[Bug 6642] New: Able to download label batches as an unauthorized user
http://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=6642 Bug #: 6642 Summary: Able to download label batches as an unauthorized user Classification: Unclassified Change sponsored?: --- Product: Koha Version: rel_3_6 Platform: All OS/Version: All Status: NEW Severity: major Priority: P5 Component: Label printing AssignedTo: cnighswonger@foundations.edu ReportedBy: wizzyrea@gmail.com QAContact: koha-bugs@lists.koha-community.org http://staff.client.url/cgi-bin/koha/labels/label-create-pdf.pl?batch_id=1&template_id=1&layout_id=17&start_label=1 (as an example) would allow unauthorized users to download generated PDF files from the staff side of the ILS. It might be possible to DOS the staff client using this. -- Configure bugmail: http://bugs.koha-community.org/bugzilla3/userprefs.cgi?tab=email ------- You are receiving this mail because: ------- You are the QA Contact for the bug.
http://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=6642 --- Comment #1 from Chris Cormack <chris@bigballofwax.co.nz> 2011-07-28 21:04:21 UTC --- Created attachment 4768 --> http://bugs.koha-community.org/bugzilla3/attachment.cgi?id=4768 Bug 6642 : Making sure permissions are checked on label creator -- Configure bugmail: http://bugs.koha-community.org/bugzilla3/userprefs.cgi?tab=email ------- You are receiving this mail because: ------- You are the QA Contact for the bug.
http://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=6642 Chris Cormack <chris@bigballofwax.co.nz> changed: What |Removed |Added ---------------------------------------------------------------------------- Priority|P5 |PATCH-Sent CC| |chris@bigballofwax.co.nz Patch Status|--- |Needs Signoff -- Configure bugmail: http://bugs.koha-community.org/bugzilla3/userprefs.cgi?tab=email ------- You are receiving this mail because: ------- You are the QA Contact for the bug.
http://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=6642 Katrin Fischer <katrin.fischer@bsz-bw.de> changed: What |Removed |Added ---------------------------------------------------------------------------- Attachment #4768|0 |1 is obsolete| | --- Comment #2 from Katrin Fischer <katrin.fischer@bsz-bw.de> 2011-08-01 08:57:51 UTC --- Created attachment 4787 --> http://bugs.koha-community.org/bugzilla3/attachment.cgi?id=4787 Signed off patch -- Configure bugmail: http://bugs.koha-community.org/bugzilla3/userprefs.cgi?tab=email ------- You are receiving this mail because: ------- You are the QA Contact for the bug.
http://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=6642 Katrin Fischer <katrin.fischer@bsz-bw.de> changed: What |Removed |Added ---------------------------------------------------------------------------- Blocks| |6654 -- Configure bugmail: http://bugs.koha-community.org/bugzilla3/userprefs.cgi?tab=email ------- You are receiving this mail because: ------- You are the QA Contact for the bug.
http://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=6642 Chris Cormack <chris@bigballofwax.co.nz> changed: What |Removed |Added ---------------------------------------------------------------------------- Patch Status|Needs Signoff |Patch Pushed --- Comment #3 from Chris Cormack <chris@bigballofwax.co.nz> 2011-08-01 09:12:37 UTC --- Security issue, pushed to master, please test -- Configure bugmail: http://bugs.koha-community.org/bugzilla3/userprefs.cgi?tab=email ------- You are receiving this mail because: ------- You are the QA Contact for the bug.
http://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=6642 Liz Rea <wizzyrea@gmail.com> changed: What |Removed |Added ---------------------------------------------------------------------------- Status|NEW |RESOLVED CC| |wizzyrea@gmail.com Resolution| |FIXED --- Comment #4 from Liz Rea <wizzyrea@gmail.com> 2011-08-04 16:43:52 UTC --- Works. Thanks! -- Configure bugmail: http://bugs.koha-community.org/bugzilla3/userprefs.cgi?tab=email ------- You are receiving this mail because: ------- You are the QA Contact for the bug.
participants (1)
-
bugzilla-daemon＠bugs.koha-community.org