gitea
/
Koha-clms
1
0
Fork 0
Code Issues Pull Requests Packages Projects Releases Wiki Activity
34,357 Commits 39 Branches 720 Tags 6 GiB
Perl 44.2%
JavaScript 41.1%
HTML 6%
XSLT 3.1%
Vue 1.9%
Other 3.2%
Go to file
Jonathan Druart 54dfd0a0cd Bug 24878: Add authentication checks to the calendar tool 
There is a security hole in 2 scripts that are used by the UI to edit
holidays.

To test:
1) Go to Tools -> Calendar, for Centerville
   Check no holiday for 30/4/2020
2) To add a new holiday without login execute
   a curl command with necessary parameters
3) Reload page from 1), verify the new holiday
   edit and delete the holiday
4) Apply the patch
5) Do 2) again, this time you get a lengthy output,
   with the magic words:

   <title>Koha &rsaquo;
       Log in to Koha
   </title>

Signed-off-by: Bernardo Gonzalez Kriegel <bgkriegel@gmail.com>
Only tested newHoliday but the fix is the same.
No errors

Signed-off-by: Nick Clemens <nick@bywatersolutions.com>

Signed-off-by: Joy Nelson <joy@bywatersolutions.com>
(cherry picked from commit 656e7814b3)

Signed-off-by: Hayley Mapley <hayleymapley@catalyst.net.nz>
 		2020-03-24 14:14:17 +13:00
C4 Bug 23064: Use Koha::Subscription in ModSubscription 2020-02-24 10:37:10 +13:00
Koha Bug 23290: [RMaint version] Mitigate XML/XSLT vulnerabilities 2020-02-24 09:10:06 +13:00
OpenILS
…
acqui Bug 24389: Better error handle when claiming late orders 2020-03-18 10:32:29 +13:00
admin Bug 23089: Fix sorting on sum and regular fields 2019-12-18 14:22:38 +13:00
api/v1 Bug 23607: Make /patrons/:patron_id/account staff only 2019-10-17 01:15:27 +00:00
authorities Bug 19994: Used Modern::Perl in Authorities perl scripts 2019-02-01 15:06:13 +00:00
basket Bug 21993: Display a user-friendly message when the CSRF token is wrong 2019-01-31 17:07:03 +00:00
catalogue Bug 23970: Make search with "Publication date" field work at any position 2020-01-13 12:47:55 +13:00
cataloguing Bug 22830: correct for loop in value_builder/unimarc_field_4XX.pl value_builder 2019-09-17 20:31:18 +00:00
circ Bug 23273: Remove debug statement 2019-09-21 12:12:19 +00:00
clubs Bug 18632: Remove 'CGI::param called in list context' warnings 2017-05-28 22:25:22 -04:00
course_reserves Bug 21003: Removed warning and changed wording on add_items-step2.tt 2019-04-15 11:54:24 +01:00
debian Bug 23345: Rename include-indexes to exclude-indexes in koha-dump 2019-08-31 04:42:26 +00:00
docs Bug 22128: Add Rudolf Byker to contributors 2019-07-25 21:15:16 +00:00
errors Bug 19998: use Modern::Perl in error perl scripts 2018-02-05 09:45:48 -03:00
etc Bug 23053: Add phrase index to authority Local-Number 2019-06-19 19:16:10 +00:00
ill Bug 20996: Remove prefix use of borrower category 2018-11-02 10:33:02 +00:00
installer Increment version for 18.11.15 release 2020-03-24 09:02:19 +13:00
koha-tmpl Bug 21296: [18.11.x] Fix wrong resolution conflict 2020-03-17 08:40:05 +13:00
labels Bug 21719: Fix typos 2018-11-08 02:18:46 +00:00
members Bug 22868: Move suggestions_manage subperm out of acquisition perm 2020-02-18 10:03:31 +13:00
misc Update release notes for 18.11.15 release 2020-03-24 09:39:32 +13:00
offline_circ Bug 13779: (QA follow-up) Correct checkauth call in offline_circ/download.pl 2018-09-14 17:27:29 +00:00
opac Bug 23836: exit after output_error 2019-11-22 17:34:56 +00:00
patron_lists Bug 19524: Use existing logged_in_user variable 2018-07-18 16:49:30 +00:00
patroncards Bug 21719: Fix typos 2018-11-08 02:18:46 +00:00
