gitea
/
Koha-clms
1
0
Fork 0
Code Issues Pull Requests Packages Projects Releases Wiki Activity
27,779 Commits 39 Branches 720 Tags 6 GiB
Perl 44.2%
JavaScript 41.1%
HTML 6%
XSLT 3.1%
Vue 1.9%
Other 3.2%
Go to file
Amit Gupta 505211d6ed Bug 19105 - XSS Stored in holidays.pl 
To Test
1. Hit the page /cgi-bin/koha/tools/holidays.pl
2. Select the date
3. Add a text in the field Title and Description that contains js
4. Save the page.
5. Notice js is execute
6. Apply patch and reload, the js is escaped

Fixed for all holidays

Signed-off-by: Katrin Fischer <katrin.fischer.83@web.de>

Signed-off-by: Marcel de Rooy <m.de.rooy@rijksmuseum.nl>
Signed-off-by: Mason James <mtj@kohaaloha.com>
 		2017-08-24 18:04:42 +12:00
C4 Bug 18605: Remove TRUNCATE from C4/HoldsQueue.pm 2017-08-23 22:14:11 +12:00
Koha Bug 18854: Protect few other occurrences of offset 2017-07-31 01:02:09 +12:00
OpenILS
…
acqui Revert "Bug 11122 - publisher code and publication year not fetched in acq orders" 2017-07-31 00:41:23 +12:00
admin Bug 18632: Remove 'CGI::param called in list context' warnings 2017-08-23 22:22:03 +12:00
api/v1 Bug 17042: Fix missing column in hold.json 2016-08-07 09:33:33 +02:00
authorities Bug 18019: [QA Follow-up] Also catch the delete from authorities detail 2017-04-24 11:09:53 +12:00
basket Bug 17109: [QA Follow-up] Die when wrong token 2017-05-03 14:25:24 +12:00
catalogue Bug 18854 - Protect from DOS 2017-07-31 01:02:09 +12:00
cataloguing Bug 17922: Use correct number of digits when replacing date placeholders 2017-02-23 03:08:41 +13:00
circ Bug 18966: Do not deal with duplicate issue_id on checkin 2017-07-25 11:51:43 +12:00
course_reserves Bug 16154: CGI->multi_param - Force scalar context 2016-04-26 23:16:43 +00:00
debian Bug 18554: Adjust a few typos including responsability 2017-07-31 01:02:09 +12:00
docs Bug 7143 : More new devs 2016-08-01 13:31:23 +02:00
errors
…
etc Bug 18669 - RewriteCond affecting wrong rule in koha-httpd.conf 2017-07-30 06:43:33 +12:00
installer Bug 18632: Remove 'CGI::param called in list context' warnings 2017-08-23 22:22:03 +12:00
koha-tmpl Bug 19105 - XSS Stored in holidays.pl 2017-08-24 18:04:42 +12:00
labels Bug 18535 - Clicking 'edit printer profile' in label creator causes software error 2017-05-24 14:26:23 +12:00
members Bug 19079 - XSS Flaws in Membership page 2017-08-24 17:58:27 +12:00
misc Add release notes for Koha 16.05.15 2017-07-31 04:10:22 +12:00
offline_circ
…
opac Bug 16711: OPAC Password recovery: Handling if multiple accounts have the same mail address 2017-08-23 21:28:10 +12:00
patron_lists Bug 16154: CGI->multi_param - Force scalar context 2016-04-26 23:16:43 +00:00
patroncards Bug 17181: Simplify code 2017-07-31 01:02:06 +12:00
plugins
…
reports Bug 13452: Fix for plack 2017-07-31 01:02:05 +12:00
reserve Bug 17028: Fix XSS in reserve/request.pl 2016-08-05 08:11:00 +02:00
reviews
…
rotating_collections
…
serials Bug 18536: [QA Follow-up] Tiny regex simplification 2017-05-24 15:44:13 +12:00
services
…
skel
…
sms
…
suggestion Bug 16154: CGI->multi_param - Declare a list 2016-04-26 23:16:42 +00:00
svc Bug 17375: Search by dateofbirth - handle invalid dates 2016-11-02 17:58:26 +00:00
t Bug 18976: [16.11] Add missing use statement 2017-08-23 22:22:38 +12:00
tags Bug 16154: CGI->multi_param - Assign a list 2016-04-26 23:16:43 +00:00
test
…
tmp/modified_authorities
…
tools Bug 18806: Fix batch revert 2017-07-31 01:02:06 +12:00
virtualshelves Bug 15451: (followup) fix filename extension for csv file 2017-04-30 23:20:01 +12:00
xt Bug 18746: Text_CSV_Various parse failures 2017-07-30 07:18:44 +12:00
.editorconfig
…
.htaccess
…
.mailmap Update mailmap - Jonathan Druart 2017-07-31 01:02:07 +12:00
INSTALL Bug 17626: Remove existing install instructions and link to the wiki pages instead 2016-12-12 14:54:13 +13:00
Koha.pm Increment version for 16.05.15 release 2017-07-31 01:04:17 +12:00
LICENSE
…
MANIFEST.SKIP
…
Makefile.PL Bug 18373: Re-add UpgradeBackup.pm 2017-04-30 23:19:56 +12:00
README
…
README.md Bug 15465 - Created README.md file for github 2017-07-30 06:31:29 +12:00
README.robots
…
about.pl Bug 18931 - Follow up - Typo fix in SQL statement 2017-07-26 15:14:53 +12:00
changelanguage.pl Bug 16776: Do not forget external language choice in language switcher 2016-08-23 11:51:49 +02:00
edithelp.pl Bug 16447: Remove occurrence of the borrow permission which does no longer exist 2016-05-05 21:28:14 +00:00
fix-perl-path.PL
…
help.pl Bug 16724: Fix link to the online documentation links 2016-08-01 09:22:30 +02:00
install-CPAN.pl
…
koha_perl_deps.pl Bug 17990: Refactor Perl module versions check 2017-01-30 00:56:20 +13:00
kohaversion.pl
…
mainpage.pl Bug 15548: Move new patron related code to Patron* 2016-03-03 14:38:26 -07:00
rewrite-config.PL Bug 16222: (QA followup) Add /api dir for the API 2016-04-20 21:18:36 +00:00

README.md

Koha is a free software integrated library system (ILS).

Koha is distributed under the GNU GPL version 3 or later.

Note: This is a synced mirror of the official Koha repo.

Note: Koha does not accept pull requests from git hosting sites.

Note: This project has its own bug tracker, to report a bug or submit a patch visit http://bugs.koha-community.org.

For guidelines on submitting patches for Koha please visit https://wiki.koha-community.org/wiki/SubmitingAPatch

The developers handbook can be found at https://wiki.koha-community.org/wiki/Developer_handbook

http://koha-community.org/

Koha Logo