gitea
/
Koha-clms
1
0
Fork 0
Code Issues Pull Requests Packages Projects Releases Wiki Activity
30,475 Commits 39 Branches 720 Tags 6 GiB
Perl 44.2%
JavaScript 41.1%
HTML 6%
XSLT 3.1%
Vue 1.9%
Other 3.2%
Go to file
Andreas Roussos 095a92a94e Bug 20083 - Information disclosure when (mis)using the MARC Preview feature 
The MARC Preview feature in the Staff client (catalogue/showmarc.pl) does not
check whether a user is logged in or not. As a consequence, it can be used to
obtain information that would normally be available to logged-in users only.
For example, you can view any bibliographic record by passing a value to the
'id' argument, but you can also view records as they were imported (normally
done via the 'Staged MARC management' tool).

All three 17.11 installations currently listed at
https://wiki.koha-community.org/wiki/Koha_Demo_Installations
are affected by this issue, as demonstrated by the URLs below:

http://koha.adminkuhn.ch:8080/cgi-bin/koha/catalogue/showmarc.pl?importid=1&viewas=html
http://pro.demo1711-koha.test.biblibre.eu/cgi-bin/koha/catalogue/showmarc.pl?id=1000&viewas=html
https://staff-kohademo.equinoxinitiative.org/cgi-bin/koha/catalogue/showmarc.pl?id=1&viewas=html

It should be noted that this only applies to XSLT-enabled installations.