plugins Bug 20011: use Modern::Perl in plugins perl scripts 2018-02-05 09:46:44 -03:00
reports Bug 23389: Add 'All' option to report dropdowns 2019-12-18 10:18:07 +13:00
reserve Bug 22021: Improve item status display when placing holds in staff 2019-08-13 20:23:26 +00:00
reviews Bug 18789: Send Koha::Patron object to the templates 2018-02-16 13:03:58 -03:00
rotating_collections Bug 21500: Remove warnings in rotating collections 2018-10-09 15:02:45 +00:00
serials Bug 11492: (follow-up) Don't pass publisheddatetext param to NewIssue 2019-06-11 14:37:06 +00:00
services Bug 20019: use Modern::Perl in misc perl scripts 2018-02-05 09:47:08 -03:00
skel
…
suggestion Bug 22868: Move suggestions_manage subperm out of acquisition perm 2020-02-18 10:03:31 +13:00
svc Bug 23144: (QA follow-up) Fix another POD error in svc/barcode 2019-07-18 23:04:02 +00:00
t Bug 23290: [RMaint version] Mitigate XML/XSLT vulnerabilities 2020-02-24 09:10:06 +13:00
tags Bug 22036: Indented code where '^I' was written rather than an indent. 2019-01-23 12:25:07 +00:00
test
…
tmp/modified_authorities
…
tools Bug 24878: Add authentication checks to the calendar tool 2020-03-24 14:14:17 +13:00
virtualshelves Bug 22941: Do not return 500 if sortfield contain parenthesis 2019-06-26 16:38:53 +00:00
xt Bug 21576: Keep compatibility with QA script 2018-10-26 17:09:52 +00:00
.editorconfig
…
.gitignore Bug 20427: Convert OPAC LESS to SCSS 2018-08-09 15:17:07 +00:00
.htaccess
…
.mailmap Update mailmap - Jonathan Druart 2017-06-21 12:42:19 -03:00
.scss-lint.yml Bug 21237: Clean up staff client SCSS 2018-08-24 16:23:25 +00:00
INSTALL Bug 17626: Remove existing install instructions and link to the wiki pages instead 2016-11-22 11:29:07 +00:00
Koha.pm Increment version for 18.11.15 release 2020-03-24 09:02:19 +13:00
LICENSE
…
MANIFEST.SKIP
…
Makefile.PL Bug 20174: Remove xml_sax.pl target from Makefile.pl 2019-02-25 15:26:15 +00:00
README
…
README.md Bug 15465: Fix typo in bugs.k-c.org 2017-05-26 11:45:31 -03:00
README.robots
…
about.pl Bug 20996: Remove prefix use of borrower category 2018-11-02 10:33:02 +00:00
changelanguage.pl Bug 21299: (QA follow-up) Rename module and subroutine 2018-11-07 21:52:17 +00:00
fix-perl-path.PL
…
gulpfile.js Bug 20427: Convert OPAC LESS to SCSS 2018-08-09 15:17:07 +00:00
help.pl Bug 19817: Use the language from the interface if valid 2018-09-06 17:32:28 +00:00
koha_perl_deps.pl Bug 20019: use Modern::Perl in misc perl scripts 2018-02-05 09:47:08 -03:00
kohaversion.pl
…
mainpage.pl Bug 21907: Fix article requests count for non-superlibrarians 2019-02-11 13:42:24 +00:00
package.json Bug 19474: Convert staff client CSS to SCSS 2018-08-09 15:12:20 +00:00
rewrite-config.PL Bug 14302: Remove GRS1 specific code 2018-08-31 11:24:20 +00:00
yarn.lock Bug 19474: Convert staff client CSS to SCSS 2018-08-09 15:12:20 +00:00

README.md

Koha is a free software integrated library system (ILS).

Koha is distributed under the GNU GPL version 3 or later.

Note: This is a synced mirror of the official Koha repo.

Note: Koha does not accept pull requests from git hosting sites.

Note: This project has its own bug tracker, to report a bug or submit a patch visit http://bugs.koha-community.org.

For guidelines on submitting patches for Koha please visit https://wiki.koha-community.org/wiki/SubmitingAPatch

The developers handbook can be found at https://wiki.koha-community.org/wiki/Developer_handbook

http://koha-community.org/

Koha Logo