gitea
/
Koha-clms
1
0
Fork 0
Code Issues Pull Requests Packages Projects Releases Wiki Activity
37,186 Commits 39 Branches 720 Tags 6 GiB
Perl 44.2%
JavaScript 41.1%
HTML 6%
XSLT 3.1%
Vue 1.9%
Other 3.2%
Go to file
David Cook 322fbf151b
Bug 23290: XSLT system preferences allow administrators to exploit XML and XSLT vulnerabilities 
The problem is that administrators can provide XSLTs that
can read from the server and network and write to the server. The

This patch prevents the Koha::XSLT_Handler from running
XSLT stylesheets that call actions such as read_file, write_file,
read_net, and write_net as documented at
https://metacpan.org/pod/XML::LibXSLT#XML::LibXSLT::Security

(Previous tests suggested issues with XML external entities
causing read file like vulnerabilities but these were not
reproducible)

Signed-off-by: Marcel de Rooy <m.de.rooy@rijksmuseum.nl>
Signed-off-by: Martin Renvoize <martin.renvoize@ptfs-europe.com>
 		2020-02-25 13:40:48 +00:00
C4 Bug 24545: Fix license statements 2020-02-24 13:31:26 +00:00
Koha Bug 23290: XSLT system preferences allow administrators to exploit XML and XSLT vulnerabilities 2020-02-25 13:40:48 +00:00
OpenILS
…
acqui Bug 24545: Fix license statements 2020-02-24 13:31:26 +00:00
admin Bug 24545: Fix license statements 2020-02-24 13:31:26 +00:00
api/v1 Bug 24545: Fix license statements 2020-02-24 13:31:26 +00:00
authorities Bug 24545: Fix license statements 2020-02-24 13:31:26 +00:00
basket Bug 11529: Add templates for biblio title display. Unify display. 2019-08-05 15:03:19 +01:00
catalogue Bug 24545: Fix newly added files 2020-02-24 13:31:27 +00:00
cataloguing Bug 24545: Fix license statements 2020-02-24 13:31:26 +00:00
circ Bug 24545: Fix license statements 2020-02-24 13:31:26 +00:00
clubs Bug 23084: Replace grep {^$var$} with grep {$_ eq $var} 2020-02-17 10:44:45 +00:00
course_reserves Bug 21003: Removed warning and changed wording on add_items-step2.tt 2019-03-23 09:51:36 +00:00
debian Bug 24545: Fix license statements 2020-02-24 13:31:26 +00:00
docs Koha 19.12 - Dobbie is a free elf... 2019-12-02 17:13:15 +00:00
errors Bug 24545: Fix license statements 2020-02-24 13:31:26 +00:00
etc Bug 22220: Fix bib Apache rewrite rule for intranet 2020-01-20 14:03:49 +00:00
ill Bug 24545: Fix license statements 2020-02-24 13:31:26 +00:00
installer Bug 24545: Fix license statements 2020-02-24 13:31:26 +00:00
koha-tmpl Bug 23777: (follow-up) Use To.json in results.tt 2020-02-25 11:07:08 +00:00
labels Bug 24545: Fix license statements 2020-02-24 13:31:26 +00:00
members Bug 24545: Fix license statements 2020-02-24 13:31:26 +00:00
misc Bug 24545: Fix license statements 2020-02-24 13:31:26 +00:00
offline_circ Bug 24545: Fix license statements 2020-02-24 13:31:26 +00:00
opac Bug 24545: Fix newly added files 2020-02-24 13:31:27 +00:00
patron_lists Bug 19524: Use existing logged_in_user variable 2018-07-18 16:49:30 +00:00
patroncards Bug 24545: Fix license statements 2020-02-24 13:31:26 +00:00
plugins Bug 21073: (QA follow-up) Avoid unnecessary unless/else construct 2019-06-18 17:30:44 +01:00
pos Bug 24477: Require `takepayment` permission in pos/pay.pl 2020-01-23 08:51:36 +00:00
