1/ hit a url like http://localhost:8081/cgi-bin/koha/acqui/lateorders.pl?delay=<script>alert('oh noes')</script>&estimateddeliverydatefrom
2/ Not you get an alert box
3/ Apply patch notice it is fixed
4/ Test functionality still works
Signed-off-by: Jonathan Druart <jonathan.druart@koha-community.org>
Signed-off-by: Katrin Fischer <katrin.fischer.83@web.de>
Signed-off-by: Chris Cormack <chrisc@catalyst.net.nz>
(cherry picked from commit 66dc4a9e7d)
Signed-off-by: Fridolin Somers <fridolin.somers@biblibre.com>
Signed-off-by: Jonathan Druart <jonathan.druart@koha-community.org>
Signed-off-by: Katrin Fischer <katrin.fischer.83@web.de>
Signed-off-by: Tomas Cohen Arazi <tomascohen@theke.io>
(cherry picked from commit 64e47c63dc)
Signed-off-by: Chris Cormack <chrisc@catalyst.net.nz>
(cherry picked from commit beedae8063)
Conflicts:
C4/Auth.pm
t/db_dependent/Auth.t
Signed-off-by: Jonathan Druart <jonathan.druart@koha-community.org>
Signed-off-by: Katrin Fischer <katrin.fischer.83@web.de>
Signed-off-by: Tomas Cohen Arazi <tomascohen@theke.io>
(cherry picked from commit 5dd7c8f0d5)
Signed-off-by: Chris Cormack <chrisc@catalyst.net.nz>
(cherry picked from commit bb5f6b4bfa)
Signed-off-by: Fridolin Somers <fridolin.somers@biblibre.com>
Conflicts:
t/db_dependent/Auth.t
Counter counter patch
Please test well, including with the null byte %00, this uses a whitelisting to only allow files ending with .tt
and not allowing ../etc
Note the previous patch tries to protect against /etc/passwd
but //etc/passwd is now vulnerable. I do think a whitelist is safer than trying to do a blacklist
/cgi-bin/koha/svc/virtualshelves/search
/cgi-bin/koha/svc/members/search
Are vulnerable
To test:
1/ Hit /cgi-bin/koha/svc/members/search?template_path=members/tables/members_results.tt
Notice you get a valid JSON response
2/ Hit
/search?template_path=..%2f..%2f..%2f..%2f..%2f..%2f..%2f..%2f..%2f..%2f..%2f..%2f..%2f..%2f..%2f..%2fetc%2fpasswd
(You may have add more ..%2f or remove them to get the correct path)
Notice you can see the contents of the /etc/passwd file
3/ Hit
/cgi-bin/koha/svc/members/search?template_path=test%2f..%2f..%2f..%2f..%2f..%2f..%2f..%2f..%2f..%2f..%2f..%2f..%2f..%2f..%2f..%2fetc%2fpasswd
4/ Apply patch
5/ Hit the first url again, notice it still works
6/ Hit the second url notice it now errors with a file not found
7/ Hit the third url notice it now errors with a file not found
Repeat for the other script also
Signed-off-by: Jonathan Druart <jonathan.druart@koha-community.org>
Signed-off-by: Katrin Fischer <katrin.fischer.83@web.de>
Signed-off-by: Tomas Cohen Arazi <tomascohen@theke.io>
(cherry picked from commit 5a7f459290)
Signed-off-by: Chris Cormack <chrisc@catalyst.net.nz>
(cherry picked from commit 364de7531c)
Conflicts:
C4/Auth.pm
To test:
1/ Hit a url like
/cgi-bin/koha/opac-shelves.pl?viewshelf=7&op=modif&display="><script>alert('oh
noes')</script> Where the id is a valid shelf id
2/ Notice the js is executed
3/ Apply patch
4/ Reload page
5/ Notice input is now escaped on display
Signed-off-by: Jonathan Druart <jonathan.druart@koha-community.org>
Signed-off-by: Katrin Fischer <katrin.fischer@bsz-bw.de>
Tested in Debian, couldn't reproduce the alert in Iceweasel, but in
Chromium. Patch fixes it.
