gitea
/
Koha-clms
1
0
Fork 0
Code Issues Pull Requests Packages Projects Releases Wiki Activity
Koha-clms/C4
History
Kyle M Hall 4c81c3262e Bug 33339: Prevent Formula Injection (CSV Injection) in CSV files 
The system is vulnerable to Formula Injection attacks as the data
stored within the database and exported as CSV/Excel is not being
sanitized or validated against implanted formula payloads

This patch modifies all uses of Text::CSV and derived classes to pass
the "formula" parameter with value of "empty" which replaces formulas
by empty string.

Test Plan:
1) Apply this patch
2) For guided_reports.pl, attempt to export CSV where you've set a column to a formula somehow
   ( such as "=1+3" )
3) Export that CSV file
4) Note the formula has not been exported
5) Repeat this plan for the remaining scripts that export CSV files
   where users can define the outputted data

Signed-off-by: Magnus Enger <magnus@libriotech.no>
Fixed two conflicts. I have tested that this works as advertised on:
- Reports (Download > Comma separated text (.csv)) [Text::CSV::Encoded]
- Circulation > Overdues > Download file of all overdues [Text::CSV_XS]
- misc/export_borrowers.pl [Text::CSV]
This covers all modules used, and both GUI and command line.

Signed-off-by: Chris Cormack <chris@bigballofwax.co.nz>

Signed-off-by: Marcel de Rooy <m.de.rooy@rijksmuseum.nl>
[EDIT] Change none to empty in the commit message ! None is the default,
doing nothing. Empty clears the formulas.
Signed-off-by: wainuiwitikapark <wainuiwitikapark@catalyst.net.nz>
(cherry picked from commit 96152682bf)
Signed-off-by: Lucas Gass <lucas@bywatersolutions.com>
 		2024-11-07 23:29:11 +00:00
..
AuthoritiesMarc Bug 17600: Standardize our EXPORT_OK 2021-07-16 08:58:47 +02:00
Barcodes Bug 30718: Use flatpickr's altInput 2022-08-19 08:26:31 -03:00
ClassSortRoutine Bug 17600: Standardize our EXPORT_OK 2021-07-16 08:58:47 +02:00
ClassSplitRoutine Bug 28572: Remove C4::Debug 2021-06-22 12:04:32 +02:00
Creators Bug 32222: Fix capitalization in various "id is invalid" 2023-02-08 16:27:45 +00:00
External Bug 17600: Standardize our EXPORT_OK 2021-07-16 08:58:47 +02:00
Form Bug 28572: Remove C4::Debug 2021-06-22 12:04:32 +02:00
Heading Bug 33277: Add comments and missing thesauri 2023-05-15 10:41:29 +00:00
ILSDI Bug 34893: ILS-DI can return the wrong patron for AuthenticatePatron 2024-01-26 09:56:12 +01:00
Installer Bug 30731: Remove Readonly::XS::MAGIC_COOKIE 2022-06-01 16:15:26 -03:00
Labels Bug 33339: Prevent Formula Injection (CSV Injection) in CSV files 2024-11-07 23:29:11 +00:00
Linker Bug 30280: Add support for subject headings from different thesaurus when using Elasticsearch 2022-10-03 10:00:04 -03:00
Members Bug 17600: Standardize our EXPORT_OK 2021-07-16 08:58:47 +02:00
OAI Bug 30308: Fix bulkmarcimport.pl broken by OAI-PMH:AutoUpdateSets(EmbedItemData) 2022-07-29 15:43:39 -03:00
Output Bug 17600: Standardize our EXPORT_OK 2021-07-16 08:58:47 +02:00
Patroncards Bug 34532: Silence warns in Patroncard.pm 2023-10-12 15:31:48 +00:00
Reports Bug 37508: (QA follow-up) Move sth error check up 2024-08-13 11:54:05 -03:00
SIP Bug 22873: Add comment to explain what disallow_overpayment is for 2023-10-17 17:23:40 +00:00