Signed-off-by: Mark Tompsett <mtompset@hotmail.com>

Signed-off-by: Marcel de Rooy <m.de.rooy@rijksmuseum.nl>

Signed-off-by: Nick Clemens <nick@bywatersolutions.com>
 		2018-03-26 15:19:26 +00:00
C4 Bug 20348: SIP2 patron identification fails to use userid 2018-03-23 10:48:03 +00:00
Koha Bug 20446 Revert to using syspref for item creation 2018-03-26 14:38:47 +00:00
OpenILS Bug 9239 QA follow-up: remove stray debug code 2013-03-16 21:32:34 -04:00
acqui Bug 20303: Do not explode when receiving an order if authorisedby not set 2018-03-23 10:43:31 +00:00
admin Bug 20201: Silence warnings triggered by admin/aqplan.pl 2018-03-23 10:28:29 +00:00
api/v1 Bug 7317: (QA followup) Make query parameters consistent with other endpoints 2017-11-09 11:42:16 -03:00
authorities Bug 19881: Remove authorities-list.pl 2018-01-26 07:01:37 -05:00
basket Bug 19040: Refactor GetMarcBiblio parameters 2017-08-25 10:23:42 -03:00
catalogue Bug 20083 - Information disclosure when (mis)using the MARC Preview feature 2018-03-26 15:19:26 +00:00
cataloguing Bug 19987: If no z39.50/SRU servers the button should not show 2018-01-23 02:01:26 +00:00
circ Bug 20003: (QA follow-up) use patron checkouts method instead of Koha::Checkouts 2018-02-02 14:43:58 +00:00
clubs Bug 18632: Remove 'CGI::param called in list context' warnings 2017-05-28 22:25:22 -04:00
course_reserves Bug 19230: Preventing warn when deleting course 2018-02-02 15:01:33 +00:00
debian Bug 17108 - Automatic debian/control updates (stable) 2018-02-02 15:12:45 +00:00
docs Bug 7143: Update about page for new dev - Victor Grousset 2017-12-14 14:01:58 +00:00
errors Bug 15288: Error pages: Code duplication removal and better translatability 2016-01-27 05:57:34 +00:00
etc Bug 7317: Interlibrary loans framework for Koha. 2017-11-09 11:42:12 -03:00
ill Bug 7317: Display all the libraries, not only one 2017-11-09 13:31:10 -03:00
installer Increment version for 17.11.04 release 2018-03-26 11:16:25 -04:00
koha-tmpl Bug 20148: Prevent adding same user multiple times to an order 2018-03-23 10:23:11 +00:00
labels Bug 19681: Correct result count formatting 2017-12-14 11:14:05 +00:00
members Bug 20367: Avoid resetting userid when BorrowerUnwantedField contains userid 2018-03-23 10:50:59 +00:00
misc Translation updates for Koha 17.11.04 2018-03-26 12:05:45 -03:00
offline_circ Bug 19771: Fix crashing in pending offline circulation actions list 2018-01-23 02:00:20 +00:00
opac Bug 20218: Fix matching of uri in tracklinks 2018-03-23 10:30:01 +00:00
patron_lists Bug 16154: CGI->multi_param - Force scalar context 2016-04-26 23:16:43 +00:00
patroncards Bug 18541: (QA follow-up) Fix wrong variable name ($layout_xml vs $print_layout_xml) 2017-09-19 11:47:32 -03:00
plugins Bug 19088: plugins-upload causes error log noise 2017-08-30 15:05:56 -03:00
reports Bug 19671: Map itemtypes to hash for correct display in issues_stats.pl 2018-02-22 00:59:34 +00:00
reserve Bug 19533: Hold pulldown for itemtype is empty if hold placement needs override 2017-12-14 11:12:11 +00:00
reviews Bug 19808: Handle deleted reviewers gracefully - reviews/reviewswaiting.pl 2017-12-21 16:07:12 +00:00
rotating_collections Bug 15758: Koha::Libraries - Remove GetBranches 2016-09-08 14:36:03 +00:00
serials Bug 19315: Prevent crash if no items and not library set for the subscription 2017-12-21 14:39:00 +00:00
services Bug 9978: Replace license header with the correct license (GPLv3+) 2015-04-20 09:59:38 -03:00
skel Bug 11078: Add locking to rebuild_zebra 2014-02-28 22:21:41 +00:00
suggestion Bug 18399: Add reasons in edit suggestion page 2017-10-11 13:05:39 -03:00
svc Bug 20088: Fix uninitialized warning from svc/holds 2018-02-02 15:09:40 +00:00
t Bug 20466: Fix fixture syntax in t/Prices.t 2018-03-26 12:37:10 +00:00
tags Bug 19040: Refactor GetMarcBiblio parameters 2017-08-25 10:23:42 -03:00
test Bug 9819 - 'stopwords'-related code removed 2015-12-30 15:49:35 +00:00
tmp/modified_authorities
…
tools Bug 20098: Inventory tool: CVS export: fix itemlost column 2018-02-16 01:10:22 +00:00
virtualshelves Bug 17214: Add records to lists by biblionumber 2017-10-27 14:10:26 -03:00
xt Bug 19262: Remove xt/author/pod_spell.t 2017-09-12 11:30:07 -03:00
.editorconfig Bug 12545: Add EditorConfig.org file to the source tree 2014-08-22 11:07:45 -03:00
.htaccess
…
.mailmap Update mailmap - Jonathan Druart 2017-06-21 12:42:19 -03:00
INSTALL Bug 17626: Remove existing install instructions and link to the wiki pages instead 2016-11-22 11:29:07 +00:00
Koha.pm Increment version for 17.11.04 release 2018-03-26 11:16:25 -04:00
LICENSE Bug 9440 - update Koha's LICENSE file from GPL2 to GPL3 2013-02-12 08:52:10 -05:00
MANIFEST.SKIP Bug 9546 : Updating make manifest tardist 2013-02-06 23:54:46 -05:00
Makefile.PL Bug 7317: Interlibrary loans framework for Koha. 2017-11-09 11:42:12 -03:00
README Bug 9440 - update Koha's LICENSE file from GPL2 to GPL3 2013-02-12 08:52:10 -05:00
README.md Bug 15465: Fix typo in bugs.k-c.org 2017-05-26 11:45:31 -03:00
README.robots
…
about.pl Bug 7317: Add partner_code checks to abot page 2017-11-09 11:42:14 -03:00
changelanguage.pl Bug 16776: Do not forget external language choice in language switcher 2016-08-10 13:51:33 +00:00
edithelp.pl Bug 16447: Remove occurrence of the borrow permission which does no longer exist 2016-05-05 21:28:14 +00:00
fix-perl-path.PL Bug 9978: (followup) Replace license header with the correct license (GPLv3+) 2015-04-20 09:59:43 -03:00
help.pl Bug 16724: Fix link to the online documentation links 2016-06-24 12:00:42 +00:00
install-CPAN.pl Bug 9978: Replace license header with the correct license (GPLv3+) 2015-04-20 09:59:38 -03:00
koha_perl_deps.pl Bug 17990: Refactor Perl module versions check 2017-02-17 12:13:44 +00:00
kohaversion.pl Bug 13758: Move the Koha version from kohaversion.pl 2015-05-07 11:39:04 -03:00
mainpage.pl Bug 18432 : Follow up - Updating to use they/them 2017-04-21 10:56:43 -04:00
rewrite-config.PL Bug 15427 : Enable TLS support for MySQL 2017-03-03 18:33:07 +00:00

README.md

Koha is a free software integrated library system (ILS).

Koha is distributed under the GNU GPL version 3 or later.

Note: This is a synced mirror of the official Koha repo.

Note: Koha does not accept pull requests from git hosting sites.

Note: This project has its own bug tracker, to report a bug or submit a patch visit http://bugs.koha-community.org.

For guidelines on submitting patches for Koha please visit https://wiki.koha-community.org/wiki/SubmitingAPatch

The developers handbook can be found at https://wiki.koha-community.org/wiki/Developer_handbook

http://koha-community.org/

Koha Logo