Signed-off-by: Tomas Cohen Arazi <tomascohen@unc.edu.ar>
(cherry picked from commit cd4c959f72)
(cherry picked from commit f9569612b6)
Signed-off-by: Fridolin Somers <fridolin.somers@biblibre.com>
Fix for /cgi-bin/koha/opac-search.pl
To test
1/ Hit /cgi-bin/koha/opac-search.pl?tag="><script
src='http://cst.sba-research.org/x.js'/>&q=a
2/ Notice the js is executed
3/ Apply patch
4/ Reload page, notice it is no longer executed
5/ Test the rss links work still
Signed-off-by: Jonathan Druart <jonathan.druart@koha-community.org>
Signed-off-by: Katrin Fischer <katrin.fischer@bsz-bw.de>
Confirmed bug and that the patch fixes it.
Signed-off-by: Tomas Cohen Arazi <tomascohen@unc.edu.ar>
(cherry picked from commit 45dd775401)
Signed-off-by: Chris Cormack <chrisc@catalyst.net.nz>
(cherry picked from commit 21cc992e7e)
Signed-off-by: Fridolin Somers <fridolin.somers@biblibre.com>
Conflicts:
koha-tmpl/opac-tmpl/bootstrap/en/modules/opac-results.tt
To test:
1) Create a list in the OPAC, name it: <script>alert('Hello');</script>
2) Delete the list
3) Confirm deletion
4) See the alert say 'Hello'
5) Apply patch
6) Recreate list with same name
7) Delete list
8) Confirm deletion and alert no longer pops up
Signed-off-by: Katrin Fischer <Katrin.Fischer.83@web.de>
Signed-off-by: Kyle M Hall <kyle@bywatersolutions.com>
Signed-off-by: Tomas Cohen Arazi <tomascohen@gmail.com>
(cherry picked from commit 9bef8f8738)
Signed-off-by: Chris Cormack <chrisc@catalyst.net.nz>
(cherry picked from commit cab96a3c8c)
Adding |html to [% resultsperpage %] to escape the variable and get rid of the alert.
To test:
1) Go to URL such as ... /cgi-bin/koha/opac-authorities-home.pl?op=do_search&resultsperpage=1%22%3E%3Cscript%3Ealert%28document.cookie%29%3C/script%3E
2) Notice pop-up box with alert
3) Apply patch, refresh page
4) Notice alert is gone
Signed-off-by: Katrin Fischer <Katrin.Fischer.83@web.de>
Signed-off-by: Kyle M Hall <kyle@bywatersolutions.com>
Signed-off-by: Tomas Cohen Arazi <tomascohen@gmail.com>
(cherry picked from commit 9e920f7479)
Signed-off-by: Chris Cormack <chrisc@catalyst.net.nz>
(cherry picked from commit ff0281d40a)
Signed-off-by: Fridolin Somers <fridolin.somers@biblibre.com>
Conflicts:
koha-tmpl/opac-tmpl/bootstrap/en/modules/opac-authoritiessearchresultlist.tt
There is a SQL Injection vulnerability in the
/cgi-bin/koha/opac-tags_subject.pl script.
By manipulating the variable 'number', the database can be accessed
via time-based blind injections.
The following string serves as an example:
/cgi-bin/koha/opac-tags_subject.pl?number=1+PROCEDURE+ANALYSE+(EXTRACTVALUE(9743,CONCAT(0x5c,(BENCHMARK(5000000,MD5('evil'))))),1)
To exploit the vulnerability, no authentication is needed
To test
1/ Turn on mysql query logging
2/ Hit /cgi-bin/koha/opac-tags_subject.pl?number=1+PROCEDURE+ANALYSE+(EXTRACTVALUE(9743,CONCAT(0x5c,(BENCHMARK(5000000,MD5('evil'))))),1)
3/ Check the logs notice something like
SELECT entry,weight FROM tags ORDER BY weight DESC LIMIT 1
PROCEDURE ANALYSE
(EXTRACTVALUE(9743,CONCAT(0x5c,(BENCHMARK(5000000,MD5('evil'))))),1)
4/ Apply patch
5/ Hit the url again
6/ Notice the log now only has
SELECT entry,weight FROM tags ORDER BY weight DESC LIMIT 1
Signed-off-by: Jonathan Druart <jonathan.druart@koha-community.org>
Signed-off-by: Katrin Fischer <katrin.fischer@bsz-bw.de>
Confirmed the problem and the fix for it.
