Bug 41971 - Library-specific Pages for OPAC openly accessible
Summary: Library-specific Pages for OPAC openly accessible
Status: NEW
Alias: None
Product: Koha
Classification: Unclassified
Component: Tools (show other bugs)
Version: 24.11
Hardware: All All
: P5 - low normal
Assignee: Bugs List
QA Contact: Testopia
URL:
Keywords:
Depends on:
Blocks:
 
Reported: 2026-03-03 08:56 UTC by David Liddle
Modified: 2026-03-03 08:56 UTC (History)
0 users

See Also:
GIT URL:
Initiative type: ---
Sponsorship status: ---
Comma delimited list of Sponsors:
Crowdfunding goal: 0
Patch complexity: ---
Documentation contact:
Documentation submission:
Text to go in the release notes:
Version(s) released in:
Circulation function:


Attachments

Note You need to log in before you can comment on or make changes to this bug.
Description David Liddle 2026-03-03 08:56:08 UTC
After an upgrade of test and production instances from Koha 22.11 to Koha 24.11, we discovered that Pages (Tools > Additional tools) with library-specific (branch-specific) settings were openly accessible. That is, not only could they be viewed by patrons of other libraries, they could be viewed publicly (without authentication).

To reproduce:

1. Create a new page.
   - Display location = OPAC
   - Library = specific, but different from the current user (for certainty)
   - Publication date = Yesterday or Today
   - Title and Content = minimally necessary content
2. Save the new page.
3. Right-click the OPAC link and copy the link address.
4. Open a Guest profile window, which has no association with any existing session.
5. Paste the link and go to the address.
6. The library-specific page will be loaded without prompting for authentication.

(If using a sandbox, ensure that OPACBaseURL is set correctly.)