[Bug 6641] New: Specially crafted URL can allow unauthorized download of MARC files from staff client
http://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=6641 Bug #: 6641 Summary: Specially crafted URL can allow unauthorized download of MARC files from staff client Classification: Unclassified Change sponsored?: --- Product: Koha Version: rel_3_6 Platform: All OS/Version: All Status: NEW Severity: major Priority: P5 Component: Staff Client AssignedTo: paul.poulain@biblibre.com ReportedBy: wizzyrea@gmail.com QAContact: koha-bugs@lists.koha-community.org CC: gmcharlt@gmail.com http://staff.client.url/cgi-bin/koha/catalogue/export.pl?format=utf8&op=export&bib=4224 (as an example) would allow unauthorized users to download MARC files from the staff side of the ILS. It might be possible to DOS the staff client using this. The same functionality is available from the OPAC, the download functionality should only be available from the staff client when a user is logged in. -- Configure bugmail: http://bugs.koha-community.org/bugzilla3/userprefs.cgi?tab=email ------- You are receiving this mail because: ------- You are the QA Contact for the bug.
http://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=6641 --- Comment #1 from Liz Rea <wizzyrea@gmail.com> 2011-07-28 21:32:26 UTC --- Created attachment 4770 --> http://bugs.koha-community.org/bugzilla3/attachment.cgi?id=4770 Bug 6641 -- Specially crafted URL can allow unauthorized download of MARC files from staff client Making sure permissions are checked on download of MARC files from staff client -- Configure bugmail: http://bugs.koha-community.org/bugzilla3/userprefs.cgi?tab=email ------- You are receiving this mail because: ------- You are the QA Contact for the bug.
http://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=6641 Liz Rea <wizzyrea@gmail.com> changed: What |Removed |Added ---------------------------------------------------------------------------- Priority|P5 |PATCH-Sent CC| |wizzyrea@gmail.com Patch Status|--- |Needs Signoff -- Configure bugmail: http://bugs.koha-community.org/bugzilla3/userprefs.cgi?tab=email ------- You are receiving this mail because: ------- You are the QA Contact for the bug.
http://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=6641 Chris Cormack <chris@bigballofwax.co.nz> changed: What |Removed |Added ---------------------------------------------------------------------------- Attachment #4770|0 |1 is obsolete| | --- Comment #2 from Chris Cormack <chris@bigballofwax.co.nz> 2011-08-01 08:44:35 UTC --- Created attachment 4786 --> http://bugs.koha-community.org/bugzilla3/attachment.cgi?id=4786 Bug 6641 -- Specially crafted URL can allow unauthorized download of MARC files from staff client Making sure permissions are checked on download of MARC files from staff client Signed-off-by: Chris Cormack <chrisc@catalyst.net.nz> -- Configure bugmail: http://bugs.koha-community.org/bugzilla3/userprefs.cgi?tab=email ------- You are receiving this mail because: ------- You are the QA Contact for the bug.
http://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=6641 Chris Cormack <chris@bigballofwax.co.nz> changed: What |Removed |Added ---------------------------------------------------------------------------- CC| |chris@bigballofwax.co.nz Patch Status|Needs Signoff |Signed Off -- Configure bugmail: http://bugs.koha-community.org/bugzilla3/userprefs.cgi?tab=email ------- You are receiving this mail because: ------- You are the QA Contact for the bug.
http://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=6641 Chris Cormack <chris@bigballofwax.co.nz> changed: What |Removed |Added ---------------------------------------------------------------------------- Patch Status|Signed Off |Patch Pushed --- Comment #3 from Chris Cormack <chris@bigballofwax.co.nz> 2011-08-01 09:17:53 UTC --- Security issue, patch pushed please test -- Configure bugmail: http://bugs.koha-community.org/bugzilla3/userprefs.cgi?tab=email ------- You are receiving this mail because: ------- You are the QA Contact for the bug.
http://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=6641 Liz Rea <wizzyrea@gmail.com> changed: What |Removed |Added ---------------------------------------------------------------------------- Status|NEW |RESOLVED Resolution| |FIXED --- Comment #4 from Liz Rea <wizzyrea@gmail.com> 2011-08-04 18:51:11 UTC --- Tested, works! -- Configure bugmail: http://bugs.koha-community.org/bugzilla3/userprefs.cgi?tab=email ------- You are receiving this mail because: ------- You are the QA Contact for the bug.
participants (1)
-
bugzilla-daemon＠bugs.koha-community.org