Signed-off-by: Tomas Cohen Arazi <tomascohen@unc.edu.ar>
(cherry picked from commit 57b01fb655)
Signed-off-by: Chris Cormack <chrisc@catalyst.net.nz>
(cherry picked from commit b414b22bf0)
Signed-off-by: Fridolin Somers <fridolin.somers@biblibre.com>
Signed-off-by: Jonathan Druart <jonathan.druart@koha-community.org>
Signed-off-by: Katrin Fischer <katrin.fischer@bsz-bw.de>
Signed-off-by: Tomas Cohen Arazi <tomascohen@unc.edu.ar>
(cherry picked from commit 542b06f065)
Signed-off-by: Chris Cormack <chrisc@catalyst.net.nz>
(cherry picked from commit afb00d1390)
Signed-off-by: Fridolin Somers <fridolin.somers@biblibre.com>
Signed-off-by: Jonathan Druart <jonathan.druart@koha-community.org>
Signed-off-by: Katrin Fischer <katrin.fischer@bsz-bw.de>
Signed-off-by: Tomas Cohen Arazi <tomascohen@unc.edu.ar>
(cherry picked from commit abd2bc99e8)
Signed-off-by: Chris Cormack <chrisc@catalyst.net.nz>
(cherry picked from commit 1ba766f200)
Signed-off-by: Fridolin Somers <fridolin.somers@biblibre.com>
opac-addbybiblionumber.pl is also vulnerable because it doesn't escape
list names.
To test
1/ Create a malicious list name
2/ Try to add a biblio to the lists
3/ Notice js is excuted
4/ Apply patch
5/ Test again
Signed-off-by: Jonathan Druart <jonathan.druart@koha-community.org>
Signed-off-by: Katrin Fischer <katrin.fischer@bsz-bw.de>
Signed-off-by: Tomas Cohen Arazi <tomascohen@unc.edu.ar>
(cherry picked from commit fb51a4bb0f)
Signed-off-by: Chris Cormack <chrisc@catalyst.net.nz>
(cherry picked from commit 20910660a2)
Signed-off-by: Fridolin Somers <fridolin.somers@biblibre.com>
A failed login should not leave the user in a half logged authenticated
state, but rather return them to an anonymouse session as per the
pre-login attempt state.
To replicate error:
1. Try to log in with some nonexisting user id or wrong password in the
OPAC
2. Go directly to /opac-user.pl (e.g., enter it in the browser address
bar, or just click on the "Log in" link)
3. Observe a DBI error displayed on the screen
4. You are now in the "deadloop" of sorts (opac/opac-user.pl refuses to
display the login screen, no matter how many times you try to reload
it); to break the deadloop, one needs to:
- remove session cookie from the browser (or cause the session to
expire in some other way - closing browser window would be probably
enough for that)
- remove offending session on the server (from mysql sessions table,
..)
- log in with proper credentials using some other page (like
opac/opac-main.pl right-side panel), which does not involve
opac/opac-user.pl being called without "userid" CGI parameter.
To test:
1. Test as above, the DBI error should no longer be present
2. Check that search history works across failed and sucessful login
attempts
Signed-off-by: Chris Cormack <chris@bigballofwax.co.nz>
Signed-off-by: Jonathan Druart <jonathan.druart@biblibre.com>
Signed-off-by: Mason James <mtj@kohaaloha.com>
(cherry picked from commit 7f504acc13)
Signed-off-by: Fridolin Somers <fridolin.somers@biblibre.com>
Add a missing semicolon to the end of a template variable assignment
line. This patch should not affect operation.
Note: With Bug 13499 we did a non-destructive perltidy, as such we only
affected indenting and whitespace to maintain blame history. However, a
number of minor code issues were also highlighted, in this series of
patches I hope to correct other minor style issues.
Signed-off-by: Chris Cormack <chris@bigballofwax.co.nz>
Signed-off-by: Jonathan Druart <jonathan.druart@biblibre.com>
Signed-off-by: Mason James <mtj@kohaaloha.com>
(cherry picked from commit e27969c502)
Signed-off-by: Fridolin Somers <fridolin.somers@biblibre.com>
Removed an uneeded semicolon from the end of an 'if' block. This should
not affect operation of the script.
