09ae62a758
The MARC Preview feature in the Staff client (catalogue/showmarc.pl) does not
check whether a user is logged in or not. As a consequence, it can be used to
obtain information that would normally be available to logged-in users only.
For example, you can view any bibliographic record by passing a value to the
'id' argument, but you can also view records as they were imported (normally
done via the 'Staged MARC management' tool).
All three 17.11 installations currently listed at
https://wiki.koha-community.org/wiki/Koha_Demo_Installations
are affected by this issue, as demonstrated by the URLs below:
http://koha.adminkuhn.ch:8080/cgi-bin/koha/catalogue/showmarc.pl?importid=1&viewas=html
http://pro.demo1711-koha.test.biblibre.eu/cgi-bin/koha/catalogue/showmarc.pl?id=1000&viewas=html
https://staff-kohademo.equinoxinitiative.org/cgi-bin/koha/catalogue/showmarc.pl?id=1&viewas=html
It should be noted that this only applies to XSLT-enabled installations.
Signed-off-by: Mark Tompsett <mtompset@hotmail.com>
Signed-off-by: Marcel de Rooy <m.de.rooy@rijksmuseum.nl>
Signed-off-by: Nick Clemens <nick@bywatersolutions.com>
(cherry picked from commit
|
||
|---|---|---|
| C4 | ||
| Koha | ||
| OpenILS | ||
| acqui | ||
| admin | ||
| api/v1 | ||
| authorities | ||
| basket | ||
| catalogue | ||
| cataloguing | ||
| circ | ||
| clubs | ||
| course_reserves | ||
| debian | ||
| docs | ||
| errors | ||
| etc | ||
| installer | ||
| koha-tmpl | ||
| labels | ||
| members | ||
| misc | ||
| offline_circ | ||
| opac | ||
| patron_lists | ||
| patroncards | ||
| plugins | ||
| reports | ||
| reserve | ||
| reviews | ||
| rotating_collections | ||
| serials | ||
| services | ||
| skel | ||
| sms | ||
| suggestion | ||
| svc | ||
| t | ||
| tags | ||
| test | ||
| tmp/modified_authorities | ||
| tools | ||
| virtualshelves | ||
| xt | ||
| .editorconfig | ||
| .htaccess | ||
| .mailmap | ||
| INSTALL | ||
| Koha.pm | ||
| LICENSE | ||
| MANIFEST.SKIP | ||
| Makefile.PL | ||
| README | ||
| README.md | ||
| README.robots | ||
| about.pl | ||
| changelanguage.pl | ||
| edithelp.pl | ||
| fix-perl-path.PL | ||
| help.pl | ||
| install-CPAN.pl | ||
| koha_perl_deps.pl | ||
| kohaversion.pl | ||
| mainpage.pl | ||
| rewrite-config.PL | ||
README.md
Koha is a free software integrated library system (ILS).
Koha is distributed under the GNU GPL version 3 or later.
Note: This is a synced mirror of the official Koha repo.
Note: Koha does not accept pull requests from git hosting sites.
Note: This project has its own bug tracker, to report a bug or submit a patch visit http://bugs.koha-community.org.
For guidelines on submitting patches for Koha please visit https://wiki.koha-community.org/wiki/SubmitingAPatch
The developers handbook can be found at https://wiki.koha-community.org/wiki/Developer_handbook
