https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=43261 Bug ID: 43261 Summary: Public biblio API ignores OpacSuppressionByIPRange Initiative type: --- Sponsorship --- status: Product: Koha Version: Main Hardware: All OS: All Status: NEW Severity: major Priority: P5 - low Component: Architecture, internals, and plumbing Assignee: koha-bugs@lists.koha-community.org Reporter: tomascohen@gmail.com QA Contact: testopia@bugs.koha-community.org Depends on: 43258 Target Milestone: --- GET /api/v1/public/biblios/:id checks OpacSuppression but does not check OpacSuppressionByIPRange. This means suppressed records are unconditionally hidden from the public API even for clients within the allowed IP range. Additionally, clients outside the IP range can still access suppressed records if they know the biblio_id, since the IP range check is missing entirely. Impact: information disclosure - suppressed bibliographic records (which may be suppressed for legal, privacy, or collection management reasons) are accessible via the public API regardless of IP restrictions. Affected endpoints: - GET /api/v1/public/biblios/:id (Koha::REST::V1::Biblios::get_public) Related: bug 43258 introduces Koha::IP and Koha::REST::Plugin::Restrictions which provide the fix mechanism. Referenced Bugs: https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=43258 [Bug 43258] Add a centralized IP range matching helper -- You are receiving this mail because: You are watching all bug changes. You are the assignee for the bug.