Note: With Bug 13499 we did a non-destructive perltidy, as such we only
affected indenting and whitespace to maintain blame history. However, a
number of minor code issues were also highlighted, in this series of
patches I hope to correct other minor style issues.
Signed-off-by: Chris Cormack <chris@bigballofwax.co.nz>
Signed-off-by: Jonathan Druart <jonathan.druart@biblibre.com>
Signed-off-by: Mason James <mtj@kohaaloha.com>
(cherry picked from commit c9d12187da)
Signed-off-by: Fridolin Somers <fridolin.somers@biblibre.com>
Test plan:
0/ Add unicode characters on the record biblionumber=X
1/ go on http://<staff-interface>/cgi-bin/koha/svc/bib/X
2/ Confirm you have encoding issues
3/ Apply the patch
4/ Repeat 2
5/ Confirm that all is correctly encoded
Signed-off-by: Josef Moravec <josef.moravec@gmail.com>
Signed-off-by: Katrin Fischer <katrin.fischer.83@web.de>
Signed-off-by: Mason James <mtj@kohaaloha.com>
(cherry picked from commit ede633b714)
Signed-off-by: Fridolin Somers <fridolin.somers@biblibre.com>
This patch removes the NOT NULL restriction on biblioitems.marcxml and
deletedbiblioitems.marcxml due to STRICT_TRANS_TABLES default in
Mysql 5.6.22 and onwards.
Test:
1. check mysql global settings:
mysql > SELECT @@GLOBAL.sql_mode;
verify that STRICT_TRANS_TABLES is not set
2. set STRICT_TRANS_TABLES (or upgrade mysql to > 5.6.21)
mysql > SET @@GLOBAL.sql_mode = 'STRICT_TRANS_TABLES';
3. try to add biblio in Cataloguing module
verify that it fails with a "software error"
4. apply patch
5. repeat 3 and verify that there is no "software error" any more
Signed-off-by: Jonathan Druart <jonathan.druart@biblibre.com>
I confirm with the problem with mariadb and STRICT_TRANS_TABLES enabled.
On adding a biblio (C4::Biblio::AddBiblio), biblioitems is populate in
_koha_add_biblioitem but marxcml is not generated yet. It's in
ModBiblioMarc, few lines later.
The NOT NULL condition is not valid here.
Signed-off-by: Kyle M Hall <kyle@bywatersolutions.com>
Signed-off-by: Mason James <mtj@kohaaloha.com>
(cherry picked from commit 4eaa86acff)
Conflicts:
installer/data/mysql/updatedatabase.pl
"item not scanned": when calling GetItemsForInventory, datelastseen should
be used when "compare barcodes list to result" is checked.
Otherwise, when loading multiple barcodes files for the same inventory, many
items will be marked as "item not scanned" when loading the last barcode file
("compare barcodes list to result" checked) even though they were scanned.
"wrong place": when searching for wrongly placed items, we should only check
for the location (callnumbers, location and branch). To fix this, A new call
to GetItemsForInventory has been made with location filters only.
Otherwise, any item with a different itemtype for instance will be marked as
wrong place even if the location is correct.
Test plan:
"item not scanned" status:
1) Split a barcode file in two.
2) Load the first barcode file without checking "compare barcodes list to result".
3) Load the second barcode file with "compare barcodes list to result" checked.
4) Check in the csv report that you have a lot of scanned items with the "item
not scanned" status.
Then apply the patch, do the same, and check that the false "item not scanned"
statuses are gone.
"wrong place" status:
1) Load a barcode file with barcode matching an item that has a correct
location, but a different itemtype than what you're looking for.
2) Check in the results that this item will be marked as "change item status"
and "wrong place".
Then apply the patch, do the same, and check that the only status for this item is "change item status", which is correct.
Signed-off-by: Brendan Gallagher <brendan@bywatersolutions.com>
Signed-off-by: Kyle M Hall <kyle@bywatersolutions.com>
Signed-off-by: Mason James <mtj@kohaaloha.com>
(cherry picked from commit 7d20f176ce)
Signed-off-by: Fridolin Somers <fridolin.somers@biblibre.com>
This patch adds a sort of branches alphabetically by name in authorised values administration, like in many other pages.
