http://staff.client.url/cgi-bin/koha/labels/label-create-pdf.pl?batch_id=1&template_id=1&layout_id=17&start_label=1 (as an example) would allow unauthorized users to download generated PDF files from the
staff side of the ILS. It might be possible to DOS the staff client using this.
Created attachment 4768 [details] [review]
Bug 6642 : Making sure permissions are checked on label creator
Created attachment 4787 [details] [review]
Signed off patch
Security issue, pushed to master, please test