gitea
/
Koha-clms
1
0
Fork 0
Code Issues Pull Requests Packages Projects Releases Wiki Activity
Koha-clms/acqui
History
David Cook 605388852d
Bug 41591: Prevent inline rendering of invoice files 
This patch forces download of invoice files rather than showing
them inline where they can potentially perform XSS

Test plan:
0. Apply the patch
1. koha-plack --restart kohadev
2. Find or create an active vendor
3. Create a basket if one doesn't already exist
4. Receive a shipment for the vendor
5. Create an invoice
6. Go to the invoice
7. In the URL change invoice.pl to invoice-files.pl
(or turn on AcqEnableFiles and go to it that way)
8. Upload an image file (e.g. SVG) or PDF
9. Click on the filename
10. Note that instead of displaying in the browser,
the file will be downloaded

Signed-off-by: Jonathan Druart <jonathan.druart@bugs.koha-community.org>

Signed-off-by: Marcel de Rooy <m.de.rooy@rijksmuseum.nl>
Signed-off-by: Lucas Gass <lucas@bywatersolutions.com>
 		2026-02-25 07:36:46 -07:00
..
acqui-home.pl Bug 40163: Fix several http addresses in the code docs 2025-09-23 16:21:29 -06:00
addorder.pl Bug 40680: Fix acqui scripts 2025-12-01 08:33:57 -07:00
addorderiso2709.pl Bug 40163: Fix several http addresses in the code docs 2025-09-23 16:21:29 -06:00
ajax-getauthvaluedropbox.pl Bug 40163: Fix several http addresses in the code docs 2025-09-23 16:21:29 -06:00
basket.pl Bug 39721: Remove GetSuggestion from C4/Suggestions.pm 2026-02-06 15:17:06 -07:00
basketgroup.pl Bug 40163: Fix several http addresses in the code docs 2025-09-23 16:21:29 -06:00
basketheader.pl Bug 41076: Adjust our perl tidiness for v20250105 2026-02-05 09:03:51 -07:00
booksellers.pl Bug 40163: Fix several http addresses in the code docs 2025-09-23 16:21:29 -06:00
cancelorder.pl Bug 40163: Fix several http addresses in the code docs 2025-09-23 16:21:29 -06:00
check_budget_total.pl Bug 40163: Fix several http addresses in the code docs 2025-09-23 16:21:29 -06:00
check_uniqueness.pl Bug 40163: Fix several http addresses in the code docs 2025-09-23 16:21:29 -06:00
duplicate_orders.pl Bug 40163: Fix several http addresses in the code docs 2025-09-23 16:21:29 -06:00
edifactmsgs.pl Bug 40163: Fix several http addresses in the code docs 2025-09-23 16:21:29 -06:00
edimsg.pl Bug 40163: Fix several http addresses in the code docs 2025-09-23 16:21:29 -06:00
finishreceive.pl Bug 40163: Fix several http addresses in the code docs 2025-09-23 16:21:29 -06:00
histsearch.pl Bug 40163: Fix several http addresses in the code docs 2025-09-23 16:21:29 -06:00
invoice-files.pl Bug 41591: Prevent inline rendering of invoice files 2026-02-25 07:36:46 -07:00
invoice.pl Bug 40680: Fix acqui scripts 2025-12-01 08:33:57 -07:00
invoices.pl Bug 40163: Fix several http addresses in the code docs 2025-09-23 16:21:29 -06:00
lateorders-export.pl Bug 40163: Fix several http addresses in the code docs 2025-09-23 16:21:29 -06:00
lateorders.pl Bug 40163: Fix several http addresses in the code docs 2025-09-23 16:21:29 -06:00
moddeliverydate.pl Bug 40163: Fix several http addresses in the code docs 2025-09-23 16:21:29 -06:00
modordernotes.pl Bug 40163: Fix several http addresses in the code docs 2025-09-23 16:21:29 -06:00
neworderempty.pl Bug 39721: Remove GetSuggestion from C4/Suggestions.pm 2026-02-06 15:17:06 -07:00
newordersubscription.pl Bug 40163: Fix several http addresses in the code docs 2025-09-23 16:21:29 -06:00
newordersuggestion.pl Bug 40163: Fix several http addresses in the code docs 2025-09-23 16:21:29 -06:00
ordered.pl Bug 40163: Fix several http addresses in the code docs 2025-09-23 16:21:29 -06:00
orderreceive.pl Bug 41563: Tidy kohaTable - acqui/orderreceive.tt 2026-02-10 10:51:49 -07:00
parcel.pl Bug 39721: Remove GetSuggestion from C4/Suggestions.pm 2026-02-06 15:17:06 -07:00
parcels.pl Bug 40163: Fix several http addresses in the code docs 2025-09-23 16:21:29 -06:00
showorder.pl Bug 40163: Fix several http addresses in the code docs 2025-09-23 16:21:29 -06:00
spent.pl Bug 40163: Fix several http addresses in the code docs 2025-09-23 16:21:29 -06:00
transferorder.pl Bug 40163: Fix several http addresses in the code docs 2025-09-23 16:21:29 -06:00
uncertainprice.pl Bug 40163: Fix several http addresses in the code docs 2025-09-23 16:21:29 -06:00
vendor_issues.pl Bug 40163: Fix several http addresses in the code docs 2025-09-23 16:21:29 -06:00
vendors.pl Bug 40163: Fix several http addresses in the code docs 2025-09-23 16:21:29 -06:00
z3950_search.pl Bug 40163: Fix several http addresses in the code docs 2025-09-23 16:21:29 -06:00