gitea
/
Koha-clms
1
0
Fork 0
Code Issues Pull Requests Packages Projects Releases Wiki Activity
25,988 Commits 39 Branches 720 Tags 6 GiB
Perl 44.2%
JavaScript 41.1%
HTML 6%
XSLT 3.1%
Vue 1.9%
Other 3.2%
Go to file
Jonathan Druart 5b03c19c12 Bug 17901: Fix possible SQL injection in shelf editing 
It has been reported that
/cgi-bin/koha/opac-shelves.pl?op=edit&referer=view&shelfnumber=146&owner=4&shelfname=testX&sortfield=titleaaaaaa\`&category=1

Could lead to SQL injection
Actually it explodes because the generated SQL query is not correctly formated.

However it would be good to limit the possible values for sortfield.

This vulnerability has been reported by MDSec.

Signed-off-by: Mirko Tietgen <mirko@abunchofthings.net>

Signed-off-by: Marcel de Rooy <m.de.rooy@rijksmuseum.nl>

Signed-off-by: Kyle M Hall <kyle@bywatersolutions.com>
(cherry picked from commit 45cffd874c)
Signed-off-by: Julian Maurice <julian.maurice@biblibre.com>
 		2017-01-30 16:28:57 +01:00
C4 Bug 17900: Fix possible SQL injection in patron cards template editing 2017-01-30 16:25:01 +01:00
Koha Revert "Bug 17494: Prevent duplicate tokens from getting stored" 2017-01-25 16:15:32 +01:00
OpenILS Bug 9239 QA follow-up: remove stray debug code 2013-03-16 21:32:34 -04:00
acqui Bug 17681: Exiisting typos might thow some feees when recieved 2017-01-02 12:30:30 +01:00
admin Bug 17389: (bug 16035 follow-up) Fix export non-default frameworks 2016-10-24 12:02:11 +02:00
api/v1 Bug 13799: Add types for patron's fields in Swagger spec 2015-11-04 13:47:33 -03:00
authorities Bug 16154: CGI->multi_param - Force scalar context 2016-05-16 14:42:43 +02:00
basket Bug 16447: Remove occurrence of the borrow permission which does no longer exist 2016-05-16 11:37:09 +02:00
catalogue Bug 16951: Replace some more 2017-01-02 12:46:15 +01:00
cataloguing Bug 16358: Do not redirect to the editor when deleting records 2016-10-24 12:32:00 +02:00
circ Bug 9569: Remove unused occurrence of AutoLocation 2017-01-30 16:21:06 +01:00
course_reserves Bug 16154: CGI->multi_param - Force scalar context 2016-05-16 14:42:43 +02:00
debian Bug 17265 - Make koha-create-defaults less greedy 2017-01-19 15:42:21 +01:00
docs Bug 7143: Updates for the 3.22 release 2015-11-10 11:01:07 -03:00
errors Bug 11944: use CGI( -utf8 ) everywhere 2015-01-13 13:07:21 -03:00
etc Bug 17547: (MARC21|NORMARC) have Chronological term field $9 indexed 2017-01-02 12:27:44 +01:00
install_misc Bug 16770: Remove 2 other occurrences of libmemoize-memcached-perl 2016-08-16 15:33:27 +02:00
installer Increment version for 3.22.15 release 2017-01-23 12:21:47 +01:00
koha-tmpl Bug 9569: Update warning message 2017-01-30 16:22:27 +01:00
labels Bug 17900: Fix possible SQL injection in patron cards template editing 2017-01-30 16:25:01 +01:00
members Bug 17419: Fix smsalertnumber and mobile confusion in moremember.pl 2016-11-30 14:36:08 +01:00
misc Update release notes for 3.22.15 release 2017-01-23 12:21:47 +01:00
offline_circ Bug 15764: Fix timestamp sent by KOCT 2016-02-26 15:47:37 +01:00
opac Bug 17901: Fix possible SQL injection in shelf editing 2017-01-30 16:28:57 +01:00
patron_lists Bug 16154: CGI->multi_param - Force scalar context 2016-05-16 14:42:43 +02:00
patroncards Bug 17900: Fix possible SQL injection in patron cards template editing 2017-01-30 16:25:01 +01:00
plugins Bug 14951: Remove C4::Dates from plugins/*.pl files 2015-10-06 10:29:42 -03:00
reports Bug 17590 - Exporting reports as CSV with 'delimiter' SysPref set to 'tabulation' creates files with 't' as separator 2016-11-30 14:32:56 +01:00
reserve Bug 17028: Fix XSS in reserve/request.pl 2016-08-17 14:14:48 +02:00
reviews Bug 14779: Cannot paginate reviews 2015-09-07 11:38:26 -03:00
rotating_collections Bug 15066: Make transfer rotating collection works under Plack 2015-11-05 09:50:09 -03:00
selenium Adding selenium tests for filterMembers 2009-09-30 11:30:37 +02:00
