gitea
/
Koha-clms
1
0
Fork 0
Code Issues Pull Requests Packages Projects Releases Wiki Activity
50,323 Commits 39 Branches 720 Tags 6 GiB
Perl 44.2%
JavaScript 41.1%
HTML 6%
XSLT 3.1%
Vue 1.9%
Other 3.2%
Go to file
David Cook 849ea83491
Bug 41593: Validate displayby parameter in suggestion.pl 
This change validates the displayby parameter in suggestion.pl
in order to prevent SQL injection.

Test plan:
0. Do not apply the patch
1. Log into the staff interface
2. Visit the path /cgi-bin/koha/suggestion/suggestion.pl?
op=else&displayby=status+AND+EXTRACTVALUE(1,CONCAT(0x7e,@@version))
3. Notice a 500 error is generated
4. In the error logs, the MySQL version number will appear

5. Apply the patch
6. koha-plack --restart kohadev

7. Visit the path /cgi-bin/koha/suggestion/suggestion.pl?
op=else&displayby=status+AND+EXTRACTVALUE(1,CONCAT(0x7e,@@version))
8. Notice that no error is generated
9. Try each of the "Organize by" options on the left nav bar
10. Note that none of them generate an error and that the option is
retained after clicking "Go"

Signed-off-by: Jonathan Druart <jonathan.druart@bugs.koha-community.org>
Signed-off-by: Lisette Scheer <lisette@bywatersolutions.com>
Signed-off-by: Wainui Witika-Park <wainuiwitikapark@catalyst.net.nz>
 		2026-01-23 12:11:28 +13:00
C4 Revert "Bug 36092: Pass sessionID at the end of get_template_and_user" 2025-07-24 17:52:32 +12:00
Koha Bug 40818: [22.11] Remove HTML from marc_lib 2025-10-30 11:23:51 +13:00
acqui Bug 30493: (QA follow-up) Fix for the only_my_library case as well 2024-10-07 19:07:20 +02:00
admin Bug 33339: Prevent Formula Injection (CSV Injection) in CSV files 2024-11-07 23:29:11 +00:00
api Bug 28907: REST - Remove allow-owner from public article requests cancel route 2025-02-24 18:37:36 +00:00
authorities Bug 25387: (QA follow-up) Tidy 2024-10-07 19:14:03 +02:00
basket Bug 33102: Display fields from biblioitems in OPAC/staff interface cart 2023-05-12 16:34:19 +01:00
bin
…
catalogue Bug 35294: Fix typos in catalogue code comments 2024-10-07 19:06:09 +02:00
cataloguing Bug 24879: Add check_cookie_auth when missing 2024-03-25 08:23:03 +00:00
circ Bug 25835: Include overdues with fines in overdues_report permission 2025-06-23 02:58:10 +00:00
clubs Bug 30718: Use flatpickr's altInput 2022-08-19 08:26:31 -03:00
course_reserves Bug 31893: Use checkauth and do not fetch about.tt template 2023-01-31 14:09:05 +00:00
debian Bug 40579: [Follow up 22.11] Add Test::NoWarnings 2025-10-30 11:24:58 +13:00
docs Bug 40022: [24.05.x] Add the 25.11 release team 2025-08-22 15:10:16 +12:00
erm Bug 32922: Remove space in shebang 2023-02-24 07:51:37 +00:00
errors
…
etc Bug 30843: Add mfa_range configuration option for TOTP 2023-10-17 16:56:21 +00:00
ill Bug 28909: Allow illview to use backend template 2022-08-09 13:21:39 -03:00
installer Bug 41421: [22.11.x] Fix DB update 2025-12-10 11:01:50 -07:00
koha-tmpl Bug 40524: [22.11.x] Update print format to use built-in formatter 2025-12-03 15:37:05 +13:00
labels Bug 33339: Prevent Formula Injection (CSV Injection) in CSV files 2024-11-07 23:29:11 +00:00
lib/CGI/Session/Serialize
…
members Bug 35830: Add merge_borrowers subpermission 2025-12-03 15:08:47 +13:00
misc Update release notes for 22.11.33 release 2025-12-05 12:19:52 +13:00
offline_circ Bug 30016: Remove GetOpenIssue subroutine 2022-08-31 08:50:37 -03:00
opac Bug 13342: Not logged user can place a review/comment 2025-07-24 18:05:26 +12:00
patron_lists
…
patroncards
…
plugins Bug 30367: (follow-up) Same adjustment for gitlab 2023-05-12 15:58:09 +01:00
