Koha's SIP2 server does a lot of logging, including all incoming
requests, in full. This means that passwords are logged, both for
the user the SIP2 client uses for logging into Koha, as well as
for the end users who provide a password to e.g. check something
out. This patch replaces passwords with three asterisks in
log strings, before they are written to the log.
To test, in ktd:
- Run the new tests:
$ prove t/db_dependent/SIP/Sip.t
- Tail the SIP2 logs:
$ sudo tail -f /var/log/koha/kohadev/sip*.log
- Telnet into the SIP2 server:
$ telnet localhost 6001
- Try logging in by pasting this into the telnet session:
"9300CNterm1|COmypassword|CPCPL|"
- Verify that "mypassword" is replaced by "***" in the logs
- Try different values for the password, including the correct password
which is "term1" in ktd
- Try other SIP2 messages that include password fields (AC, AD, CO)
Update 2024-12-03: Fix issues pointed out by QA.
Signed-off-by: Victor Grousset/tuxayo <victor@tuxayo.net>
Signed-off-by: Marcel de Rooy <m.de.rooy@rijksmuseum.nl>
Signed-off-by: Paul Derscheid <paul.derscheid@lmscloud.de>
Signed-off-by: David Cook <dcook@prosentient.com.au>
Signed-off-by: Jonathan Druart <jonathan.druart@bugs.koha-community.org>
Signed-off-by: Paul Derscheid <paul.derscheid@lmscloud.de>
For use_rfc3986() to work, we need at least Template::Toolkit 2.27.
Signed-off-by: Victor Grousset/tuxayo <victor@tuxayo.net>
Signed-off-by: Julian Maurice <julian.maurice@biblibre.com>
Signed-off-by: Paul Derscheid <paul.derscheid@lmscloud.de>
Signed-off-by: Victor Grousset/tuxayo <victor@tuxayo.net>
Signed-off-by: Julian Maurice <julian.maurice@biblibre.com>
Signed-off-by: Paul Derscheid <paul.derscheid@lmscloud.de>
Signed-off-by: Victor Grousset/tuxayo <victor@tuxayo.net>
Signed-off-by: Julian Maurice <julian.maurice@biblibre.com>
Signed-off-by: Paul Derscheid <paul.derscheid@lmscloud.de>
This change invokes Template::Filters->use_rfc3986 in the C4::Template
module.
Test plan:
0. Apply the patch
1. Note that "uri" and "url" filters now escape single quotes
Signed-off-by: Phil Ringnalda <phil@chetcolibrary.org>
Signed-off-by: Victor Grousset/tuxayo <victor@tuxayo.net>
Signed-off-by: Julian Maurice <julian.maurice@biblibre.com>
Signed-off-by: Paul Derscheid <paul.derscheid@lmscloud.de>
...and allow-guarantor functionality. Replaced by $c->auth->public($patron_id)
and/or $c->auth->public_guarantor($patron_id), where $patron_id is the patron's
id that owns the requested resource.
Old method, was applicable to both privileged and public routes:
api/v1/swagger/paths/route.yaml
x-koha-authorization:
allow-owner: true
allow-guarantor: true
New method, use public routes with no x-koha-authorization:
GET /public/route/{patron_id}
Koha/REST/V1/Controller#public_action:
sub public_action {
my $c = shift->openapi->valid_input or return;
my $patron_id = $c->param( 'patron_id' );
try {
# Throws an exception that will render a response of 401 if not
# authenticated and 403 if trying to access another user's resources
$c->auth->public($patron_id); #or $c->auth->public_guarantor($patron_id)
...
# other code
...
}
catch {
$c->unhandled_exception($_);
}
}
Another example of retrieving $patron_id when patron_id is not a request
parameter:
GET /public/another/object/{another_object_id}
my $patron_id = Another::Object->find($another_object_id)->borrowernumber;
try {
# 403 if $another_object_id does not belong to API user
$c->auth->public($patron_id);
...
Signed-off-by: Victor Grousset/tuxayo <victor@tuxayo.net>
Signed-off-by: Marcel de Rooy <m.de.rooy@rijksmuseum.nl>
Signed-off-by: Paul Derscheid <paul.derscheid@lmscloud.de>
To test:
1. prove t/db_dependent/api/v1/article_requests.t
2. Apply patch
3. prove t/db_dependent/api/v1/article_requests.t
Observe success in both cases.
