gitea
/
Koha-clms
1
0
Fork 0
Code Issues Pull Requests Packages Projects Releases Wiki Activity
Koha-clms/admin
History
Kyle M Hall 96152682bf Bug 33339: Prevent Formula Injection (CSV Injection) in CSV files 
The system is vulnerable to Formula Injection attacks as the data
stored within the database and exported as CSV/Excel is not being
sanitized or validated against implanted formula payloads

This patch modifies all uses of Text::CSV and derived classes to pass
the "formula" parameter with value of "empty" which replaces formulas
by empty string.

Test Plan:
1) Apply this patch
2) For guided_reports.pl, attempt to export CSV where you've set a column to a formula somehow
   ( such as "=1+3" )
3) Export that CSV file
4) Note the formula has not been exported
5) Repeat this plan for the remaining scripts that export CSV files
   where users can define the outputted data

Signed-off-by: Magnus Enger <magnus@libriotech.no>
Fixed two conflicts. I have tested that this works as advertised on:
- Reports (Download > Comma separated text (.csv)) [Text::CSV::Encoded]
- Circulation > Overdues > Download file of all overdues [Text::CSV_XS]
- misc/export_borrowers.pl [Text::CSV]
This covers all modules used, and both GUI and command line.

Signed-off-by: Chris Cormack <chris@bigballofwax.co.nz>

Signed-off-by: Marcel de Rooy <m.de.rooy@rijksmuseum.nl>
[EDIT] Change none to empty in the commit message ! None is the default,
doing nothing. Empty clears the formulas.
Signed-off-by: wainuiwitikapark <wainuiwitikapark@catalyst.net.nz>
 		2024-11-05 22:46:12 +00:00
..
searchengine/elasticsearch Bug 33099: Add missing MARC21 Match authority mappings so "Search all headings" search works 2024-05-30 19:29:19 +00:00
additional-fields.pl Bug 35190: Adjust UI handling to avoid inserting an empty string 2023-11-09 20:53:00 -10:00
admin-home.pl Bug 31401: Update administration sidebar to match entries on administration start page 2022-09-07 13:55:32 -07:00
adveditorshortcuts.pl Bug 17600: Standardize our EXPORT_OK 2021-07-16 08:58:47 +02:00
aqbudgetperiods.pl Bug 30718: Use flatpickr's altInput 2022-08-19 08:26:31 -03:00
aqbudgets.pl Bug 17600: Standardize our EXPORT_OK 2021-07-16 08:58:47 +02:00
aqcontract.pl Bug 30718: Use flatpickr's altInput 2022-08-19 08:26:31 -03:00
aqplan.pl Bug 33339: Prevent Formula Injection (CSV Injection) in CSV files 2024-11-05 22:46:12 +00:00
audio_alerts.pl Bug 29844: Fix ->search occurrences 2022-02-09 15:36:23 -10:00
auth_subfields_structure.pl Bug 33341: Address some perlcritic errors in 5.36 2023-03-28 14:50:33 +02:00
auth_tag_structure.pl Bug 17600: Standardize our EXPORT_OK 2021-07-16 08:58:47 +02:00
authorised_values.pl Bug 31976: Incorrect default category selected by authorized values page 2022-10-27 09:46:58 -03:00
authtypes.pl Bug 17600: Standardize our EXPORT_OK 2021-07-16 08:58:47 +02:00
background_jobs.pl Bug 32922: Remove space in shebang 2023-02-20 09:44:06 -03:00
biblio_framework.pl Bug 31196: Remove 'default_value_for_mod_marc-' clear_from_cache calls 2022-10-25 11:16:57 -03:00
branch_transfer_limits.pl Bug 18247: Remove SQL queries from branch_transfer_limit.pl 2023-01-27 16:10:22 -03:00
branches.pl Bug 31785: (follow-up) Fix modify operation too 2022-10-14 15:47:57 -03:00
cash_registers.pl Bug 17600: Standardize our EXPORT_OK 2021-07-16 08:58:47 +02:00
categories.pl Bug 30718: Use flatpickr's altInput 2022-08-19 08:26:31 -03:00
check_budget_parent.pl Bug 17600: Standardize our EXPORT_OK 2021-07-16 08:58:47 +02:00
check_parent_total.pl Bug 17600: Standardize our EXPORT_OK 2021-07-16 08:58:47 +02:00
checkmarc.pl Bug 17600: Standardize our EXPORT_OK 2021-07-16 08:58:47 +02:00
cities.pl Bug 32922: Remove space in shebang 2023-02-20 09:44:06 -03:00
classsources.pl Bug 32922: Remove space in shebang 2023-02-20 09:44:06 -03:00
clone-rules.pl Bug 17600: Standardize our EXPORT_OK 2021-07-16 08:58:47 +02:00