Also replaces var $branch (too ambigus) by $branchcode.
Test plan :
- Create 2 branches : code=AAA,name=Zbranch and code=ZZZ,name=Abranch
- Create a new authorized value : admin/authorised_values.pl
- Look at "Libraries limitation" :
=> Without patch branches are sorted by code : Zbranch then Abranch
=> Without patch branches are sorted by name : Abranch then Zbranch
- Select a branch and save
- Re-edit
=> Check the same branch is selected
Followed test plan. Patch behaves as expected.
Signed-off-by: Marc Veron <veron@veron.ch>
Signed-off-by: Kyle M Hall <kyle@bywatersolutions.com>
Signed-off-by: Mason James <mtj@kohaaloha.com>
(cherry picked from commit 771c294c74)
Signed-off-by: Fridolin Somers <fridolin.somers@biblibre.com>
Signed-off-by: Kyle M Hall <kyle@bywatersolutions.com>
Signed-off-by: Mason James <mtj@kohaaloha.com>
(cherry picked from commit 4c8c1e1cd0)
Signed-off-by: Fridolin Somers <fridolin.somers@biblibre.com>
* Syndetics routines include a statement to check that the returned
content from Syndetics is xml. The get_syndetics_index routine was
missing this check and so when a 'not found' html page was returned
the opac-detail page would take a long time to load whilst xml::simple
attempted to parse the large html document.
Test Plan
1. Enable Syndetics indexes on opac.
2. Head over to an opac-detail page on the opac.
3. Remove the ISBN from the same item in the staff client.
4. Reload the opac-detail page for the item noticeing a much slower
page load.
5. Apply the patch
6. Reload the opac-detail page for the item and note that it now laods
in a reasonable timescale again.
Signed-off-by: Chris Cormack <chris@bigballofwax.co.nz>
Signed-off-by: Kyle M Hall <kyle@bywatersolutions.com>
Signed-off-by: Mason James <mtj@kohaaloha.com>
(cherry picked from commit 8ac1c243fe)
Signed-off-by: Fridolin Somers <fridolin.somers@biblibre.com>
In some cases (eg. when Staf Client Search is active), when user choose
Edit->Delete record on record tool bar, browser don't wait for
confirmation and goes immediately to delete record.
To reproduce:
1. Search for some biblio records and choose one without items attached.
2. Note that there, must be "Return to search results" box on left side,
bug works in that case, when in normal view everything work fine.
3. Click Edit->Delete record, watch that confirmation box shows, but
don't wait for OK and runs immediately. If you are fast enough to
click OK, then you get error as below, because record was deleted
earlier.
To test:
1. Apply patch.
2. Follow reproduce steps.
3. Check if waits for confirmation in all cases.
4. Check if deletes record after confirm.
Followed test plan. Patch behaves as expected.
Signed-off-by: Marc Véron <veron@veron.ch>
Signed-off-by: Katrin Fischer <Katrin.Fischer.83@web.de>
Confirmed the problem and that the patch fixes it.
Good catch!
Signed-off-by: Mason James <mtj@kohaaloha.com>
(cherry picked from commit 94636a8a19)
Signed-off-by: Fridolin Somers <fridolin.somers@biblibre.com>
Test Plan ( using sample data included with Koha )
1) Catalog a record and item with the title "Oh no! or, (How my
science project destroyed the world) /"
2) Edit the DEFAULT template
a) Set layout type to Biblio
b) Set data fields to "title, author, isbn, issn, itemtype,
barcode, itemcallnumber"
c) Set font size to 10
3) Create a batch with just the one item you created
4) Export the PDF with the Avery template and the DEFAULT layout
5) Note the weirdness
6) Apply this patch
7) Re-export the PDF, note it's no longer weird ; )
Signed-off-by: Nick Clemens <nick@quecheelibrary.org>
Signed-off-by: Katrin Fischer <katrin.fischer.83@web.de>
Signed-off-by: Mason James <mtj@kohaaloha.com>
(cherry picked from commit b26f9140e9)
Signed-off-by: Fridolin Somers <fridolin.somers@biblibre.com>
An item can be marked as lost by longoverdue.pl, but left checked out to
the patron. In this case, the item will continue to accrue fines.