Signed-off-by: Victor Grousset/tuxayo <victor@tuxayo.net>
Signed-off-by: Marcel de Rooy <m.de.rooy@rijksmuseum.nl>
Signed-off-by: Paul Derscheid <paul.derscheid@lmscloud.de>
To test:
1. prove t/db_dependent/api/v1/checkouts.t
2. Apply patch
3. prove t/db_dependent/api/v1/checkouts.t
Observe success in both cases.
Signed-off-by: Victor Grousset/tuxayo <victor@tuxayo.net>
Signed-off-by: Marcel de Rooy <m.de.rooy@rijksmuseum.nl>
Signed-off-by: Paul Derscheid <paul.derscheid@lmscloud.de>
To test:
1. prove t/db_dependent/api/v1/patrons.t
2. Apply patch
3. prove t/db_dependent/api/v1/patrons.t
Observe success in both cases.
Signed-off-by: Victor Grousset/tuxayo <victor@tuxayo.net>
Signed-off-by: Marcel de Rooy <m.de.rooy@rijksmuseum.nl>
Signed-off-by: Paul Derscheid <paul.derscheid@lmscloud.de>
To test:
1. prove t/db_dependent/api/v1/checkouts.t
2. Apply patch
3. prove t/db_dependent/api/v1/checkouts.t
Observe success in both cases.
Signed-off-by: Victor Grousset/tuxayo <victor@tuxayo.net>
Signed-off-by: Marcel de Rooy <m.de.rooy@rijksmuseum.nl>
Signed-off-by: Paul Derscheid <paul.derscheid@lmscloud.de>
To test:
1. prove t/db_dependent/api/v1/patrons_password.t
2. Apply patch
3. prove t/db_dependent/api/v1/patrons_password.t
Observe success in both cases.
https://bugs.koha-community.org/show_bug.cgi?id=28907
Signed-off-by: Victor Grousset/tuxayo <victor@tuxayo.net>
Signed-off-by: Marcel de Rooy <m.de.rooy@rijksmuseum.nl>
Signed-off-by: Paul Derscheid <paul.derscheid@lmscloud.de>
To test:
1. prove t/db_dependent/Koha/REST/Plugin/Auth/PublicRoutes.t
Signed-off-by: Victor Grousset/tuxayo <victor@tuxayo.net>
Signed-off-by: Marcel de Rooy <m.de.rooy@rijksmuseum.nl>
Signed-off-by: Paul Derscheid <paul.derscheid@lmscloud.de>
To test:
1. perl -c Koha/REST/Plugin/Exceptions.pm
2. perl -c Koha/Exceptions/REST.pm
More tests coming in following patches.
Signed-off-by: Victor Grousset/tuxayo <victor@tuxayo.net>
Signed-off-by: Marcel de Rooy <m.de.rooy@rijksmuseum.nl>
Signed-off-by: Paul Derscheid <paul.derscheid@lmscloud.de>
Signed-off-by: Magnus Enger <magnus@libriotech.no>
The new test fails without this patch, and passes
when it is applied.
Signed-off-by: Marcel de Rooy <m.de.rooy@rijksmuseum.nl>
Signed-off-by: Paul Derscheid <paul.derscheid@lmscloud.de>
Signed-off-by: Magnus Enger <magnus@libriotech.no>
Signed-off-by: Marcel de Rooy <m.de.rooy@rijksmuseum.nl>
[EDIT] Added a shebang line.
Signed-off-by: Paul Derscheid <paul.derscheid@lmscloud.de>
This change adds some double quotes where quotes were missing,
and replaces single quotes with double quotes, which prevents XSS.
Test plan:
0. Apply the patch
1. Create a subscription
2. Using the ID from the subscription, go to this page:
http://localhost:8081/cgi-bin/koha/serials/subscription-detail.pl?
print_routing_list_issue=1&subscriptionid=<SUBSCRIPTIONID>
3. Note that you're able to generate a print slip
(You may need to allow popups)
4. To check the security vulnerability is fixed, try the proof-of-concepts
attached to the bug report
Signed-off-by: Victor Grousset/tuxayo <victor@tuxayo.net>
Signed-off-by: Julian Maurice <julian.maurice@biblibre.com>
Signed-off-by: Paul Derscheid <paul.derscheid@lmscloud.de>
This change adds double quotes to some template strings where
quotes are missing all together or single quotes are used incorrectly.
