gitea
/
Koha-clms
1
0
Fork 0
Code Issues Pull Requests Packages Projects Releases Wiki Activity
Koha-clms/opac
History
David Cook 030d306944 Bug 28409: Comprehensively validate category in opac-shelves.pl 
Default to a category of 1 (ie Private). Only allow input of 1
or 2 (ie Public)

== Test plan ==
1. Go to http://localhost:8080/cgi-bin/koha/opac-shelves.pl?category=function(){window.location.href%20=%20%27https://git.koha-community.org/stats/koha-master/authors.html%27}()
2. Note that you are redirected to another website
3. Go to http://localhost:8080/cgi-bin/koha/opac-shelves.pl?op=add&shelfname=foo&category=9
4. Note that you can't see this list in the Lists (but it has been added to the database)
5. Apply the patch & restart services
6. Go to http://localhost:8080/cgi-bin/koha/opac-shelves.pl?category=function(){window.location.href%20=%20%27https://git.koha-community.org/stats/koha-master/authors.html%27}()
7. Note that you are not redirected to another website
8. Go to http://localhost:8080/cgi-bin/koha/opac-shelves.pl?op=add&shelfname=bar&category=9
9. Note that "bar" has been added as a Private list

Signed-off-by: Victor Grousset/tuxayo <victor@tuxayo.net>

Signed-off-by: Kyle M Hall <kyle@bywatersolutions.com>
Signed-off-by: Victor Grousset/tuxayo <victor@tuxayo.net>
(cherry picked from commit fa3adb5c05535f73666b06acab95518c9267abc1)
Signed-off-by: Wainui Witika-Park <wainuiwitikapark@catalyst.net.nz>
(cherry picked from commit fa3adb5c05535f73666b06acab95518c9267abc1)
 		2021-06-27 04:46:14 +00:00
..
clubs Bug 24663: [19.11.x] Remove authnotrequired if set to 0 2020-08-25 15:45:46 +12:00
errors Bug 19991: use Modern::Perl in OPAC perl scripts 2018-08-30 13:40:32 +00:00
external/overdrive
…
rss
…
sci Bug 24663: [19.11.x] Remove authnotrequired if set to 0 2020-08-25 15:45:46 +12:00
sco Bug 24663: [19.11.x] Remove authnotrequired if set to 0 2020-08-25 15:45:46 +12:00
svc Bug 24663: [19.11.x] Remove authnotrequired if set to 0 2020-08-25 15:45:46 +12:00
ilsdi.pl Bug 23156: Add pagination to checkouts in ILS-DI GetPatronInfo service 2019-06-25 17:16:26 +01:00
maintenance.pl
…
oai.pl
…
opac-ISBDdetail.pl Bug 23248: (QA follow-up) Consolidate 404s 2019-07-05 08:36:14 +01:00
opac-MARCdetail.pl Bug 5103: Refactor the code to avoid repetition 2020-04-03 17:26:54 +00:00
opac-account-pay-paypal-return.pl Bug 24663: [19.11.x] Remove authnotrequired if set to 0 2020-08-25 15:45:46 +12:00
opac-account-pay-return.pl
…
opac-account-pay.pl Bug 24663: [19.11.x] Remove authnotrequired if set to 0 2020-08-25 15:45:46 +12:00
opac-account.pl Bug 24663: [19.11.x] Remove authnotrequired if set to 0 2020-08-25 15:45:46 +12:00
opac-addbybiblionumber.pl Bug 24663: [19.11.x] Remove authnotrequired if set to 0 2020-08-25 15:45:46 +12:00
opac-alert-subscribe.pl Bug 22542: Force back button to display personal data 2019-05-02 13:43:48 +00:00
opac-article-request-cancel.pl Bug 24663: [19.11.x] Remove authnotrequired if set to 0 2020-08-25 15:45:46 +12:00
opac-authorities-home.pl Bug 24103: (follow-up) Dump query on opac authorities search 2020-04-01 15:29:24 +00:00
opac-authoritiesdetail.pl Bug 21871: (QA follow-up) C4::Biblio qw(GetMarcUrls) 2019-01-30 12:12:21 +00:00
opac-basket.pl Bug 23392: Don't display private notes in MARC21 2019-10-24 10:58:02 +01:00
opac-blocked.pl
…
opac-browser.pl Bug 19991: use Modern::Perl in OPAC perl scripts 2018-08-30 13:40:32 +00:00
opac-changelanguage.pl Bug 21299: (QA follow-up) Rename module and subroutine 2018-11-07 21:52:17 +00:00
opac-course-details.pl
…
opac-course-reserves.pl
…
opac-detail.pl Bug 25416: Let OPAC XSLTs know if the context is an anonymous session 2020-05-20 20:44:57 +00:00
opac-discharge.pl Bug 23723: using exit inside eval to stop sending output to browser doesn't work under plack 2019-10-07 12:21:30 +01:00
opac-downloadcart.pl Bug 17842: Simplify the code 2020-06-18 13:48:02 +12:00
opac-downloadshelf.pl Bug 14385: Squash of a lot of patches rebased 2018-11-02 10:33:12 +00:00
opac-export.pl Bug 22075: Fix encoding problem with RIS export in OPAC 2019-04-11 11:47:17 +00:00
opac-ics.pl Bug 24663: [19.11.x] Remove authnotrequired if set to 0 2020-08-25 15:45:46 +12:00
opac-idref.pl
…
