https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=43263
Bug ID: 43263
Summary: Public biblio ratings API does not check
OpacSuppression
Initiative type: ---
Sponsorship ---
status:
Product: Koha
Version: Main
Hardware: All
OS: All
Status: NEW
Severity: normal
Priority: P5 - low
Component: Architecture, internals, and plumbing
Assignee: [email protected]
Reporter: [email protected]
QA Contact: [email protected]
Depends on: 43258
Target Milestone: ---
POST /api/v1/public/biblios/:id/ratings (Koha::REST::V1::Biblios::set_rating)
does not check whether the biblio is suppressed. A logged-in patron can rate a
suppressed record if they know its biblio_id, confirming the existence of a
record that should be hidden.
Impact: information disclosure - the existence of suppressed bibliographic
records can be confirmed via the public API (a successful rating confirms the
record exists).
Affected endpoints:
- POST /api/v1/public/biblios/:id/ratings (Koha::REST::V1::Biblios::set_rating)
Related: bug 43258 introduces Koha::IP and Koha::REST::Plugin::Restrictions
which provide the fix mechanism.
Referenced Bugs:
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=43258
[Bug 43258] Add a centralized IP range matching helper
--
You are receiving this mail because:
You are the assignee for the bug.
You are watching all bug changes.
_______________________________________________
Koha-bugs mailing list -- [email protected]
To unsubscribe send an email to [email protected]
website : http://www.koha-community.org/
git : http://git.koha-community.org/
bugs : http://bugs.koha-community.org/
