gitea
/
Koha-clms
1
0
Fork 0
Code Issues Pull Requests Packages Projects Releases Wiki Activity
52,808 Commits 39 Branches 720 Tags 6 GiB
Perl 44.2%
JavaScript 41.1%
HTML 6%
XSLT 3.1%
Vue 1.9%
Other 3.2%
Go to file
Aleisha Amohia 38364e9a17
Bug 37508: Throw error if password column is detected in SQL report 
This enhancement prevents SQL queries from being run if they would return a password field from the database table.

To test:

1. Run tests and notice they fail t/db_dependent/Reports/Guided.t

2. Apply patch and restart services

3. Create a public report with an SQL report which would access a password column in a database table
4. Try to run the report. Notice you are met with an error and the results are not shown.
5. Access the JSON URL, you should not get the results and should be shown an error
6. Confirm tests pass t/db_dependent/Reports/Guided.t

Sponsored-by: Reserve Bank of New Zealand
Signed-off-by: David Cook <dcook@prosentient.com.au>

Signed-off-by: Marcel de Rooy <m.de.rooy@rijksmuseum.nl>
Signed-off-by: Tomas Cohen Arazi <tomascohen@theke.io>
 		2024-08-13 02:03:22 -03:00
C4 Bug 37508: Throw error if password column is detected in SQL report 2024-08-13 02:03:22 -03:00
Koha Bug 37018: Add 400 response definition to all routes 2024-07-25 09:58:11 +02:00
acqui Bug 10758: Show title of deleted biblio on basket page 2024-08-02 14:37:14 +02:00
admin Bug 37163: Fix the redirect after deleting a tag from an authority framework to load the right page 2024-07-19 11:42:58 +02:00
api Bug 36480: (follow-up) Add missing library_id parameter 2024-08-02 14:41:29 +02:00
authorities Bug 25387: (QA follow-up) Tidy 2024-07-19 11:30:08 +02:00
basket Bug 34731: Don't call SendQueuedMessages if message_id is bad 2023-09-12 09:44:59 -03:00
bin
…
bookings Bug 35574: Bookings tab from biblio details should only require manage_bookings permission 2024-01-03 15:48:28 +01:00
catalogue Bug 35294: Fix typos in catalogue code comments 2024-07-19 10:30:46 +02:00
cataloguing Bug 36792: Limit POSIX imports 2024-05-30 10:02:31 +02:00
circ Bug 37210: Properly escape SQL query parameters by using bind values 2024-07-25 09:58:11 +02:00
clubs Bug 25079: Show club enrollment question answers in staff client 2023-06-23 11:00:54 -03:00
course_reserves Bug 20256: Use new methods 2023-02-02 11:59:26 -03:00
debian Bug 33563: Add comments for Elasticsearch security config 2024-07-19 11:27:56 +02:00
docs Bug 37003: (follow-up) Amend 22.11 RMaint 2024-07-19 11:10:06 +02:00
erm Bug 32922: Remove space in shebang 2023-02-20 09:44:06 -03:00
errors
…
etc Bug 33563: Add comments for Elasticsearch security config 2024-07-19 11:27:56 +02:00
ill Bug 35930: Add guards for plugins_enabled 2024-02-15 10:51:57 +01:00
installer Increment version for 23.11.07 release 2024-07-25 10:05:01 +02:00
koha-tmpl Bug 37508: Throw error if password column is detected in SQL report 2024-08-13 02:03:22 -03:00
labels Bug 36511: Some scripts missing a dependency following Bug 24879 2024-04-11 15:57:36 +02:00
lib/CGI/Session/Serialize
…
members Bug 33849: Do not reset new patrons home library when error occurs 2024-05-29 13:57:54 +02:00
misc Update release notes for 23.11.07 release 2024-07-25 10:41:41 +02:00
offline_circ Bug 34529: Offline circulation should be able to accept userid as well as cardnumber 2023-11-06 11:34:44 -03:00
opac Bug 37370: Return 400 if OpacExportOptions does not contain the passed format 2024-08-13 02:03:21 -03:00
patron_lists Bug 34977: (QA follow-up) Tidy code 2023-11-08 11:41:33 -03:00