opac-illrequests.pl Bug 24663: [19.11.x] Remove authnotrequired if set to 0 2020-08-25 15:45:46 +12:00
opac-image.pl Bug 19991: use Modern::Perl in OPAC perl scripts 2018-08-30 13:40:32 +00:00
opac-imageviewer.pl Bug 19991: use Modern::Perl in OPAC perl scripts 2018-08-30 13:40:32 +00:00
opac-issue-note.pl Bug 24663: [19.11.x] Remove authnotrequired if set to 0 2020-08-25 15:45:46 +12:00
opac-main.pl Bug 26070: Remove GoogleIndicTransliteration system preference 2020-08-07 14:20:49 +12:00
opac-memberentry.pl Bug 27626: Fix self registration if categorycode is hidden and PatronSelfRegistrationVerifyByEmail 2021-03-18 22:14:51 +01:00
opac-messaging.pl Bug 24663: [19.11.x] Remove authnotrequired if set to 0 2020-08-25 15:45:46 +12:00
opac-modrequest-suspend.pl Bug 24663: [19.11.x] Remove authnotrequired if set to 0 2020-08-25 15:45:46 +12:00
opac-modrequest.pl Bug 24663: [19.11.x] Remove authnotrequired if set to 0 2020-08-25 15:45:46 +12:00
opac-mymessages.pl Bug 24663: [19.11.x] Remove authnotrequired if set to 0 2020-08-25 15:45:46 +12:00
opac-news-rss.pl
…
opac-overdrive-search.pl Bug 19991: use Modern::Perl in OPAC perl scripts 2018-08-30 13:40:32 +00:00
opac-passwd.pl Bug 24663: [19.11.x] Remove authnotrequired if set to 0 2020-08-25 15:45:46 +12:00
opac-password-recovery.pl Bug 26904: OPAC password recovery allows regexp in email 2020-11-24 13:06:44 +13:00
opac-patron-consent.pl Bug 24663: [19.11.x] Remove authnotrequired if set to 0 2020-08-25 15:45:46 +12:00
opac-patron-image.pl Bug 19991: use Modern::Perl in OPAC perl scripts 2018-08-30 13:40:32 +00:00
opac-privacy.pl Bug 24663: [19.11.x] Remove authnotrequired if set to 0 2020-08-25 15:45:46 +12:00
opac-ratings-ajax.pl Bug 19991: use Modern::Perl in OPAC perl scripts 2018-08-30 13:40:32 +00:00
opac-ratings.pl Bug 19991: use Modern::Perl in OPAC perl scripts 2018-08-30 13:40:32 +00:00
opac-readingrecord.pl Bug 24663: [19.11.x] Remove authnotrequired if set to 0 2020-08-25 15:45:46 +12:00
opac-recordedbooks-search.pl Bug 17602: Fix few minor QA issues 2018-10-01 13:56:56 +00:00
opac-registration-verify.pl Bug 23253: Fix OpacNavRight for self reg by email 2019-08-15 09:19:28 +01:00
opac-renew.pl Bug 24663: [19.11.x] Remove authnotrequired if set to 0 2020-08-25 15:45:46 +12:00
opac-request-article.pl Bug 24663: [19.11.x] Remove authnotrequired if set to 0 2020-08-25 15:45:46 +12:00
opac-reserve.pl Bug 15448: Remove items fetch 2021-02-01 23:55:03 +01:00
opac-restrictedpage.pl
…
opac-retrieve-file.pl
…
opac-review.pl Bug 25340: Pass biblio object to OPAC comments template 2020-05-11 20:27:51 +00:00
opac-routing-lists.pl Bug 24663: [19.11.x] Remove authnotrequired if set to 0 2020-08-25 15:45:46 +12:00
opac-search-history.pl
…
opac-search.pl Bug 26070: Remove GoogleIndicTransliteration system preference 2020-08-07 14:20:49 +12:00
opac-sendbasket.pl Bug 24663: [19.11.x] Remove authnotrequired if set to 0 2020-08-25 15:45:46 +12:00
opac-sendshelf.pl Bug 24663: [19.11.x] Remove authnotrequired if set to 0 2020-08-25 15:45:46 +12:00
opac-serial-issues.pl Bug 23126: Display multi-line entries in subscrpitions correctly 2019-06-25 17:18:00 +01:00
opac-shareshelf.pl Bug 22542: Force back button to display personal data 2019-05-02 13:43:48 +00:00
opac-shelves.pl Bug 28409: Comprehensively validate category in opac-shelves.pl 2021-06-27 04:46:14 +00:00
opac-showmarc.pl Bug 25009: Avoid leakages in opac-showmarc.pl 2020-04-17 19:08:38 +00:00
opac-showreviews.pl Bug 22445: Custom cover images - opac reviews 2019-10-22 15:02:49 +01:00
opac-suggestions.pl Bug 24663: [19.11.x] Remove authnotrequired if set to 0 2020-08-25 15:45:46 +12:00
opac-tags.pl Bug 23276: Do not display tag if pref TagsEnabled is off 2020-06-22 15:04:45 +12:00
opac-tags_subject.pl Bug 19991: use Modern::Perl in OPAC perl scripts 2018-08-30 13:40:32 +00:00
opac-topissues.pl Bug 19991: use Modern::Perl in OPAC perl scripts 2018-08-30 13:40:32 +00:00
opac-user.pl Bug 26388: Do not show 'Renew all' or 'Renew selected' if no renewable items 2020-09-15 23:53:54 +12:00
tracklinks.pl Bug 23836: exit after output_error 2019-11-27 11:30:19 +00:00
unapi Bug 19991: use Modern::Perl in OPAC perl scripts 2018-08-30 13:40:32 +00:00