gitea
/
Koha-clms
1
0
Fork 0
Code Issues Pull Requests Packages Projects Releases Wiki Activity
28,518 Commits 39 Branches 720 Tags 6 GiB
Perl 44.2%
JavaScript 41.1%
HTML 6%
XSLT 3.1%
Vue 1.9%
Other 3.2%
Go to file
Chris Cormack 210f7cdcf3 Bug 18854 - Protect from DOS 
There was a bug that meant a very large offset in the search params
will cause the search script to run forever (or long enough to crash
the machine)

To test

1/ Get ready with sudo top so you can kill the thread before it causes
your machine to OOM
2/ Hit a page like yourdomain.com/cgi-bin/koha/opac-search.pl?q=1&offset=-9999999999999999999
3/ Notice the process runs for a long time
4/ Kill the process
5/ Apply the patch
6/ Hit the page again, notice the it loads (offset is set to zero)
7/ Do the same to search in the staff client

Signed-off-by: Mirko Tietgen <mirko@abunchofthings.net>

Signed-off-by: Marcel de Rooy <m.de.rooy@rijksmuseum.nl>
Amended: changed -2 to 0 in opac-search.pl.
Signed-off-by: Julian Maurice <julian.maurice@biblibre.com>

Signed-off-by: Jonathan Druart <jonathan.druart@bugs.koha-community.org>
(cherry picked from commit 99b32717cd)
Signed-off-by: Fridolin Somers <fridolin.somers@biblibre.com>
(cherry picked from commit a64d14db20)
Signed-off-by: Katrin Fischer <katrin.fischer.83@web.de>
 		2017-07-19 23:17:49 +02:00
C4 Bug 14572 - insert_single_holiday() forces a value on an AUTO_INCREMENT column, during an INSERT 2017-07-16 13:48:51 +02:00
Koha Bug 18577: Add FIXME about the missing FK 2017-07-19 23:15:12 +02:00
OpenILS Bug 9239 QA follow-up: remove stray debug code 2013-03-16 21:32:34 -04:00
acqui Bug 18716: Remove CGI::param warns from updatesupplier.pl 2017-06-13 08:02:08 +02:00
admin Bug 18934: Preventing warns in Admin -> SMS providers 2017-07-19 23:16:06 +02:00
api/v1 Bug 17086: Reword borrowers to patrons in Swagger tags for holds 2016-11-22 11:31:08 +00:00
authorities Bug 18019: [QA Follow-up] Also catch the delete from authorities detail 2017-04-02 19:18:25 +02:00
basket Bug 18124: Change the calls to generate and check CSRF tokens 2017-04-02 18:03:53 +02:00
catalogue Bug 18854 - Protect from DOS 2017-07-19 23:17:49 +02:00
cataloguing Bug 17922: Use correct number of digits when replacing date placeholders 2017-02-07 22:18:39 +01:00
circ Bug 18435 - Language entered in Materials Specified does not display when items are checked out and checked in 2017-05-13 13:44:04 +02:00
course_reserves Bug 18264 - (QA Followup) Remove use of GetBiblioFromItemNumber Replace <blank> with (blank) 2017-06-05 15:42:45 +02:00
debian Bug 18554: Adjust a few typos including responsability 2017-07-16 14:47:24 +02:00
docs Bug 7143: [QA Follow-up] Handling tabs 2017-01-22 20:29:05 +01:00
errors Bug 15288: Error pages: Code duplication removal and better translatability 2016-01-27 05:57:34 +00:00
etc Bug 18669 - RewriteCond affecting wrong rule in koha-httpd.conf 2017-06-05 14:54:35 +02:00
installer Bug 18848: borrowers.lastseen comment typo 2017-07-16 13:59:09 +02:00
koha-tmpl Bug 18554: Adjust a few typos including responsability 2017-07-16 14:47:24 +02:00
labels Bug 18535 - Clicking 'edit printer profile' in label creator causes software error 2017-05-14 11:52:51 +02:00
members Bug 18858: Prevent warn when deleting a borrower debarment 2017-07-19 23:15:32 +02:00
misc Bug 17639 - Remove white filling inside of Koha logo 2017-07-19 23:16:59 +02:00
offline_circ Bug 15902 [QA Followup] - Use Koha::Patrons instead of Koha::Borrowers 2016-09-27 13:53:23 +00:00
opac Bug 18854 - Protect from DOS 2017-07-19 23:17:49 +02:00
patron_lists Bug 16154: CGI->multi_param - Force scalar context 2016-04-26 23:16:43 +00:00
patroncards Bug 17181: Simplify code 2017-06-28 07:49:04 +02:00
plugins Bug 16586: Koha Plugins: Limit results of GetPlugins by metadata 2016-09-09 12:13:39 +00:00
reports Bug 13452: Fix for plack 2017-06-27 23:26:08 +02:00
