From 84777319d75c87e701c7ac00f9f4cba1cda75dc9 Mon Sep 17 00:00:00 2001 From: jvoisin Date: Tue, 14 Apr 2026 23:05:18 +0200 Subject: [PATCH] Fix access bypass on /show/ (serve_book) The `serve_book` function uses `get_book()` which performs no access filtering: it simply fetches by ID. Compare with `read_book` at web.py:1562 which correctly uses `get_filtered_book()`. The `common_filters()` function enforces per-user tag restrictions, language restrictions, and hidden-book rules. --- cps/web.py | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-) diff --git a/cps/web.py b/cps/web.py index cc261b8dd..6c3f1f76c 100644 --- a/cps/web.py +++ b/cps/web.py @@ -1195,7 +1195,9 @@ def get_robots(): @viewer_required def serve_book(book_id, book_format, anyname): book_format = book_format.split(".")[0] - book = calibre_db.get_book(book_id) + book = calibre_db.get_filtered_book(book_id) + if not book: + return "File not in Database" data = calibre_db.get_book_format(book_id, book_format.upper()) if not data: return "File not in Database"