Search Bug 30718: Use flatpickr's altInput 2022-08-19 08:26:31 -03:00
Serials Bug 17600: Standardize our EXPORT_OK 2021-07-16 08:58:47 +02:00
Utils Bug 29648: (QA follow-up) Minor POD fix 2022-04-27 11:20:45 -10:00
Accounts.pm Bug 29184: Fix warn about undefined replacecost 2022-09-08 10:50:30 -07:00
Acquisition.pm Bug 33339: Prevent Formula Injection (CSV Injection) in CSV files 2024-11-07 23:29:11 +00:00
Auth.pm Bug 36575: (QA follow-up) Shibboleth POD and checkpw_internal call 2024-05-29 07:17:42 +00:00
Auth_cas_servers.yaml.sample Bug 17065 - Rename C4/Auth_cas_servers.yaml.orig 2016-08-08 13:16:36 +00:00
Auth_with_cas.pm Bug 34893: (QA follow-up) Tidy code for qa script 2024-01-26 09:57:14 +01:00
Auth_with_ldap.pm Bug 36575: (bug 34893 follow-up) Return patron from LDAP 2024-05-29 07:16:11 +00:00
Auth_with_shibboleth.pm Bug 36575: (QA follow-up) Shibboleth POD and checkpw_internal call 2024-05-29 07:17:42 +00:00
AuthoritiesMarc.pm Bug 32279: Add GetAuthorizedHeading method export C4::AuthoritiesMarc 2023-04-16 18:08:50 +01:00
BackgroundJob.pm Bug 17600: Standardize our EXPORT_OK 2021-07-16 08:58:47 +02:00
Barcodes.pm Bug 17600: Standardize our EXPORT_OK 2021-07-16 08:58:47 +02:00
Biblio.pm Bug 34943: (QA follow-up) Use `before_biblio_action` and an `action` param 2024-03-26 15:31:26 +01:00
Breeding.pm Bug 33404: Fix serverhost and init $page 2023-07-18 13:27:56 +00:00
Budgets.pm Bug 27550: "Duplicate budget" does not keep users associated with that budget 2022-09-22 08:18:33 -03:00
Calendar.pm Bug 32048: Added clear cache routine to delete_holiday_range_repeatable 2023-10-12 16:00:20 +00:00
Charset.pm Bug 18984: Remove NORMARC support 2021-10-07 15:36:40 +02:00
Circulation.pm Bug 30362: Fix GetSoonestRenewDate to really return soonest renew date 2023-08-31 13:34:28 +00:00
ClassSortRoutine.pm Bug 29951: Fix EXPORT for C4::ClassS*Routine modules 2022-07-08 15:29:56 -03:00
ClassSource.pm Bug 29951: Fix EXPORT for C4::ClassS*Routine modules 2022-07-08 15:29:56 -03:00
ClassSplitRoutine.pm Bug 29951: Fix EXPORT for C4::ClassS*Routine modules 2022-07-08 15:29:56 -03:00
Context.pm Bug 36149: Unset userenv from middleware 2024-04-24 10:48:12 +00:00
Contract.pm Bug 17600: Standardize our EXPORT_OK 2021-07-16 08:58:47 +02:00
CourseReserves.pm Bug 30016: Remove GetOpenIssue subroutine 2022-08-31 08:50:37 -03:00
Creators.pm Bug 17600: Standardize our EXPORT_OK 2021-07-16 08:58:47 +02:00
HTML5Media.pm Bug 18984: Remove NORMARC support 2021-10-07 15:36:40 +02:00
Heading.pm Bug 33557: Add LinkerConsiderThesaurus system preference 2023-05-16 07:32:11 +01:00
HoldsQueue.pm Bug 34678: Allow new entries to overwrite hold_fill_targets 2023-11-13 15:22:14 +00:00
ImportBatch.pm Bug 34822: Process real time holds along with indexing 2023-10-17 16:56:24 +00:00
ImportExportFramework.pm Bug 33339: Prevent Formula Injection (CSV Injection) in CSV files 2024-11-07 23:29:11 +00:00
InstallAuth.pm Bug 26019: Koha should set SameSite attribute on cookies 2022-04-13 15:55:38 +02:00
Installer.pm Bug 34174: (bug 33341 follow-up) Fix Ris export 2023-07-18 13:32:49 +00:00
ItemCirculationAlertPreference.pm Bug 29844: Fix ->search occurrences 2022-02-09 15:36:23 -10:00
Items.pm Bug 34656: Do not update real Time Holds Queue when moving from cart to shelf 2023-10-12 15:31:50 +00:00
