https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=43261
Bug ID: 43261
Summary: Public biblio API ignores OpacSuppressionByIPRange
Initiative type: ---
Sponsorship ---
status:
Product: Koha
Version: Main
Hardware: All
OS: All
Status: NEW
Severity: major
Priority: P5 - low
Component: Architecture, internals, and plumbing
Assignee: [email protected]
Reporter: [email protected]
QA Contact: [email protected]
Depends on: 43258
Target Milestone: ---
GET /api/v1/public/biblios/:id checks OpacSuppression but does not check
OpacSuppressionByIPRange. This means suppressed records are unconditionally
hidden from the public API even for clients within the allowed IP range.
Additionally, clients outside the IP range can still access suppressed records
if they know the biblio_id, since the IP range check is missing entirely.
Impact: information disclosure - suppressed bibliographic records (which may be
suppressed for legal, privacy, or collection management reasons) are accessible
via the public API regardless of IP restrictions.
Affected endpoints:
- GET /api/v1/public/biblios/:id (Koha::REST::V1::Biblios::get_public)
Related: bug 43258 introduces Koha::IP and Koha::REST::Plugin::Restrictions
which provide the fix mechanism.
Referenced Bugs:
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=43258
[Bug 43258] Add a centralized IP range matching helper
--
You are receiving this mail because:
You are watching all bug changes.
You are the assignee for the bug.
_______________________________________________
Koha-bugs mailing list -- [email protected]
To unsubscribe send an email to [email protected]
website : http://www.koha-community.org/
git : http://git.koha-community.org/
bugs : http://bugs.koha-community.org/
