Bug 6653 - [security] Rotating collections pages can be accessed without being logged in
Summary: [security] Rotating collections pages can be accessed without being logged in
Status: CLOSED FIXED
Alias: None
Product: Koha
Classification: Unclassified
Component: Authentication (show other bugs)
Version: master
Hardware: All All
: PATCH-Sent (DO NOT USE) critical (vote)
Assignee: Galen Charlton
QA Contact: Bugs List
URL:
Keywords:
Depends on:
Blocks: 6654
  Show dependency treegraph
 
Reported: 2011-08-01 09:07 UTC by Katrin Fischer
Modified: 2019-06-27 09:24 UTC (History)
5 users (show)

See Also:
Change sponsored?: ---
Patch complexity: ---
Documentation contact:
Documentation submission:
Text to go in the release notes:
Version(s) released in:


Attachments
Bug 6553 : Fixing authentication issue, there is no reason we should be able to use these without authentication (2.80 KB, patch)
2011-08-01 09:54 UTC, Chris Cormack
Details | Diff | Splinter Review
Bug 6553 : Follow up adding license statements (4.67 KB, patch)
2011-08-01 09:55 UTC, Chris Cormack
Details | Diff | Splinter Review
Signed off patch (2.92 KB, patch)
2011-08-01 10:04 UTC, Katrin Fischer
Details | Diff | Splinter Review
Signed follow up patch (4.81 KB, patch)
2011-08-04 08:12 UTC, Marcel de Rooy
Details | Diff | Splinter Review

Note You need to log in before you can comment on or make changes to this bug.
Description Katrin Fischer 2011-08-01 09:07:54 UTC
Following URLs in staff can be accessed withoug being logged in:

.../cgi-bin/koha/rotating_collections/editCollections.pl
.../cgi-bin/koha/rotating_collections/rotatingCollections.pl
.../cgi-bin/koha/rotating_collections/addItems.pl
.../cgi-bin/koha/rotating_collections/transferCollection.pl
Comment 1 Chris Cormack 2011-08-01 09:54:54 UTC Comment hidden (obsolete)
Comment 2 Chris Cormack 2011-08-01 09:55:14 UTC Comment hidden (obsolete)
Comment 3 Katrin Fischer 2011-08-01 10:04:07 UTC
Created attachment 4792 [details] [review]
Signed off patch
Comment 4 Marcel de Rooy 2011-08-04 08:09:46 UTC
Followup signed (only text)
Comment 5 Marcel de Rooy 2011-08-04 08:12:34 UTC
Created attachment 4834 [details] [review]
Signed follow up patch
Comment 6 Ian Walls 2011-08-12 19:06:26 UTC
Simple change to known parameter (1 => 0), then addition of consistent Licensing text... marking as Passed QA
Comment 7 Chris Cormack 2011-08-13 08:03:40 UTC
Pushed, please test