Bug 20627 - Prevent leakages of user permissions to api access tokens
Summary: Prevent leakages of user permissions to api access tokens
Status: NEW
Alias: None
Product: Koha
Classification: Unclassified
Component: Authentication (show other bugs)
Version: master
Hardware: All All
: P5 - low enhancement (vote)
Assignee: Martin Renvoize
QA Contact: Testopia
Depends on: 20568 20612
  Show dependency treegraph
Reported: 2018-04-20 12:48 UTC by Martin Renvoize
Modified: 2019-11-07 09:44 UTC (History)
2 users (show)

See Also:
Change sponsored?: ---
Patch complexity: ---
Who signed the patch off:
Text to go in the release notes:
Version(s) released in:


Note You need to log in before you can comment on or make changes to this bug.
Description Martin Renvoize 2018-04-20 12:48:23 UTC
Bug #20568 allow users to create API access tokens, but it always associates all a users permissions with that access token and additionally if that user comes to have more permissions down the line those additional permissions are automagically added to the access token as well. This is generally bad practice for access tokens as in general, they should be of a definite scope and any time additional privileges are required the client application should have to ask for them and receive a new token with the additional privileges assigned to it.