gitea
/
Koha-clms
1
0
Fork 0
Code Issues Pull Requests Packages Projects Releases Wiki Activity
50,330 Commits 39 Branches 720 Tags 6 GiB
Perl 44.2%
JavaScript 41.1%
HTML 6%
XSLT 3.1%
Vue 1.9%
Other 3.2%
Go to file
David Cook 6c6467cfb5
Bug 41591: Prevent inline rendering of invoice files 
This patch forces download of invoice files rather than showing
them inline where they can potentially perform XSS

Test plan:
0. Apply the patch
1. koha-plack --restart kohadev
2. Find or create an active vendor
3. Create a basket if one doesn't already exist
4. Receive a shipment for the vendor
5. Create an invoice
6. Go to the invoice
7. In the URL change invoice.pl to invoice-files.pl
(or turn on AcqEnableFiles and go to it that way)
8. Upload an image file (e.g. SVG) or PDF
9. Click on the filename
10. Note that instead of displaying in the browser,
the file will be downloaded

Signed-off-by: Jonathan Druart <jonathan.druart@bugs.koha-community.org>

Signed-off-by: Marcel de Rooy <m.de.rooy@rijksmuseum.nl>
Signed-off-by: Wainui Witika-Park <wainuiwitikapark@catalyst.net.nz>
 		2026-02-24 12:58:06 +13:00
C4 Revert "Bug 36092: Pass sessionID at the end of get_template_and_user" 2025-07-24 17:52:32 +12:00
Koha Bug 40818: [22.11] Remove HTML from marc_lib 2025-10-30 11:23:51 +13:00
acqui Bug 41591: Prevent inline rendering of invoice files 2026-02-24 12:58:06 +13:00
admin Bug 33339: Prevent Formula Injection (CSV Injection) in CSV files 2024-11-07 23:29:11 +00:00
api Bug 28907: REST - Remove allow-owner from public article requests cancel route 2025-02-24 18:37:36 +00:00
authorities Bug 25387: (QA follow-up) Tidy 2024-10-07 19:14:03 +02:00
basket Bug 33102: Display fields from biblioitems in OPAC/staff interface cart 2023-05-12 16:34:19 +01:00
bin Bug 20582: Turn Koha into a Mojolicious application 2020-10-06 12:00:04 +02:00
catalogue Bug 35294: Fix typos in catalogue code comments 2024-10-07 19:06:09 +02:00
cataloguing Bug 24879: Add check_cookie_auth when missing 2024-03-25 08:23:03 +00:00
circ Bug 25835: Include overdues with fines in overdues_report permission 2025-06-23 02:58:10 +00:00
clubs Bug 30718: Use flatpickr's altInput 2022-08-19 08:26:31 -03:00
course_reserves Bug 31893: Use checkauth and do not fetch about.tt template 2023-01-31 14:09:05 +00:00
debian Bug 40579: [Follow up 22.11] Add Test::NoWarnings 2025-10-30 11:24:58 +13:00
docs Bug 41317: Add 25.11 maintainers 2026-01-29 19:40:51 +13:00
erm Bug 32922: Remove space in shebang 2023-02-24 07:51:37 +00:00
errors Bug 29420: HTTP status code incorrect when calling error pages directly under Plack/PSGI 2022-04-20 09:03:39 -10:00
etc Bug 30843: Add mfa_range configuration option for TOTP 2023-10-17 16:56:21 +00:00
ill Bug 28909: Allow illview to use backend template 2022-08-09 13:21:39 -03:00
installer Increment version for 22.11.34 release 2026-01-29 19:40:51 +13:00
koha-tmpl Bug 41591: Prevent inline rendering of invoice files 2026-02-24 12:58:06 +13:00
labels Bug 33339: Prevent Formula Injection (CSV Injection) in CSV files 2024-11-07 23:29:11 +00:00
lib/CGI/Session/Serialize Bug 17600: Standardize our EXPORT_OK 2021-07-16 08:58:47 +02:00
members Bug 35830: Add merge_borrowers subpermission 2025-12-03 15:08:47 +13:00
misc Fix release notes 2026-01-29 19:40:51 +13:00
offline_circ Bug 30016: Remove GetOpenIssue subroutine 2022-08-31 08:50:37 -03:00
opac Bug 13342: Not logged user can place a review/comment 2025-07-24 18:05:26 +12:00
patron_lists Bug 16446: Add ability to add patrons to list by borrowernumber 2021-10-21 12:24:04 +02:00
patroncards Bug 24001: Fix patron card template edition 2022-04-28 10:49:20 -10:00
plugins Bug 30367: (follow-up) Same adjustment for gitlab 2023-05-12 15:58:09 +01:00
pos Bug 34331: Use register from userenv if parameter not passed 2023-08-31 10:23:50 +00:00
recalls Bug 34013: Recalls awaiting pickup doesn't show count on each tab 2023-07-18 11:21:31 +00:00
reports Bug 37784: [24.05] (QA follow-up) Bail out to new definition 2025-03-24 15:33:19 +00:00
