Bug 6643 - Able to download patron card batches as an unauthorized user
Summary: Able to download patron card batches as an unauthorized user
Status: CLOSED FIXED
Alias: None
Product: Koha
Classification: Unclassified
Component: Tools (show other bugs)
Version: 3.6
Hardware: All All
: PATCH-Sent (DO NOT USE) critical (vote)
Assignee: Galen Charlton
QA Contact: Bugs List
URL:
Keywords:
Depends on:
Blocks:
 
Reported: 2011-07-28 16:15 UTC by Liz Rea
Modified: 2019-06-27 09:24 UTC (History)
2 users (show)

See Also:
Change sponsored?: ---
Patch complexity: ---
Text to go in the release notes:
Version(s) released in:


Attachments
Bug 6643 -- Able to download patron card batches as an unauthorized user (1.71 KB, patch)
2011-07-28 21:19 UTC, Liz Rea
Details | Diff | Splinter Review
Bug 6643 -- Able to download patron card batches as an unauthorized user (1.72 KB, patch)
2011-08-01 08:42 UTC, Chris Cormack
Details | Diff | Splinter Review

Note You need to log in before you can comment on or make changes to this bug.
Description Liz Rea 2011-07-28 16:15:04 UTC
http://staff.client.url/cgi-bin/koha/patroncards/create-pdf.pl?batch_id=3&template_id=23&layout_id=20&start_card=1

This requires knowledge of the batch, template, layout, and start_card id's, but it is still possible to download a generated batch of patron cards as an unauthorized user.
Comment 1 Liz Rea 2011-07-28 21:19:34 UTC Comment hidden (obsolete)
Comment 2 Chris Cormack 2011-08-01 08:42:19 UTC
Created attachment 4785 [details] [review]
Bug 6643 -- Able to download patron card batches as an unauthorized user

Making sure permissions are checked on label creator

Signed-off-by: Chris Cormack <chrisc@catalyst.net.nz>
Comment 3 Chris Cormack 2011-08-01 09:18:46 UTC
Security issue, patch pushed please test
Comment 4 Liz Rea 2011-08-04 16:45:40 UTC
Tested, works!