pos Bug 34331: Use register from userenv if parameter not passed 2023-08-31 10:23:50 +00:00
recalls Bug 34013: Recalls awaiting pickup doesn't show count on each tab 2023-07-18 11:21:31 +00:00
reports Bug 37784: [24.05] (QA follow-up) Bail out to new definition 2025-03-24 15:33:19 +00:00
reserve Bug 34634: Show expirationdate of expired holds on reserve/request.pl 2023-09-15 09:33:06 +00:00
reviews
…
rotating_collections
…
serials Bug 39996: Fix subscription details display 2025-08-22 16:14:59 +12:00
services
…
skel
…
suggestion Bug 41593: Validate displayby parameter in suggestion.pl 2026-01-23 12:11:28 +13:00
svc Bug 37508: Throw error if password column is detected in SQL report 2024-08-13 11:54:01 -03:00
t Bug 35830: Add merge_borrowers subpermission 2025-12-03 15:08:47 +13:00
tags Bug 38969: Prevent XSS in tags/review.pl and Prevent JS error when adding tags with quote at the OPAC 2025-04-24 15:12:24 +00:00
tools Bug 38357: Prevent holidays to be wrongly added 2025-03-31 09:42:12 +00:00
virtualshelves Bug 34650: Remove unnecessary CSRF check on edit_form 2023-09-08 09:47:28 +00:00
xt [22.11.x] Bug 40579: Add author test for CSV formula injection protection 2025-08-26 16:02:04 +12:00
.editorconfig
…
.eslintrc.json
…
.gitignore Bug 35174: Add misc/translator/po to .gitignore 2023-11-22 09:37:30 +01:00
.htaccess
…
.mailmap Update .mailmap 2023-07-18 09:22:47 +00:00
.perlcriticrc
…
.perltidyrc Bug 30002: Adjust perltidy 2023-07-12 09:16:19 +00:00
.proverc.dist
…
.stylelintrc.json Bug 31528: (follow-up) A few additional rules 2022-10-03 08:23:15 -03:00
INSTALL
…
Koha.pm Increment version for 22.11.33 release 2025-12-05 12:19:49 +13:00
LICENSE
…
MANIFEST.SKIP
…
Makefile.PL Bug 30002: (QA follow-up) Add .perltidyrc to Makefile.PL mapping 2023-07-12 09:41:28 +00:00
README
…
README.md
…
README.robots
…
about.pl Bug 35174: Add a warning to the about page 2023-11-22 09:37:14 +01:00
app.psgi Bug 36149: Add userenv middleware to app.psgi 2024-04-24 10:50:45 +00:00
build-resources.PL Bug 32609: Use the current yarn.lock to generate node_modules 2023-03-10 12:27:47 +00:00
changelanguage.pl
…
cpanfile Bug 40579: [Follow up 22.11] Add Test::NoWarnings 2025-10-30 11:24:58 +13:00
cypress.json Bug 33408: Extend defaultCommandTimeout for cypress 2023-05-15 13:15:43 +00:00
fix-perl-path.PL
…
gulpfile.js Bug 35174: Don't run gulp po commands if po dir is missing 2023-11-22 09:37:36 +01:00
help.pl
…
kohaversion.pl
…
mainpage.pl Bug 30493: (QA follow-up) Fix for the only_my_library case as well 2024-10-07 19:07:20 +02:00
package.json Bug 33066: Introduce a KohaTable Vue component 2023-05-11 17:01:22 +01:00
rewrite-config.PL
…
tsconfig.json Bug 32030: Move cypress to t - fix build_js/watch_js 2022-11-08 09:44:52 -03:00
webpack.config.js Bug 32806: Move main-erm.ts to modules/erm.ts 2023-02-28 18:54:57 +00:00
yarn.lock Bug 33066: Introduce a KohaTable Vue component 2023-05-11 17:01:22 +01:00

README.md

Koha is a free software integrated library system (ILS).

Koha is distributed under the GNU GPL version 3 or later.

Note: Koha does not accept pull requests from git hosting sites.

Note: This project has its own bug tracker, to report a bug or submit a patch visit http://bugs.koha-community.org.

For guidelines on submitting patches for Koha please visit https://wiki.koha-community.org/wiki/SubmitingAPatch

The developers handbook can be found at https://wiki.koha-community.org/wiki/Developer_handbook

http://koha-community.org/

Koha Logo