reserve Bug 15758: Koha::Libraries - Remove GetBranches 2016-09-08 14:36:03 +00:00
reviews Bug 15839: Koha::Reviews - Remove C4::Review residue 2016-09-09 10:31:00 +00:00
rotating_collections Bug 15758: Koha::Libraries - Remove GetBranches 2016-09-08 14:36:03 +00:00
serials Bug 18536: [QA Follow-up] Tiny regex simplification 2017-05-21 23:25:47 +02:00
services Bug 9978: Replace license header with the correct license (GPLv3+) 2015-04-20 09:59:38 -03:00
skel Bug 11078: Add locking to rebuild_zebra 2014-02-28 22:21:41 +00:00
sms Bug 15258: Fix Perl scripts declaring unused variables 2015-12-30 17:24:45 -07:00
suggestion Bug 17252 - Koha::AuthorisedValues - Remove GetAuthorisedValueByCode 2016-10-21 15:35:21 +00:00
svc Bug 17375: Search by dateofbirth - handle invalid dates 2016-10-27 13:18:32 +00:00
t Bug 18554: Adjust a few typos including responsability 2017-07-16 14:47:24 +02:00
tags Bug 16154: CGI->multi_param - Assign a list 2016-04-26 23:16:43 +00:00
test Bug 9819 - 'stopwords'-related code removed 2015-12-30 15:49:35 +00:00
tmp/modified_authorities
…
tools Bug 18577 - Importing a batch using a framework not fully set up causes and endless loop 2017-07-19 23:14:36 +02:00
virtualshelves Bug 15584 - Staff client list errors are incorrectly styled 2017-02-14 22:26:18 +01:00
xt Bug 18746: Add license and remove diag 2017-06-13 07:55:27 +02:00
.editorconfig Bug 12545: Add EditorConfig.org file to the source tree 2014-08-22 11:07:45 -03:00
.htaccess
…
.mailmap Update mailmap - Jonathan Druart 2017-06-29 22:39:52 +02:00
INSTALL Bug 17626: Remove existing install instructions and link to the wiki pages instead 2016-11-22 11:29:07 +00:00
Koha.pm Increment version for 16.11.09 release 2017-06-21 10:58:58 +00:00
LICENSE Bug 9440 - update Koha's LICENSE file from GPL2 to GPL3 2013-02-12 08:52:10 -05:00
MANIFEST.SKIP Bug 9546 : Updating make manifest tardist 2013-02-06 23:54:46 -05:00
Makefile.PL Bug 18373: Re-add UpgradeBackup.pm 2017-04-16 14:28:39 +02:00
README Bug 9440 - update Koha's LICENSE file from GPL2 to GPL3 2013-02-12 08:52:10 -05:00
README.md Bug 15465: Fix typo in bugs.k-c.org 2017-06-05 14:20:54 +02:00
README.robots Bug 6411 add another example to README.robots 2011-07-05 14:48:05 +12:00
about.pl Bug 7533: Add a warning to the about page if template_cache_dir is not set 2017-02-07 08:04:02 +01:00
changelanguage.pl Bug 16776: Do not forget external language choice in language switcher 2016-08-10 13:51:33 +00:00
edithelp.pl Bug 16447: Remove occurrence of the borrow permission which does no longer exist 2016-05-05 21:28:14 +00:00
fix-perl-path.PL Bug 9978: (followup) Replace license header with the correct license (GPLv3+) 2015-04-20 09:59:43 -03:00
help.pl Bug 16724: Fix link to the online documentation links 2016-06-24 12:00:42 +00:00
install-CPAN.pl Bug 9978: Replace license header with the correct license (GPLv3+) 2015-04-20 09:59:38 -03:00
koha_perl_deps.pl bug 10548: fix count of missing required dependencies by koha_perl_deps.pl 2013-07-11 14:03:32 +00:00
kohaversion.pl Bug 13758: Move the Koha version from kohaversion.pl 2015-05-07 11:39:04 -03:00
mainpage.pl Bug 14610 - Add and update scripts 2016-10-26 12:15:14 +00:00
rewrite-config.PL Bug 16222: (QA followup) Add /api dir for the API 2016-04-20 21:18:36 +00:00

README.md

Koha is a free software integrated library system (ILS).

Koha is distributed under the GNU GPL version 3 or later.

Note: This is a synced mirror of the official Koha repo.

Note: Koha does not accept pull requests from git hosting sites.

Note: This project has its own bug tracker, to report a bug or submit a patch visit http://bugs.koha-community.org.

For guidelines on submitting patches for Koha please visit https://wiki.koha-community.org/wiki/SubmitingAPatch

The developers handbook can be found at https://wiki.koha-community.org/wiki/Developer_handbook

http://koha-community.org/

Koha Logo