Test Plan:
1) Check out an item and back date it so it is overdue and should
generate fines.
2) Mark the item as lost by either using longoverdue.pl, or just
by setting itemlost to 1 by directly accessing the database
3) Run fines.pl
4) Note the overdue generated a fine
5) Repeat steps 1-2
6) Apply this patch
7) Run fines.pl
8) Note a fine was not generated
Signed-off-by: Jonathan Druart <jonathan.druart@biblibre.com>
Signed-off-by: Martin Renvoize <martin.renvoize@ptfs-europe.com>
Signed-off-by: Mason James <mtj@kohaaloha.com>
(cherry picked from commit e920b9a681)
Signed-off-by: Fridolin Somers <fridolin.somers@biblibre.com>
This patch changes the footer include, adding an alias for the jQueryUI
tooltip function to prevent conflict with Bootstrap's function of the
same name.
To test, you must have at least two libraries configured with "OPAC
info" for display in the OPAC.
Modify the holdings of a title so that there is at least one item which
has different holding and home branches matching your library configured
above.
View the detail page for that record. Hovering your cursor over the
library name in the "Location" column should display the branch
information you configured for that library in a tooltip.
Signed-off-by: Nick Clemens <nick@quecheelibrary.org>
Signed-off-by: Katrin Fischer <katrin.fischer.83@web.de>
Signed-off-by: Mason James <mtj@kohaaloha.com>
(cherry picked from commit 6d5e964168)
Signed-off-by: Fridolin Somers <fridolin.somers@biblibre.com>
On testing I've found that t/db_dependent/Suggestions.t leaves
cruft on the DB. Small followup for that.
Signed-off-by: Tomas Cohen Arazi <tomascohen@gmail.com>
Signed-off-by: Galen Charlton <gmc@esilibrary.com>
(cherry picked from commit 724a68540c)
Signed-off-by: Fridolin Somers <fridolin.somers@biblibre.com>
Conflicts:
t/db_dependent/Suggestions.t
The tabbed display in suggestions offers different options to organize
the tabs. The descriptions on the tabs and some of the search options were
not working correctly, displaying as "Unknown".
To test:
- Add several suggestions to your installation, make sure you have:
- suggestions from different users
- suggestions managed by different users
- suggestions with different statuses
- suggestions with different selected item types
Test all the 'organize by' options (except "Organize by: Library"
- see note below), make sure that the tabs and search options
have correct descriptions and do no longer display as "Unknown".
- Add 1 or 2 custom status to SUGGEST_STATUS authorized value.
- Verify display is still correct and your new status are displayed.
Note: "Organize by: Library" option is currently severely broken
(and not easily fixable, especially for 'IndependentBranches'
enabled). But this turns out to be a separate issue, with a different
underlaying causes, and it's outside the scope of this patch.
This should be dealt with later, in it's own bug report.
Signed-off-by: Christopher Brannon <cbrannon@cdalibrary.org>
Signed-off-by: Marcel de Rooy <m.de.rooy@rijksmuseum.nl>
Signed-off-by: Tomas Cohen Arazi <tomascohen@gmail.com>
Signed-off-by: Galen Charlton <gmc@esilibrary.com>
(cherry picked from commit 17c0c5f9a5)
Signed-off-by: Fridolin Somers <fridolin.somers@biblibre.com>
If multiple registrations are submitted, the first patron to register
will be used for the first patron to click the registration confirmation
link!
Test Plan:
1) Submit 2 new patron registrations
2) Use the confirm link from the 2nd registration
3) Note you end up registering as the first submitted registration
4) Apply the patch
5) Repeat steps 1 and 2
6) Note you are now confirmed correctly
Signed-off-by: Chris Cormack <chris@bigballofwax.co.nz>
Test plan appears to work fine, I have a feeling the sql could be
written better but can't come up with it on a Sunday morning
Signed-off-by: Katrin Fischer <Katrin.Fischer.83@web.de>
Works as described and fixes a critical bug.
Passes tests and QA script.