reserve Bug 34634: Show expirationdate of expired holds on reserve/request.pl 2023-09-15 09:33:06 +00:00
reviews Bug 17600: Standardize our EXPORT_OK 2021-07-16 08:58:47 +02:00
rotating_collections Bug 17600: Standardize our EXPORT_OK 2021-07-16 08:58:47 +02:00
serials Bug 39996: Fix subscription details display 2025-08-22 16:14:59 +12:00
services Bug 17600: Standardize our EXPORT_OK 2021-07-16 08:58:47 +02:00
skel
…
suggestion Bug 41593: Validate displayby parameter in suggestion.pl 2026-01-23 12:11:28 +13:00
svc Bug 37508: Throw error if password column is detected in SQL report 2024-08-13 11:54:01 -03:00
t Bug 35830: Add merge_borrowers subpermission 2025-12-03 15:08:47 +13:00
tags Bug 38969: Prevent XSS in tags/review.pl and Prevent JS error when adding tags with quote at the OPAC 2025-04-24 15:12:24 +00:00
tools Bug 38357: Prevent holidays to be wrongly added 2025-03-31 09:42:12 +00:00
virtualshelves Bug 34650: Remove unnecessary CSRF check on edit_form 2023-09-08 09:47:28 +00:00
xt [22.11.x] Bug 40579: Add author test for CSV formula injection protection 2025-08-26 16:02:04 +12:00
.editorconfig Bug 27375: Set YAML file settings in .editorconfig 2021-11-03 15:40:52 +01:00
.eslintrc.json
…
.gitignore Bug 35174: Add misc/translator/po to .gitignore 2023-11-22 09:37:30 +01:00
.htaccess
…
.mailmap Update .mailmap 2023-07-18 09:22:47 +00:00
.perlcriticrc Bug 25898: Prohibit indirect object notation 2020-10-15 12:56:30 +02:00
.perltidyrc Bug 30002: Adjust perltidy 2023-07-12 09:16:19 +00:00
.proverc.dist Bug 19821: Install sample data, ES mappings and Version syspref 2021-10-25 11:27:40 +02:00
.stylelintrc.json Bug 31528: (follow-up) A few additional rules 2022-10-03 08:23:15 -03:00
INSTALL Bug 26617: Update INSTALL file to include koha-testing-docker and Gitlab links 2020-10-15 12:56:30 +02:00
Koha.pm Increment version for 22.11.34 release 2026-01-29 19:40:51 +13:00
LICENSE
…
MANIFEST.SKIP
…
Makefile.PL Bug 30002: (QA follow-up) Add .perltidyrc to Makefile.PL mapping 2023-07-12 09:41:28 +00:00
README
…
README.md Bug 27092: Remove note about "synced repo" from README.md 2020-11-25 16:31:58 +01:00
README.robots
…
about.pl Bug 35174: Add a warning to the about page 2023-11-22 09:37:14 +01:00
app.psgi Bug 36149: Add userenv middleware to app.psgi 2024-04-24 10:50:45 +00:00
build-resources.PL Bug 32609: Use the current yarn.lock to generate node_modules 2023-03-10 12:27:47 +00:00
changelanguage.pl Bug 25898: Prohibit indirect object notation 2020-10-15 12:56:30 +02:00
cpanfile Bug 40579: [Follow up 22.11] Add Test::NoWarnings 2025-10-30 11:24:58 +13:00
cypress.json Bug 33408: Extend defaultCommandTimeout for cypress 2023-05-15 13:15:43 +00:00
fix-perl-path.PL Bug 28606: Remove $DEBUG and $ENV{DEBUG} 2021-06-24 11:53:44 +02:00
gulpfile.js Bug 35174: Don't run gulp po commands if po dir is missing 2023-11-22 09:37:36 +01:00
help.pl Bug 17600: Standardize our EXPORT_OK 2021-07-16 08:58:47 +02:00
kohaversion.pl
…
mainpage.pl Bug 30493: (QA follow-up) Fix for the only_my_library case as well 2024-10-07 19:07:20 +02:00
package.json Bug 33066: Introduce a KohaTable Vue component 2023-05-11 17:01:22 +01:00
rewrite-config.PL Bug 28519: Put CGI::Session::Serialize::yamlxs in lib directory 2021-06-17 10:07:36 +02:00
tsconfig.json Bug 32030: Move cypress to t - fix build_js/watch_js 2022-11-08 09:44:52 -03:00
webpack.config.js Bug 32806: Move main-erm.ts to modules/erm.ts 2023-02-28 18:54:57 +00:00
yarn.lock Bug 33066: Introduce a KohaTable Vue component 2023-05-11 17:01:22 +01:00

README.md

Koha is a free software integrated library system (ILS).

Koha is distributed under the GNU GPL version 3 or later.

Note: Koha does not accept pull requests from git hosting sites.

Note: This project has its own bug tracker, to report a bug or submit a patch visit http://bugs.koha-community.org.

For guidelines on submitting patches for Koha please visit https://wiki.koha-community.org/wiki/SubmitingAPatch

The developers handbook can be found at https://wiki.koha-community.org/wiki/Developer_handbook

http://koha-community.org/

Koha Logo