serials Bug 12178: Update serial status to "claimed" when exporting to CSV 2016-08-17 11:33:26 +02:00
services Bug 9978: Replace license header with the correct license (GPLv3+) 2015-04-20 09:59:38 -03:00
skel Bug 11078: Add locking to rebuild_zebra 2014-02-28 22:21:41 +00:00
sms Bug 15258: Fix Perl scripts declaring unused variables 2015-12-31 14:32:53 +01:00
suggestion Bug 16154: CGI->multi_param - Declare a list 2016-05-16 14:38:51 +02:00
svc Bug 17375: Search by dateofbirth - handle invalid dates 2016-11-08 10:17:35 +01:00
t Bug 17900: Update the tests to the new API 2017-01-30 16:25:01 +01:00
tags Bug 16154: CGI->multi_param - Assign a list 2016-05-16 14:42:51 +02:00
test Bug 14321: Final cleanup, removing obsolete files 2015-09-25 12:02:52 -03:00
tmp/modified_authorities changing DO_NOT_REMOVE to README.txt 2007-10-21 19:14:41 -05:00
tools Bug 17949: Fix batch patron deletion tool 2017-01-20 13:43:21 +01:00
virtualshelves Bug 17901: Fix possible SQL injection in shelf editing 2017-01-30 16:28:57 +01:00
xt Bug 13632: (QA followup) remove xt/permissions.t 2015-10-19 12:42:59 -03:00
.editorconfig Bug 12545: Add EditorConfig.org file to the source tree 2014-08-22 11:07:45 -03:00
.htaccess Fix file permissions: if it is not a script, it should not be executable. 2010-04-16 00:40:34 -04:00
.mailmap (RM followup) .mailmap updates 2015-05-22 17:02:21 -03:00
INSTALL Bug 7759, update of install files to use background indexing (and some whitespace tidy) 2012-04-20 16:11:52 +02:00
INSTALL.debian Bug 8092 follow-up: Add optional dependency on CHI 2012-06-09 13:08:18 +02:00
INSTALL.fedora7 Bug 9809: Remove one more occurrence of reserveconstraints 2015-08-26 10:27:01 -03:00
INSTALL.opensuse Bug 11757: remove dependency on POE 2014-02-15 01:38:15 +00:00
INSTALL.ubuntu Bug 7764: (follow-up) editorial tweaks 2013-10-04 16:27:55 +00:00
Koha.pm Increment version for 3.22.15 release 2017-01-23 12:21:47 +01:00
LICENSE Bug 9440 - update Koha's LICENSE file from GPL2 to GPL3 2013-02-12 08:52:10 -05:00
MANIFEST.SKIP Bug 9546 : Updating make manifest tardist 2013-02-06 23:54:46 -05:00
Makefile.PL Bug 17044: Fix wrong destination for 'api' directory 2016-08-17 15:47:12 +02:00
README Bug 9440 - update Koha's LICENSE file from GPL2 to GPL3 2013-02-12 08:52:10 -05:00
README.robots Bug 6411 add another example to README.robots 2011-07-05 14:48:05 +12:00
about.pl Bug 12721 - Syspref StatisticsFields: Warning on About page and text change in System preferences 2016-05-09 10:40:44 +02:00
changelanguage.pl Bug 16776: Do not forget external language choice in language switcher 2016-08-23 17:39:21 +02:00
edithelp.pl Bug 16447: Remove occurrence of the borrow permission which does no longer exist 2016-05-16 11:37:09 +02:00
fix-perl-path.PL Bug 9978: (followup) Replace license header with the correct license (GPLv3+) 2015-04-20 09:59:43 -03:00
help.pl Bug 14812: Display the help in the correct language 2015-10-02 15:06:08 -03:00
install-CPAN.pl Bug 9978: Replace license header with the correct license (GPLv3+) 2015-04-20 09:59:38 -03:00
koha_perl_deps.pl bug 10548: fix count of missing required dependencies by koha_perl_deps.pl 2013-07-11 14:03:32 +00:00
kohaversion.pl Bug 13758: Move the Koha version from kohaversion.pl 2015-05-07 11:39:04 -03:00
mainpage.pl Bug 10904: (QA followup) Use branch limit if either IndependentBranches or IndependentBranchesPatronModifications is enabled 2015-11-02 12:34:46 -03:00
rewrite-config.PL Bug 16222: (QA followup) Add /api dir for the API 2016-04-21 09:33:01 +02:00

README 

Koha is a free software integrated library system.

Koha is distributed under the GNU GPL version 3 or later.
Please read the file LICENSE for more details.

To install or upgrade Koha, please see the INSTALL file appropriate
to your platform.

Report bugs at http://bugs.koha-community.org/

Visit the Koha Project website at http://www.koha-community.org/