Test plan:
0. Apply the patch
1. Go to http://localhost:8081/cgi-bin/koha/catalogue/search.pl?q=test
2. Click on "Gairm"
3. Use the search result navigation box to go to the next result
On the left of the page. Just bellow the breadcrumb and
left of the record title.
4. Note that everything loads correctly
5. To test that the security hole has been fixed, try some of the
proof-of-concept attacks provided for biblionumber and searchid
Signed-off-by: Victor Grousset/tuxayo <victor@tuxayo.net>
Signed-off-by: Baptiste Wojtkowski <baptiste.wojtkowski@biblibre.com>
Signed-off-by: Paul Derscheid <paul.derscheid@lmscloud.de>
This change prevents CSV Formula injection on DataTables exports
by escaping formula with a single quote prefix as per OWASP recommendations.
Test plan:
0. Apply patch
1. Go to http://localhost:8081/cgi-bin/koha/members/memberentry.pl
?op=edit_form&destination=circ&borrowernumber=51
2. Add the following in a "Circulation note"
=SUM(1+1)
3. Go to http://localhost:8081/cgi-bin/koha/members/member.pl
?quicksearch=1&circsearch=1&searchmember=koha
4. Click "Export" and choose "Excel" and "CSV"
5. Open those downloaded files in Excel
6. Note that the =SUM(1+1) function is prefixed with a single quote,
and is not automatically executed
Signed-off-by: Magnus Enger <magnus@libriotech.no>
Works as advertised. The problematic "cell" is exported as "'=SUM(1+1)".
Signed-off-by: Chris Cormack <chris@bigballofwax.co.nz>
Signed-off-by: Paul Derscheid <paul.derscheid@lmscloud.de>
Test plan:
Run t/db_dependent/Letters.t
Signed-off-by: Marcel de Rooy <m.de.rooy@rijksmuseum.nl>
Signed-off-by: Paul Derscheid <paul.derscheid@lmscloud.de>
(cherry picked from commit b2f3f8b6ea4ae63d762dc51274a2b2c4065acdf0)
Signed-off-by: Paul Derscheid <paul.derscheid@lmscloud.de>
Test plan:
Try things like [% borrower.dateexpiry.strftime('%d-%m-%y') %] in
a notice. Also test datetime fields like borrower.lastseen.
Add locale support with strftime('%d %B', 'nl_NL') etc.
Signed-off-by: Marcel de Rooy <m.de.rooy@rijksmuseum.nl>
Signed-off-by: Paul Derscheid <paul.derscheid@lmscloud.de>
(cherry picked from commit 9a2042c3e9cb975273e6c17e111b4baeb5278006)
Signed-off-by: Paul Derscheid <paul.derscheid@lmscloud.de>
Signed-off-by: Katrin Fischer <katrin.fischer@bsz-bw.de>
(cherry picked from commit 1a4820322e)
Signed-off-by: Paul Derscheid <paul.derscheid@lmscloud.de>
This patch updates the sample_date, as used in koha-testing-docker, with
the new preferred_name field.
Signed-off-by: Katrin Fischer <katrin.fischer@bsz-bw.de>
(cherry picked from commit a5e3b45019)
Signed-off-by: Paul Derscheid <paul.derscheid@lmscloud.de>
This patch updates the sample_date, as used in koha-testing-docker, with
the new preferred_name field.
Signed-off-by: Katrin Fischer <katrin.fischer@bsz-bw.de>
(cherry picked from commit a5e3b45019)
Signed-off-by: Paul Derscheid <paul.derscheid@lmscloud.de>
This patch removes code intended to include the hc-sticky js library.
hc-sticky is not longer included in Koha.
To test, apply the patch and make sure the TagsEnabled system preference
is turned on.
Log in to the OPAC and go to the tags page. Everything should work
correctly. There should be no errors in the developer console.
Signed-off-by: Lucas Gass <lucas@bywatersolutions.com>
Signed-off-by: Jonathan Druart <jonathan.druart@bugs.koha-community.org>
Signed-off-by: Katrin Fischer <katrin.fischer@bsz-bw.de>
(cherry picked from commit 4cb222217f)
Signed-off-by: Paul Derscheid <paul.derscheid@lmscloud.de>
Dates were incorrectly handled during the first days of the month because of
the use of non-zero-padded days values.
