Bug 6642 - Able to download label batches as an unauthorized user
Summary: Able to download label batches as an unauthorized user
Alias: None
Product: Koha
Classification: Unclassified
Component: Label/patron card printing (show other bugs)
Version: 3.6
Hardware: All All
: PATCH-Sent (DO NOT USE) major (vote)
Assignee: Chris Nighswonger
QA Contact: Bugs List
Depends on:
Blocks: 6654
  Show dependency treegraph
Reported: 2011-07-28 16:11 UTC by Liz Rea
Modified: 2012-10-25 23:09 UTC (History)
2 users (show)

See Also:
Change sponsored?: ---
Patch complexity: ---
Text to go in the release notes:
Version(s) released in:

Bug 6642 : Making sure permissions are checked on label creator (2.33 KB, patch)
2011-07-28 21:04 UTC, Chris Cormack
Details | Diff | Splinter Review
Signed off patch (2.45 KB, patch)
2011-08-01 08:57 UTC, Katrin Fischer
Details | Diff | Splinter Review

Note You need to log in before you can comment on or make changes to this bug.
Description Liz Rea 2011-07-28 16:11:42 UTC
http://staff.client.url/cgi-bin/koha/labels/label-create-pdf.pl?batch_id=1&template_id=1&layout_id=17&start_label=1  (as an example) would allow unauthorized users to download generated PDF files from the
staff side of the ILS. It might be possible to DOS the staff client using this.
Comment 1 Chris Cormack 2011-07-28 21:04:21 UTC Comment hidden (obsolete)
Comment 2 Katrin Fischer 2011-08-01 08:57:51 UTC
Created attachment 4787 [details] [review]
Signed off patch
Comment 3 Chris Cormack 2011-08-01 09:12:37 UTC
Security issue, pushed to master, please test
Comment 4 Liz Rea 2011-08-04 16:43:52 UTC
Works. Thanks!