user01/calibre-web
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

Fix access bypass on /show/ (serve_book)

Browse Source 
The `serve_book` function uses `get_book()` which performs no access filtering:
it simply fetches by ID. Compare with `read_book` at web.py:1562 which
correctly uses `get_filtered_book()`. The `common_filters()` function enforces
per-user tag restrictions, language restrictions, and hidden-book rules.
This commit is contained in:
jvoisin
2026-04-14 23:05:18 +02:00
parent 088778969d
commit 84777319d7
1 changed files with 3 additions and 1 deletions
Download Patch File Download Diff File Expand all files Collapse all files
cps/web.py
+3 -1
View File
@@ -1195,7 +1195,9 @@ def get_robots():
@viewer_required @viewer_required
def serve_book(book_id, book_format, anyname): def serve_book(book_id, book_format, anyname):
book_format = book_format.split(".")[0] book_format = book_format.split(".")[0]
book = calibre_db.get_book(book_id) book = calibre_db.get_filtered_book(book_id)
if not book:
return "File not in Database"
data = calibre_db.get_book_format(book_id, book_format.upper()) data = calibre_db.get_book_format(book_id, book_format.upper())
if not data: if not data:
return "File not in Database" return "File not in Database"