Koha.pm Bug 33341: Address some perlcritic errors in 5.36 2023-04-11 10:54:27 +00:00
Labels.pm Bug 21395: Make perlcritic happy 2020-06-29 12:37:02 +02:00
Languages.pm Bug 32775: (QA follow-up) Fix tab and indenting issues 2023-06-05 16:51:50 +00:00
Letters.pm Bug 37198: Improve GetPreparedLetter documentation 2024-10-07 19:17:57 +02:00
Linker.pm Bug 17600: Standardize our EXPORT_OK 2021-07-16 08:58:47 +02:00
Log.pm Bug 31203: Add End action to cronjobs and log viewer 2022-10-05 16:12:55 -03:00
MarcModificationTemplates.pm Bug 17600: Standardize our EXPORT_OK 2021-07-16 08:58:47 +02:00
Matcher.pm Bug 26611: Make authority record matching use required match checks 2023-06-08 17:15:33 +00:00
Members.pm Bug 33937: Remove incorrect export in C4::Members 2023-07-12 09:36:02 +00:00
Message.pm Bug 18398: (follow-up) Update POD & Unit tests 2023-05-09 21:34:01 +01:00
Output.pm Bug 30524: Core CSRF checking code 2023-07-28 11:13:55 +00:00
Overdues.pm Bug 34279: Don't enforce overduefinescap unless it is greater than 0 2023-08-18 10:37:11 +00:00
Patroncards.pm Bug 17600: Standardize our EXPORT_OK 2021-07-16 08:58:47 +02:00
Record.pm Bug 33339: Prevent Formula Injection (CSV Injection) in CSV files 2024-11-07 23:29:11 +00:00
Reports.pm Bug 17600: Standardize our EXPORT_OK 2021-07-16 08:58:47 +02:00
Reserves.pm Bug 17798: Confirm hold when printing slip from another patron's account 2023-11-14 13:42:15 -01:00
Ris.pm Bug 34174: (bug 33341 follow-up) Fix Ris export 2023-07-18 13:32:49 +00:00
RotatingCollections.pm Bug 17600: Standardize our EXPORT_OK 2021-07-16 08:58:47 +02:00
SMS.pm Bug 27673: Replace YAML with YAML::XS 2021-02-16 14:54:50 +01:00
Scheduler.pm Bug 17600: Standardize our EXPORT_OK 2021-07-16 08:58:47 +02:00
Scrubber.pm Bug 19613: Fix test for 22.11 2024-04-24 10:40:09 +00:00
Search.pm Bug 13976: Sort popularity numerically in Zebra 2023-04-16 17:46:38 +01:00
Serials.pm Bug 23775: Claiming a serial issue doesn't create the next one 2023-07-18 13:00:04 +00:00
Service.pm Bug 17600: Standardize our EXPORT_OK 2021-07-16 08:58:47 +02:00
ShelfBrowser.pm Bug 29697: Replace GetMarcBiblio occurrences with $biblio->metadata->record 2022-07-22 15:24:11 -03:00
SocialData.pm Bug 17600: Standardize our EXPORT_OK 2021-07-16 08:58:47 +02:00
Stats.pm Bug 7021: Terminology - usercode -> categorycode 2022-09-22 09:31:28 -03:00
Suggestions.pm Bug 32027: Fix 'librarian interface' to use 'staff interface' in Pages/HTML customizations/News 2023-02-08 16:32:02 +00:00
TTParser.pm Bug 26673: Remove #!/usr/bin/env perl from .pm modules too 2020-10-26 00:14:42 +01:00
Tags.pm Bug 31517: (QA follow-up) Fix indentation 2022-11-04 19:30:56 -03:00
Templates.pm Bug 31390: Remove noisy warns in C4::Templates 2022-08-22 13:25:00 -03:00
TmplToken.pm Bug 16011: $VERSION - Remove the $VERSION init 2016-03-24 17:20:28 +00:00
TmplTokenType.pm Bug 17600: Standardize our EXPORT_OK 2021-07-16 08:58:47 +02:00
UsageStats.pm Bug 30025: Replace AllowManualAuthorityEditing with RequireChoosingExistingAuthority 2022-09-16 16:48:34 -03:00
XISBN.pm Bug 30813: (QA follow-up) Adjust three use statements 2022-06-08 11:40:32 -03:00
XSLT.pm Bug 28375: (follow-up) Use C4::Context->interface 2022-10-20 11:50:53 -03:00