columns_settings.pl Bug 35278: Fix warn from column_settings.pl 2023-11-10 21:26:52 -10:00
columns_settings.yml Bug 34938: Add collection column to hold ratio report 2023-11-10 15:10:46 -10:00
credit_types.pl Bug 32922: Remove space in shebang 2023-02-20 09:44:06 -03:00
curbside_pickup.pl Bug 32922: Remove space in shebang 2023-02-20 09:44:06 -03:00
currency.pl Bug 17600: Standardize our EXPORT_OK 2021-07-16 08:58:47 +02:00
debit_types.pl Bug 32450: Noissuescharge debit type exclusions 2023-05-17 10:25:06 -03:00
desks.pl Bug 32922: Remove space in shebang 2023-02-20 09:44:06 -03:00
didyoumean.pl Bug 17600: Standardize our EXPORT_OK 2021-07-16 08:58:47 +02:00
edi_accounts.pl Bug 34261: Add missing argument to show_account 2023-07-18 12:42:20 +01:00
edi_ean_accounts.pl Bug 17600: Standardize our EXPORT_OK 2021-07-16 08:58:47 +02:00
identity_providers.pl Bug 32139: Set "update on login" correctly when creating new IdP 2022-11-09 13:32:46 -03:00
import_export_authtype.pl Bug 13952: (follow-up) JS translatability, clean warns, other 2022-04-04 16:23:46 +02:00
import_export_framework.pl Bug 13952: (follow-up) Fixing export on default biblio framework 2022-04-04 16:23:45 +02:00
item_circulation_alerts.pl Bug 32122: Correct permissions check on item circulation alerts 2022-11-07 11:17:40 -03:00
items_search_field.pl Bug 17600: Standardize our EXPORT_OK 2021-07-16 08:58:47 +02:00
items_search_fields.pl Bug 17600: Standardize our EXPORT_OK 2021-07-16 08:58:47 +02:00
itemtypes.pl Bug 29859: Use iterator instead of as_list 2022-02-09 15:36:23 -10:00
koha2marclinks.pl Bug 31196: Remove 'default_value_for_mod_marc-' clear_from_cache calls 2022-10-25 11:16:57 -03:00
library_groups.pl Bug 32922: Remove space in shebang 2023-02-20 09:44:06 -03:00
localization.pl Bug 17600: Standardize our EXPORT_OK 2021-07-16 08:58:47 +02:00
marc-overlay-rules.pl Bug 33335: (QA follow-up) Polishing and comments 2023-05-12 17:50:09 -03:00
marc_subfields_structure.pl Bug 36395: Remove useless fetch in admin/marc_subfields_structure.pl 2024-05-28 17:17:44 +00:00
marctagstructure.pl Bug 31196: Remove 'default_value_for_mod_marc-' clear_from_cache calls 2022-10-25 11:16:57 -03:00
matching-rules.pl Bug 32922: Remove space in shebang 2023-02-20 09:44:06 -03:00
oai_set_mappings.pl Bug 32797: Check if fields have a value, not if true 2023-02-03 10:30:07 -03:00
oai_sets.pl Bug 17600: Standardize our EXPORT_OK 2021-07-16 08:58:47 +02:00
overdrive.pl Bug 29844: Fix ->search occurrences 2022-02-09 15:36:23 -10:00
patron-attr-types.pl Bug 32922: Remove space in shebang 2023-02-20 09:44:06 -03:00
preferences.pl Bug 34369: Require CSRF token for updating system preferences 2023-09-26 21:29:27 -10:00
restrictions.pl Bug 33578: Fix controller when editing a restriction type 2023-07-17 14:52:23 +01:00
search_filters.pl Bug 17170: Minor fixes 2022-10-21 11:15:21 -03:00
share_content.pl Bug 17600: Standardize our EXPORT_OK 2021-07-16 08:58:47 +02:00
smart-rules.pl Bug 32271: (QA follow-up) Convert all positive numbers to monetary float and convert all 0 equivilents to blank value 2023-08-07 20:05:46 -10:00
sms_providers.pl Bug 29859: Use iterator instead of as_list 2022-02-09 15:36:23 -10:00
smtp_servers.pl Bug 34616: Fix showing default server info on edit SMTP server page 2023-09-07 14:29:56 -10:00
sru_modmapping.pl Bug 17600: Standardize our EXPORT_OK 2021-07-16 08:58:47 +02:00
systempreferences.pl Bug 34369: Require CSRF token for updating system preferences 2023-09-26 21:29:27 -10:00
transfer_limits.pl Bug 17600: Standardize our EXPORT_OK 2021-07-16 08:58:47 +02:00
transport-cost-matrix.pl Bug 29844: Fix ->search occurrences 2022-02-09 15:36:23 -10:00
usage_statistics.pl Bug 17600: Standardize our EXPORT_OK 2021-07-16 08:58:47 +02:00
z3950servers.pl Bug 17600: Standardize our EXPORT_OK 2021-07-16 08:58:47 +02:00