Signed-off-by: Tomas Cohen Arazi <tomascohen@gmail.com>
Signed-off-by: Galen Charlton <gmc@esilibrary.com>
(cherry picked from commit 37fae3408b)
Signed-off-by: Fridolin Somers <fridolin.somers@biblibre.com>
To Test:
- Use an installation a reasonable amount of authorities, so that you
can have a search result list with more than one page
- Activate OpacAuthorities
- Create an OPAC link like shown below, verify that an alert is shown
- Apply patch
- Refresh the page and no alert should appear
- Verify the paging still works correctly for 'numbers' and 'arrows'
URL: .../cgi-bin/koha/opac-authorities-home.pl?and_or=and&marclist=match&op=do_search&operator=contains&orderby=HeadingAsc2"><script>prompt(987898)</script>
Signed-off-by: Mason James <mtj@kohaaloha.com>
(cherry picked from commit 20dd347c48)
Signed-off-by: Fridolin Somers <fridolin.somers@biblibre.com>
To test
1/ Make sure you have some items in your database, that have values in items.issue
If nessecary do something like
UPDATE items SET issues = 10 WHERE itemnumber=somenumber
2/ Hit a url like http://localhost:8080/cgi-bin/koha/opac-topissues.pl?do_it=1&timeLimit=3%3Cscript%3Eprompt%28924513%29%3C/script%3E
3/ Notice you will get a prompt
4/ Apply patch
5/ Test again
Signed-off-by: Katrin Fischer <katrin.fischer@bsz-bw.de>
Signed-off-by: Martin Renvoize <martin.renvoize@ptfs-europe.com>
(cherry picked from commit 82e3bc7e21)
Signed-off-by: Fridolin Somers <fridolin.somers@biblibre.com>
A specially crafted url causes XSS in Koha
To test:
cgi-bin/koha/opac-shelves.pl?viewshelf=2%22%3E%3Cscript%3Eprompt(987898)%3C/script%3E
cgi-bin/koha/opac-downloadshelf.pl?shelfid=2%22%3Cscript%3Eprompt(1)%3C/script%3E&showprivateshelves
These should cause a popup without the patch. With the patch, no popup.
You may need to create these lists, the xss will not be triggered if the list doesn't exist or you don't
have permission to view them.
Signed-off-by: Chris <chris@bigballofwax.co.nz>
Fixes the two listed problems
Signed-off-by: Katrin Fischer <katrin.fischer@bsz-bw.de>
Confirmed patch fixes the problem.
Signed-off-by: Martin Renvoize <martin.renvoize@ptfs-europe.com>
Signed-off-by: Mason James <mtj@kohaaloha.com>
(cherry picked from commit 0718ced5e4)
Signed-off-by: Fridolin Somers <fridolin.somers@biblibre.com>
Conflicts:
koha-tmpl/opac-tmpl/bootstrap/en/modules/opac-shelves.tt
When using the backdating of returns feature, an item that is not
overdue is treated as being as many days overdue as it is *not* overdue.
This is due to the fact that _get_chargeable_units appears to return the
difference between the return date and the due date without
consideration the return date being earlier than the due date.
Test Plan:
1) Apply the unit test patch
2) prove t/db_dependent/Circulation.t
3) Note the failure
4) Apply the second patch
5) prove t/db_dependent/Circulation.t
6) Note there are no failures
Signed-off-by: Chris Cormack <chrisc@catalyst.net.nz>
Fixes some badly named variables also
Signed-off-by: Katrin Fischer <Katrin.Fischer.83@web.de>
In order to test this, you need to activate SpecifyReturnDate.
I confirmed the problem and verified that the bug fixes it
by running the tests, but also by testing in staff.
Signed-off-by: Tomas Cohen Arazi <tomascohen@gmail.com>
Signed-off-by: Galen Charlton <gmc@esilibrary.com>
(cherry picked from commit 462c33aeb6)
Signed-off-by: Fridolin Somers <fridolin.somers@biblibre.com>
Chris
Jonathan Druart
Fridolin Somers
Chris Cormack
Aleisha
Mason James
Martin Renvoize
Bernardo Gonzalez Kriegel
Jonathan Druart
Benjamin Rokseth
Matthias Meusburger
Kyle M Hall
Rafal Kopaczka
Owen Leonard
Tomas Cohen Arazi
Jacek Ablewicz
Liz