gitea
/
Koha-clms
1
0
Fork 0
Code Issues Pull Requests Packages Projects Releases Wiki Activity
Koha-clms/tools
History
Jonathan Druart 96f6c110ed Bug 24878: Add authentication checks to the calendar tool 
There is a security hole in 2 scripts that are used by the UI to edit
holidays.

To test:
1) Go to Tools -> Calendar, for Centerville
   Check no holiday for 30/4/2020
2) To add a new holiday without login execute
   a curl command with necessary parameters
3) Reload page from 1), verify the new holiday
   edit and delete the holiday
4) Apply the patch
5) Do 2) again, this time you get a lengthy output,
   with the magic words:

   <title>Koha &rsaquo;
       Log in to Koha
   </title>

Signed-off-by: Bernardo Gonzalez Kriegel <bgkriegel@gmail.com>
Only tested newHoliday but the fix is the same.
No errors

Signed-off-by: Nick Clemens <nick@bywatersolutions.com>

Signed-off-by: Joy Nelson <joy@bywatersolutions.com>
(cherry picked from commit 656e7814b3)

Signed-off-by: Lucas Gass <lucas@bywatersolutions.com>
 		2020-03-24 20:45:08 +00:00
..
csv-profiles
…
quotes Bug 20017: use Modern::Perl in Tools perl scripts 2018-02-05 09:46:45 -03:00
access_files.pl Bug 21695: Clean up access files template 2018-12-26 20:47:04 +00:00
ajax-inventory.pl
…
automatic_item_modification_by_age.pl
…
background-job-progress.pl Bug 20017: use Modern::Perl in Tools perl scripts 2018-02-05 09:46:45 -03:00
batchMod.pl Bug 24051: Remove "search( %condition ) is deprecated" warning from batchMod.pl 2020-03-18 21:33:14 +00:00
batch_delete_records.pl Bug 12759: (follow-up) Using tabs for diff ways of adding records 2019-02-19 13:52:15 +00:00
batch_extend_due_dates.pl Bug 24846: Update items.onloan with the new due date 2020-03-24 15:32:54 +00:00
batch_record_modification.pl Bug 12759: (follow-up) Using tabs for diff ways of adding records 2019-02-19 13:52:15 +00:00
batch_records_ajax.pl Bug 21579: Make showdiffmarc.pl work for authorities and biblios 2018-10-17 12:29:41 +00:00
cleanborrowers.pl
…
copy-holidays.pl Bug 20017: use Modern::Perl in Tools perl scripts 2018-02-05 09:46:45 -03:00
csv-profiles.pl Bug 8612: [Follow-up] Make usage and type different columns in table 2017-06-05 12:02:08 -03:00
exceptionHolidays.pl Bug 24878: Add authentication checks to the calendar tool 2020-03-24 20:45:08 +00:00
export.pl Bug 18201: Export data -Fix "Remove non-local items" option and add "Removes non-local records" option for existing functionality 2017-12-21 13:10:03 -03:00
holidays.pl Bug 20017: use Modern::Perl in Tools perl scripts 2018-02-05 09:46:45 -03:00
import_borrowers.pl Bug 21993: Display a user-friendly message when the CSRF token is wrong 2019-01-25 20:38:32 +00:00
inventory.pl Bug 23006: Cannot use inventory with barcodes containing special chars 2019-06-10 16:47:13 +02:00
koha-news.pl Bug 20017: use Modern::Perl in Tools perl scripts 2018-02-05 09:46:45 -03:00
letter.pl Bug 23278: Reopen last panel upon "Save and continue" in notices 2019-08-06 16:45:26 +02:00
manage-marc-import.pl Bug 20180: [sql_modes] Remove GROUP BY clause in manage-marc-import.pl 2018-04-09 16:15:17 -03:00
marc_modification_templates.pl Bug 13560: Add an 'Add' option for marc modification templates 2018-07-19 17:22:18 +00:00
modborrowers.pl Bug 23217: Remove SQL error when batch patron mod and not attribute selected 2019-08-09 14:49:36 +02:00
newHolidays.pl Bug 24878: Add authentication checks to the calendar tool 2020-03-24 20:45:08 +00:00
overduerules.pl Bug 20017: use Modern::Perl in Tools perl scripts 2018-02-05 09:46:45 -03:00
picture-upload.pl Bug 21993: Display a user-friendly message when the CSRF token is wrong 2019-01-25 20:38:32 +00:00
quotes-upload.pl Bug 20017: use Modern::Perl in Tools perl scripts 2018-02-05 09:46:45 -03:00
quotes.pl Bug 20017: use Modern::Perl in Tools perl scripts 2018-02-05 09:46:45 -03:00
scheduler.pl Bug 20017: use Modern::Perl in Tools perl scripts 2018-02-05 09:46:45 -03:00
showdiffmarc.pl Bug 21579: Make showdiffmarc.pl work for authorities and biblios 2018-10-17 12:29:41 +00:00
stage-marc-import.pl Bug 21333: Add ability to add to basket from a new file 2018-09-26 19:05:53 +00:00
stockrotation.pl Bug 11897: Stockrotation 2018-10-09 15:46:05 +00:00
tools-home.pl Bug 18403: Patron reviews 2018-02-12 15:41:41 -03:00
upload-cover-image.pl Bug 20564: Don't use system to unzip files 2018-09-19 13:54:26 +00:00
upload-file.pl
…
upload.pl Bug 19633: Use alphanumeric error codes in upload 2018-08-10 10:10:46 +00:00
viewlog.pl Bug 10352: Get add operations too 2020-02-05 21:45:33 +00:00