(t/db_dependent/Koha/OAIHarvester.t failed)
Signed-off-by: Jonathan Druart <jonathan.druart@bugs.koha-community.org>
Signed-off-by: David Nind <david@davidnind.com>
Signed-off-by: Katrin Fischer <katrin.fischer@bsz-bw.de>
(cherry picked from commit 73fbdbb1f8)
Signed-off-by: Paul Derscheid <paul.derscheid@lmscloud.de>
If one has multiple databases in use adding columns
bookings.creation_date and bookings.modification_date is added
just to first updated database and skipped in other updates.
This happens because we check if these columns already exist
in database from information_schema. We should instead make
this check with method column_exists.
To test:
1. Apply this patch.
3. Drop columns bookings.creation_date and bookings.modification_date:
ALTER TABLE bookings DROP COLUMN creation_date;
ALTER TABLE bookings DROP COLUMN modification_date;
2. Revert your database back to version 24.0600028:
UPDATE systempreferences SET value = "24.0600014" WHERE variable = "version";
3. Run updatedatabase.pl.
=> Check that columns were added.
If you happen to have two databases:
1. Check if you have columns in your bookings table:
SELECT DISTINCT TABLE_SCHEMA, TABLE_NAME FROM
INFORMATION_SCHEMA.COLUMNS WHERE COLUMN_NAME IN
('creation_date', 'modification_date');
=> Note that columns exist only in one of the databases.
2. Make sure you're using database missing columns
from booking table.
3. Apply this patch.
4. Revert back to version 24.0600028.
5. Run updatedatabase.pl
=> Check that columns were now added to database.
Sponsored-by: Koha-Suomi Oy
Signed-off-by: David Nind <david@davidnind.com>
Signed-off-by: Martin Renvoize <martin.renvoize@ptfs-europe.com>
Signed-off-by: Katrin Fischer <katrin.fischer@bsz-bw.de>
(cherry picked from commit a84195d7da)
Signed-off-by: Paul Derscheid <paul.derscheid@lmscloud.de>
Problem highlighted by bug 38436. There is a JS error on some views
with tables at the OPAC.
Uncaught TypeError: table_settings.columns is undefined
Test plan:
Go to the 3 views modified by this patch and confirm that the JS error
in the console is gone when this patch is applied.
Signed-off-by: Owen Leonard <oleonard@myacpl.org>
Signed-off-by: Lucas Gass <lucas@bywatersolutions.com>
Signed-off-by: Katrin Fischer <katrin.fischer@bsz-bw.de>
(cherry picked from commit 4733ca89a6)
Signed-off-by: Paul Derscheid <paul.derscheid@lmscloud.de>
This is no longer used, and should not.
Test plan:
git grep TablesSettings.GetColumns
should not return any results
git grep GetColumns
should not return results related to this method
Signed-off-by: Owen Leonard <oleonard@myacpl.org>
Signed-off-by: Lucas Gass <lucas@bywatersolutions.com>
Signed-off-by: Katrin Fischer <katrin.fischer@bsz-bw.de>
(cherry picked from commit 827126e316)
Signed-off-by: Paul Derscheid <paul.derscheid@lmscloud.de>
We are passing the columns settings, but KohaTable is expecting the
table settings.
Test plan:
Hide some columns for the course reserves table at the OPAC
Define a course, add 1+ items
Go to the OPAC, "Course reserves"
Notice that with this patch the columns are correctly hidden by default.
Signed-off-by: Owen Leonard <oleonard@myacpl.org>
Signed-off-by: Lucas Gass <lucas@bywatersolutions.com>
Signed-off-by: Katrin Fischer <katrin.fischer@bsz-bw.de>
(cherry picked from commit 41c718382c)
Signed-off-by: Paul Derscheid <paul.derscheid@lmscloud.de>
rowGroup plugin is now part of the datatables.min.js bundle. We no
longer need to include its css and js files, and they no longer exist
anyway!
