https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=43262 Bug ID: 43262 Summary: Public biblio items API does not check OpacSuppression Initiative type: --- Sponsorship --- status: Product: Koha Version: Main Hardware: All OS: All Status: NEW Severity: major Priority: P5 - low Component: Architecture, internals, and plumbing Assignee: koha-bugs@lists.koha-community.org Reporter: tomascohen@gmail.com QA Contact: testopia@bugs.koha-community.org Depends on: 43258 Target Milestone: --- GET /api/v1/public/biblios/:id/items (Koha::REST::V1::Biblios::get_items_public) does not check whether the parent biblio is suppressed. If a client knows the biblio_id of a suppressed record, they can enumerate its items via the public API. The endpoint uses filter_by_visible_in_opac() which handles OpacHiddenItems at the item level, but does not check biblio-level suppression (OpacSuppression / OpacSuppressionByIPRange). Impact: information disclosure - items belonging to suppressed bibliographic records are accessible via the public API. Affected endpoints: - GET /api/v1/public/biblios/:id/items (Koha::REST::V1::Biblios::get_items_public) Related: bug 43258 introduces Koha::IP and Koha::REST::Plugin::Restrictions which provide the fix mechanism. Referenced Bugs: https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=43258 [Bug 43258] Add a centralized IP range matching helper -- You are receiving this mail because: You are the assignee for the bug. You are watching all bug changes.