to known parameter (1 => 0), then addition of consistent Licensing text... marking as Passed QA
Comment 7 Chris Cormack 2011-08-13 08:03:40 UTC
Pushed, please test