[2024/11/27 08:52:37] [WARN] File not found : lib/jquery/plugins/rowGroup/stylesheets/rowGroup.dataTables.min.css at /kohadevbox/koha/Koha/Template/Plugin/Asset.pm line 107
[2024/11/27 08:52:37] [WARN] File not found : lib/jquery/plugins/rowGroup/dataTables.rowGroup.min.js at /kohadevbox/koha/Koha/Template/Plugin/Asset.pm line 84.
Test plan:
Confirm that the checkouts are grouped "today" and "previous" on the
checkout page.
Signed-off-by: David Nind <david@davidnind.com>
Signed-off-by: Matt Blenkinsop <matt.blenkinsop@ptfs-europe.com>
Signed-off-by: Katrin Fischer <katrin.fischer@bsz-bw.de>
(cherry picked from commit 4b82e00416)
Signed-off-by: Paul Derscheid <paul.derscheid@lmscloud.de>
This patch updates the JavaScript on the patrons requesting modification
page in order to make it work following the upgrade to Bootstrap 5. The
automatic panel expansion is broken.
To test, apply the patch and enable, if necessary, the OPACPatronDetails
system preference.
- Log in to the OPAC and submit changes to your personal details.
- Do this again as a different user so that there is more than one
pending request.
- From the staff interface home page, follow the link for "Patrons
requesting modifications"
- Upon loading, the "Update patron records" page should automatically
expand the first panel.
- Locate the patron record for the second of the patrons you requested
updates for.
- From that patron's detail page, follow the "Review pending
modifications" link.
- The panel containing that patron's information should expand by
default.
Sponsored-by: Athens County Public Libraries
Signed-off-by: David Nind <david@davidnind.com>
Signed-off-by: Jonathan Druart <jonathan.druart@bugs.koha-community.org>
Signed-off-by: Katrin Fischer <katrin.fischer@bsz-bw.de>
(cherry picked from commit a42686d891)
Signed-off-by: Paul Derscheid <paul.derscheid@lmscloud.de>
Signed-off-by: Katrin Fischer <katrin.fischer@bsz-bw.de>
(cherry picked from commit 855638123e)
Signed-off-by: Paul Derscheid <paul.derscheid@lmscloud.de>
Signed-off-by: Lucas Gass <lucas@bywatersolutions.com>
Signed-off-by: Katrin Fischer <katrin.fischer@bsz-bw.de>
(cherry picked from commit 73c7acd33f)
Signed-off-by: Paul Derscheid <paul.derscheid@lmscloud.de>
to test:
1- try to save an agreement with 81+ characters in License Info
2- it does not save
3- apply patch, updatedatabase
4- repeat 1, it works!
Signed-off-by: Lucas Gass <lucas@bywatersolutions.com>
Signed-off-by: Katrin Fischer <katrin.fischer@bsz-bw.de>
(cherry picked from commit 2512392b2a)
Signed-off-by: Paul Derscheid <paul.derscheid@lmscloud.de>
So that we can open in a separate bug using right click.
Signed-off-by: Owen Leonard <oleonard@myacpl.org>
Signed-off-by: Marcel de Rooy <m.de.rooy@rijksmuseum.nl>
Signed-off-by: Katrin Fischer <katrin.fischer@bsz-bw.de>
(cherry picked from commit d53784de3a)
Signed-off-by: Paul Derscheid <paul.derscheid@lmscloud.de>
Test plan:
1) Download the file attached to this bug and save it as a .txt file
2) In the ERM module, create a local package
3) Go to the local titles page and click Import from KBART file
4) Select your package and the saved file and click import
5) The import will fail with just a console error
6) Apply patch and run a restart_all and a yarn js:build
7) Repeat step 4, it should now display an error saying the file must be either TSV or CSV
8) Convert the file to either of those two formats and repeat step 4
9) The file should now import successfully, with a message saying that there is an additional column "bestppn" that will not be imported
Signed-off-by: msaby <mathsabypro@gmail.com>
Signed-off-by: Marcel de Rooy <m.de.rooy@rijksmuseum.nl>
Signed-off-by: Katrin Fischer <katrin.fischer@bsz-bw.de>
(cherry picked from commit 68be4dd747)
Signed-off-by: Paul Derscheid <paul.derscheid@lmscloud.de>
To test from the OPAC:
1 - create a list with more than 10 items
2 - print the list -> there is a pagination and that only 10 items
are printed
3 - Apply patch
4 - print the list again -> every items are being printed
Signed-off-by: Sam Sowanick <sam.sowanick@corvallisoregon.gov>
Signed-off-by: Marcel de Rooy <m.de.rooy@rijksmuseum.nl>
[EDIT] Tidied: added a few spaces.
