gitea
/
Koha-clms
1
0
Fork 0
Code Issues Pull Requests Packages Projects Releases Wiki Activity
28,650 Commits 39 Branches 720 Tags 6 GiB
Perl 44.2%
JavaScript 41.1%
HTML 6%
XSLT 3.1%
Vue 1.9%
Other 3.2%
Go to file
Katrin Fischer 5e405e8d5d Bug 19125 - XSS - members.pl 
In preparation to test this patch:
- Add a patron list named <script>alert("patron list")</script>
- Add a library named <script>alert("library")</script>
- Add a patron category named <script>alert("patron category")</script>

To test:
- Access patron search page and do a search
- Verify that the alerts added above are executed
- Apply patch
- Verify that no alerts are displayed

Signed-off-by: Amit Gupta <amit.gupta@informaticsglobal.com>

Signed-off-by: Marcel de Rooy <m.de.rooy@rijksmuseum.nl>

Signed-off-by: Jonathan Druart <jonathan.druart@bugs.koha-community.org>
(cherry picked from commit 849eaf73fc419b9a635a1ba4b69ef46a7544e55a)
Signed-off-by: Fridolin Somers <fridolin.somers@biblibre.com>
(cherry picked from commit 2b0bd9add5)
Signed-off-by: Katrin Fischer <katrin.fischer.83@web.de>
 		2017-09-19 23:00:22 +02:00
C4 Bug 18927: Use fully qualified subroutine names in C4::Items 2017-09-16 08:52:59 +02:00
Koha Bug 18900: wrong number format in receiving order 2017-09-16 01:23:53 +02:00
OpenILS
…
acqui Bug 18716: Remove CGI::param warns from updatesupplier.pl 2017-06-13 08:02:08 +02:00
admin Bug 18906: Display all funds the logged in user can use 2017-09-16 01:22:30 +02:00
api/v1 Bug 17086: Reword borrowers to patrons in Swagger tags for holds 2016-11-22 11:31:08 +00:00
authorities Bug 18019: [QA Follow-up] Also catch the delete from authorities detail 2017-04-02 19:18:25 +02:00
basket Bug 18124: Change the calls to generate and check CSRF tokens 2017-04-02 18:03:53 +02:00
catalogue Bug 18854 - Protect from DOS 2017-07-19 23:17:49 +02:00
cataloguing Bug 17922: Use correct number of digits when replacing date placeholders 2017-02-07 22:18:39 +01:00
circ Bug 19053: Keep auto_renew flag if a confirmation is needed 2017-09-10 10:58:16 +02:00
course_reserves Bug 18367 - (QA Followup) Only warn if doing a lookup and not having an item 2017-08-01 07:56:28 +02:00
debian Bug 18554: Adjust a few typos including responsability 2017-07-16 14:47:24 +02:00
docs Bug 7143: [QA Follow-up] Handling tabs 2017-01-22 20:29:05 +01:00
errors
…
etc Bug 18669 - RewriteCond affecting wrong rule in koha-httpd.conf 2017-06-05 14:54:35 +02:00
installer Bug 18741: Fix loading of SQL files in web installer 2017-09-10 11:16:25 +02:00
koha-tmpl Bug 19125 - XSS - members.pl 2017-09-19 23:00:22 +02:00
labels Bug 18535 - Clicking 'edit printer profile' in label creator causes software error 2017-05-14 11:52:51 +02:00
members Bug 19079 - XSS Flaws in Membership page 2017-08-20 15:47:21 +02:00
misc Bug 18927: Use fully qualified subroutine names in C4::Items 2017-09-16 08:52:59 +02:00
offline_circ Bug 15902 [QA Followup] - Use Koha::Patrons instead of Koha::Borrowers 2016-09-27 13:53:23 +00:00
opac Bug 16711: OPAC Password recovery: Handling if multiple accounts have the same mail address 2017-08-01 07:18:50 +02:00
patron_lists Bug 16154: CGI->multi_param - Force scalar context 2016-04-26 23:16:43 +00:00
patroncards Bug 17181: Simplify code 2017-06-28 07:49:04 +02:00
plugins Bug 16586: Koha Plugins: Limit results of GetPlugins by metadata 2016-09-09 12:13:39 +00:00
reports Bug 18898 - Some permissions for Reports can be bypassed 2017-09-16 01:20:13 +02:00
reserve Bug 15758: Koha::Libraries - Remove GetBranches 2016-09-08 14:36:03 +00:00
reviews Bug 15839: Koha::Reviews - Remove C4::Review residue 2016-09-09 10:31:00 +00:00
rotating_collections Bug 15758: Koha::Libraries - Remove GetBranches 2016-09-08 14:36:03 +00:00
serials Bug 18536: [QA Follow-up] Tiny regex simplification 2017-05-21 23:25:47 +02:00
services
…
skel
…
sms
…
suggestion Bug 18839: Suggestion.pl spelling mistake 2017-08-01 07:27:54 +02:00
svc Bug 17375: Search by dateofbirth - handle invalid dates 2016-10-27 13:18:32 +00:00
t Bug 18900: (QA followup) Make tests conditional to locale existence 2017-09-16 01:23:41 +02:00
tags Bug 16154: CGI->multi_param - Assign a list 2016-04-26 23:16:43 +00:00
test
…
tmp/modified_authorities
…
tools Bug 19023 - inventory tool performance 2017-09-16 08:54:48 +02:00
virtualshelves Bug 15584 - Staff client list errors are incorrectly styled 2017-02-14 22:26:18 +01:00
xt Bug 18746: Add license and remove diag 2017-06-13 07:55:27 +02:00
.editorconfig
…
.htaccess
…
.mailmap Update mailmap - Jonathan Druart 2017-06-29 22:39:52 +02:00
INSTALL Bug 17626: Remove existing install instructions and link to the wiki pages instead 2016-11-22 11:29:07 +00:00
Koha.pm Increment version for 16.11.11 security release 2017-08-23 19:51:09 +02:00
LICENSE
…
MANIFEST.SKIP
…
Makefile.PL Bug 18373: Re-add UpgradeBackup.pm 2017-04-16 14:28:39 +02:00
README
…
README.md Bug 15465: Fix typo in bugs.k-c.org 2017-06-05 14:20:54 +02:00
README.robots
…
about.pl Bug 18931 - Follow up - Typo fix in SQL statement 2017-07-28 01:12:13 +02:00
changelanguage.pl Bug 16776: Do not forget external language choice in language switcher 2016-08-10 13:51:33 +00:00
edithelp.pl Bug 16447: Remove occurrence of the borrow permission which does no longer exist 2016-05-05 21:28:14 +00:00
fix-perl-path.PL
…
help.pl Bug 16724: Fix link to the online documentation links 2016-06-24 12:00:42 +00:00
install-CPAN.pl
…
koha_perl_deps.pl
…
kohaversion.pl
…
mainpage.pl Bug 14610 - Add and update scripts 2016-10-26 12:15:14 +00:00
rewrite-config.PL
…

README.md

Koha is a free software integrated library system (ILS).

Koha is distributed under the GNU GPL version 3 or later.

Note: This is a synced mirror of the official Koha repo.

Note: Koha does not accept pull requests from git hosting sites.

Note: This project has its own bug tracker, to report a bug or submit a patch visit http://bugs.koha-community.org.

For guidelines on submitting patches for Koha please visit https://wiki.koha-community.org/wiki/SubmitingAPatch

The developers handbook can be found at https://wiki.koha-community.org/wiki/Developer_handbook

http://koha-community.org/

Koha Logo