https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=43263 Bug ID: 43263 Summary: Public biblio ratings API does not check OpacSuppression Initiative type: --- Sponsorship --- status: Product: Koha Version: Main Hardware: All OS: All Status: NEW Severity: normal Priority: P5 - low Component: Architecture, internals, and plumbing Assignee: koha-bugs@lists.koha-community.org Reporter: tomascohen@gmail.com QA Contact: testopia@bugs.koha-community.org Depends on: 43258 Target Milestone: --- POST /api/v1/public/biblios/:id/ratings (Koha::REST::V1::Biblios::set_rating) does not check whether the biblio is suppressed. A logged-in patron can rate a suppressed record if they know its biblio_id, confirming the existence of a record that should be hidden. Impact: information disclosure - the existence of suppressed bibliographic records can be confirmed via the public API (a successful rating confirms the record exists). Affected endpoints: - POST /api/v1/public/biblios/:id/ratings (Koha::REST::V1::Biblios::set_rating) Related: bug 43258 introduces Koha::IP and Koha::REST::Plugin::Restrictions which provide the fix mechanism. Referenced Bugs: https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=43258 [Bug 43258] Add a centralized IP range matching helper -- You are receiving this mail because: You are the assignee for the bug. You are watching all bug changes.