reports Bug 24545: Fix license statements 2020-02-24 13:31:26 +00:00
reserve Bug 14711: Change prototype for AddReserve - pass a hashref 2020-02-11 14:32:47 +00:00
reviews Bug 18789: Send Koha::Patron object to the templates 2018-02-16 13:03:58 -03:00
rotating_collections Bug 21500: Remove warnings in rotating collections 2018-10-09 15:02:45 +00:00
serials Bug 14711: Change prototype for AddReserve - pass a hashref 2020-02-11 14:32:47 +00:00
services Bug 20019: use Modern::Perl in misc perl scripts 2018-02-05 09:47:08 -03:00
skel
…
suggestion Bug 23594: Restore previous view after delete or update itemtype 2020-01-30 10:56:57 +00:00
svc Bug 24545: Fix license statements 2020-02-24 13:31:26 +00:00
t Bug 24545: Fix newly added files 2020-02-24 13:31:27 +00:00
tags Bug 11529: Add templates for biblio title display. Unify display. 2019-08-05 15:03:19 +01:00
tmp/modified_authorities
…
tools Bug 24545: Fix license statements 2020-02-24 13:31:26 +00:00
virtualshelves Bug 23084: Replace grep {^$var$} with grep {$_ eq $var} 2020-02-17 10:44:45 +00:00
xt Bug 24545: Fix newly added files 2020-02-24 13:31:27 +00:00
.editorconfig
…
.eslintrc.json Bug 23834: Add default ESLint configuration 2019-11-03 08:02:39 +00:00
.gitignore Bug 20427: Convert OPAC LESS to SCSS 2018-08-09 15:17:07 +00:00
.htaccess
…
.mailmap
…
.scss-lint.yml Bug 21237: Clean up staff client SCSS 2018-08-24 16:23:25 +00:00
INSTALL
…
Koha.pm Bug 22880: DBRev 19.12.00.030 2020-02-24 13:31:26 +00:00
LICENSE
…
MANIFEST.SKIP
…
Makefile.PL Bug 19735: Move Perl deps definitions into a cpanfile 2020-02-12 16:33:02 +00:00
README
…
README.md
…
README.robots
…
about.pl Bug 19735: Add support for max_ver 2020-02-12 16:33:02 +00:00
changelanguage.pl Bug 21299: (QA follow-up) Rename module and subroutine 2018-11-07 21:52:17 +00:00
cpanfile Bug 24693: Move GD from recommends to requires in cpanfile 2020-02-24 13:18:08 +00:00
fix-perl-path.PL
…
gulpfile.js Bug 21751: Replace fixFloat with HC-sticky to fix Chrome display 2019-02-04 14:13:35 +00:00
help.pl Bug 19817: Use the language from the interface if valid 2018-09-06 17:32:28 +00:00
koha_perl_deps.pl Bug 24545: Fix license statements 2020-02-24 13:31:26 +00:00
kohaversion.pl
…
mainpage.pl Bug 21907: Fix article requests count for non-superlibrarians 2019-02-04 14:50:40 +00:00
package.json Bug 23025: security vulnerability detected in fstream < 1.0.12 defined in yarn.lock 2019-11-27 11:30:17 +00:00
rewrite-config.PL Bug 17851: Add elasticsearch config to koha-conf.xml 2019-10-07 14:09:10 +01:00
yarn.lock Bug 23025: Update yarn.lock 2019-11-27 11:30:17 +00:00

README.md

Koha is a free software integrated library system (ILS).

Koha is distributed under the GNU GPL version 3 or later.

Note: This is a synced mirror of the official Koha repo.

Note: Koha does not accept pull requests from git hosting sites.

Note: This project has its own bug tracker, to report a bug or submit a patch visit http://bugs.koha-community.org.

For guidelines on submitting patches for Koha please visit https://wiki.koha-community.org/wiki/SubmitingAPatch

The developers handbook can be found at https://wiki.koha-community.org/wiki/Developer_handbook

http://koha-community.org/

Koha Logo