patroncards
…
plugins Bug 35536: Refine verbose handling in some Koha::Plugins calls 2024-07-22 14:00:11 +02:00
pos Bug 34731: Don't call SendQueuedMessages if message_id is bad 2023-09-12 09:44:59 -03:00
preservation Bug 34030: Add a "print slips" action links to print in batch 2023-10-23 11:33:55 -03:00
recalls Bug 34013: Recalls awaiting pickup doesn't show count on each tab 2023-06-23 10:01:04 -03:00
reports Bug 36380: Add filter value on patron statistics report summary 2024-05-29 10:49:32 +02:00
reserve Bug 35559: Revert changes from bug 34634 2024-05-24 14:43:23 +02:00
reviews
…
rotating_collections
…
serials Bug 37247: Fix display of "closed" 2024-07-25 09:58:11 +02:00
services
…
skel
…
suggestion Bug 34963: Restore the ability to blank fields when editing a suggestion 2024-05-23 15:50:54 +02:00
svc Bug 37508: Throw error if password column is detected in SQL report 2024-08-13 02:03:22 -03:00
t Bug 37508: Throw error if password column is detected in SQL report 2024-08-13 02:03:22 -03:00
tags
…
tools Bug 37488: Validate paths in datalink.txt/idlink.txt files 2024-08-13 02:03:20 -03:00
virtualshelves Bug 36858: Remove warnings 2024-05-29 16:12:13 +02:00
xt Bug 37018: Add 400 response definition to all routes 2024-07-25 09:58:11 +02:00
.editorconfig
…
.eslintrc.json
…
.gitignore Bug 35174: Add misc/translator/po to .gitignore 2023-11-16 08:56:36 +01:00
.htaccess
…
.mailmap Bug 36943: (follow-up) 24.05.00 - Update .mailmap 2024-05-30 10:03:25 +02:00
.perlcriticrc
…
.perltidyrc Bug 30002: Adjust perltidy 2023-06-08 08:32:42 -03:00
.proverc.dist
…
.stylelintrc.json
…
INSTALL
…
Koha.pm Increment version for 23.11.07 release 2024-07-25 10:05:01 +02:00
LICENSE
…
MANIFEST.SKIP
…
Makefile.PL Bug 35759: (bug 30708 follow-up) Generated dist file not installed for preservation module 2024-01-17 10:06:28 +01:00
README
…
README.md
…
README.robots
…
about.pl Bug 36134: Read complete Elasticsearch configuration in about.pl 2024-03-11 11:20:07 +01:00
app.psgi Bug 36149: Add userenv middleware to app.psgi 2024-04-24 07:36:20 +02:00
build-resources.PL Bug 32609: Use the current yarn.lock to generate node_modules 2023-02-10 11:07:57 -03:00
changelanguage.pl
…
cpanfile Bug 34064: Add SQL::Translator dependency to cpanfile 2023-10-10 10:54:04 -03:00
cypress.config.ts Bug 34319: Upgrade cypress 9.7.0 to 12.17.2 2023-09-05 11:52:25 -03:00
fix-perl-path.PL
…
gulpfile.js Bug 36730: (Bug 35428 follow-up) po files (sometimes) fail to update 2024-05-24 16:12:44 +02:00
help.pl
…
kohaversion.pl
…
mainpage.pl Bug 30493: (QA follow-up) Fix for the only_my_library case as well 2024-07-19 11:05:22 +02:00
package.json Bug 34319: Upgrade cypress 9.7.0 to 12.17.2 2023-09-05 11:52:25 -03:00
rewrite-config.PL
…
tsconfig.json Bug 32030: Move cypress to t - fix build_js/watch_js 2022-11-08 09:44:52 -03:00
webpack.config.js Bug 30708: Vue app 2023-10-18 15:41:40 -03:00
yarn.lock Bug 34319: Update yarn.lock 2023-09-05 11:52:25 -03:00

README.md

Koha is a free software integrated library system (ILS).

Koha is distributed under the GNU GPL version 3 or later.

Note: Koha does not accept pull requests from git hosting sites.

Note: This project has its own bug tracker, to report a bug or submit a patch visit http://bugs.koha-community.org.

For guidelines on submitting patches for Koha please visit https://wiki.koha-community.org/wiki/SubmitingAPatch

The developers handbook can be found at https://wiki.koha-community.org/wiki/Developer_handbook

http://koha-community.org/

Koha Logo