Signed-off-by: Katrin Fischer <katrin.fischer@bsz-bw.de>
(cherry picked from commit 8d0e7ff906)
Signed-off-by: Katrin Fischer <katrin.fischer@bsz-bw.de>
(cherry picked from commit 7c6c3e8f9c)
Signed-off-by: Paul Derscheid <paul.derscheid@lmscloud.de>
The cause was erroneous check `[% IF bundlesEnabled %]` before the parent bundle information is requested+shown. The `bundlesEnabled` variable checks if the current biblio ITSELF is of collection type, so should only be used for whether to show the button to add new items to the bundle items, NOT for querying whether current item is part of a bundle, as the items that make up the bundle aren't of collection type themselves.
The second fixed problem was that `bundle_host` didn't contain `.biblio` subitem (which'd contain the actual host biblio title) as the JavaScript code assumed, and it wasn't possible to request it with the API either.
Test plan: please follow the reproduction instructions from bug and ensure that the described issue is gone.
If you run into an error 400 on the detail page, you need to refresh API definitions, in kts shell you'drun:
redocly bundle --ext json api/v1/swagger/swagger.yaml --output api/v1/swagger/swagger_bundle.json
koha-plack --restart kohadev
Signed-off-by: Roman Dolny <roman.dolny@jezuici.pl>
Signed-off-by: Marcel de Rooy <m.de.rooy@rijksmuseum.nl>
Signed-off-by: Katrin Fischer <katrin.fischer@bsz-bw.de>
(cherry picked from commit 7df4eda9ec)
Signed-off-by: Paul Derscheid <paul.derscheid@lmscloud.de>
The database columns for liblibrarian and libopac in marc_tag_structure and
marc_subfield_structure are 255 characters, but the HTML maxlength in
/koha-tmpl/intranet-tmpl/prog/en/modules/admin/marctagstructure.tt and
/koha-tmpl/intranet-tmpl/prog/en/modules/admin/marc_subfields_structure.tt
limit tags to 100 characters and subfields to 80 characters.
Test plan:
1. Apply patch, restart_all
2. Administration - MARC bibliographic framework - for Default, Actions -
MARC Structure
3. For the 000 tag, Actions - Edit tag
4. In both the "Description in staff interface" and "Description in OPAC"
paste the 255 character string
1234567890 1234567890 1234567890 1234567890 1234567890 1234567890 1234567890 1234567890 1234567890 1234567890 1234567890 1234567890 1234567890 1234567890 1234567890 1234567890 1234567890 1234567890 1234567890 1234567890 1234567890 1234567890 1234567890 12
and click Save changes
5. Verify that the display shows all 255 characters, then Actions - Edit tag
and verify that the two inputs reloaded with all 255 characters, and that
you cannot type a 256th character, then click Cancel
6. For the 000 tag, Actions - Edit subfields
7. Paste the same string in both the staff interface and OPAC inputs, Save
changes, verify that all 255 characters show, click Edit subfields, verify
that all 255 characters reloaded in the inputs, verify that you cannot
type a 256th character
Sponsored-by: Chetco Community Public Library
Signed-off-by: Shi Yao Wang <shi-yao.wang@inlibro.com>
Signed-off-by: Lucas Gass <lucas@bywatersolutions.com>
Signed-off-by: Katrin Fischer <katrin.fischer@bsz-bw.de>
(cherry picked from commit a9044f4b34)
Signed-off-by: Paul Derscheid <paul.derscheid@lmscloud.de>
Signed-off-by: Katrin Fischer <katrin.fischer@bsz-bw.de>
(cherry picked from commit 7c6c3e8f9c)
Signed-off-by: Paul Derscheid <paul.derscheid@lmscloud.de>
Magnus Enger
Julian Maurice
Phil Ringnalda
Jonathan Druart
David Cook
Lari Taskula
Paul Derscheid
Marcel de Rooy
Andrew Fuerste Henry
Martin Renvoize
Owen Leonard
Matthias Meusburger
Emmi Takkinen
Katrin Fischer
Matt Blenkinsop
Lucas Gass
Michał Kula