https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=42769
David Cook <[email protected]> changed: What |Removed |Added ---------------------------------------------------------------------------- Status|Signed Off |Failed QA --- Comment #13 from David Cook <[email protected]> --- That said, changing this to "Failed QA". It looks like this change would allow people to bypass cross-branch restrictions (ie IndependentBranches/Library Groups). For instance, responses should be limited by patron_id and item_id to only those patrons and items accessible to the logged in user. Otherwise, the REST API endpoint could easily be used in a user enumeration attack to show information for all users across privacy and permission boundaries (as this endpoint only requires the sip2 permission). I think the API endpoint will need some additional permissions as well regarding patron information. -- You are receiving this mail because: You are watching all bug changes. _______________________________________________ Koha-bugs mailing list -- [email protected] To unsubscribe send an email to [email protected] website : http://www.koha-community.org/ git : http://git.koha-community.org/ bugs : http://bugs.koha-community.org/
