]> git.evergreen-ils.org Git - Evergreen.git/commit
LP#1207281 Prevent download of offline patron list without authentication
authorMichael Peters <mpeters@emeralddata.net>
Tue, 24 Sep 2013 20:57:37 +0000 (16:57 -0400)
committerBill Erickson <berick@esilibrary.com>
Thu, 3 Oct 2013 14:51:17 +0000 (10:51 -0400)
commita97d5e0c87369a3ed9d23abf010ec368e8460e18
treed54cb5892ebf9076b7d290dbcacd62c0c9148322
parentcaa65873f6fa5e20b4a5bde84af3b4748bc3745a
LP#1207281 Prevent download of offline patron list without authentication

This patch addresses the vulnerability which allowed a user with the proper
knowledge of the location of offline patron lists to download the file over
regular HTTP without any staff credentials.

This small addition to eg_vhost.conf.in will present users with a login prompt
when trying to access the /standalone/ subdirectory on an Evergreen server.

Users are able to download the patron list in the staff client as normal
because they already have obtained credentials during the normal staff client
authentication process.

Signed-off-by: Michael Peters <mpeters@emeralddata.net>
Signed-off-by: Galen Charlton <gmc@esilibrary.com>
Signed-off-by: Bill Erickson <berick@esilibrary.com>
Open-ILS/examples/apache/eg_vhost.conf