https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=42769 David Cook <dcook@prosentient.com.au> changed: What |Removed |Added ---------------------------------------------------------------------------- Status|Signed Off |Failed QA --- Comment #13 from David Cook <dcook@prosentient.com.au> --- That said, changing this to "Failed QA". It looks like this change would allow people to bypass cross-branch restrictions (ie IndependentBranches/Library Groups). For instance, responses should be limited by patron_id and item_id to only those patrons and items accessible to the logged in user. Otherwise, the REST API endpoint could easily be used in a user enumeration attack to show information for all users across privacy and permission boundaries (as this endpoint only requires the sip2 permission). I think the API endpoint will need some additional permissions as well regarding patron information. -- You are receiving this mail because: You are watching all bug changes.