gitea
/
Koha-clms
1
0
Fork 0
Code Issues Pull Requests Packages Projects Releases Wiki Activity
20,886 Commits 39 Branches 720 Tags 6 GiB
Perl 44.2%
JavaScript 41.1%
HTML 6%
XSLT 3.1%
Vue 1.9%
Other 3.2%
Go to file
Chris 9e704e2b28 Bug 14423 : Multiple XSS vulnerabilities in serials-search 
To test

1/ Hit a url like http://localhost:8081/cgi-bin/koha/serials/serials-search.pl?bookseller_filter=%22%22%22%3E%3Cscript%3Ealert%28%27oh%20noes%27%29%3C/script%3E&searched=1&title_filter=
2/ Notice alert boxes
3/ Apply patch
4/ Reload, notice fixed

Repeat for
callnumber_filter
EAN_filter
ISSN_filter
publisher_filter
title_filter

Signed-off-by: Jonathan Druart <jonathan.druart@koha-community.org>

Signed-off-by: Katrin Fischer <katrin.fischer.83@web.de>
Signed-off-by: Chris Cormack <chrisc@catalyst.net.nz>
(cherry picked from commit bab7a33c2d)
Signed-off-by: Fridolin Somers <fridolin.somers@biblibre.com>

Conflicts:
	koha-tmpl/intranet-tmpl/prog/en/modules/serials/serials-search.tt
 		2015-06-23 14:40:24 +02:00
C4 Bug 14408: Allow tmpl and empty in template paths 2015-06-23 14:16:58 +02:00
Koha Bug 11148: Add a as_due_date parameter to the output_pref routine 2014-08-06 12:45:39 +02:00
OpenILS Bug 9239 QA follow-up: remove stray debug code 2013-03-16 21:32:34 -04:00
acqui Bug 10277 - Add C4::Context->IsSuperLibrarian() 2014-08-07 09:36:50 +02:00
admin Bug 13401 - sort branches alphabetically in admin/authorised_values.pl 2015-04-21 14:04:57 +02:00
authorities Bug 7442: fix crash when selecting an authority with 200$x or 200$y (UNIMARC) 2014-10-16 12:31:53 +02:00
basket Bug 10605: fix encoding issue on basket email (INTRANET) 2013-12-24 11:10:14 +01:00
catalogue Bug 7002: fix some invalid superlibrarian permission checks 2014-08-07 09:48:02 +02:00
cataloguing Bug 11254: make reservoir search normalize ISBNs 2014-08-13 09:44:51 +02:00
circ Bug 10277 - Add C4::Context->IsSuperLibrarian() 2014-08-07 09:36:50 +02:00
course_reserves Bug 11866: (follow-up) repair security issue introduced by main patch 2014-05-27 14:05:15 +02:00
debian Bug 10782 - Add a koha-mysqlcheck script 2014-09-10 17:19:18 +02:00
docs Bug 7143: Updating history with new developers 2014-08-06 11:11:03 +02:00
errors Housekeeping in errors scripts 2010-05-12 07:29:03 -04:00
etc Bug 9972: (follow-up) enable Lexile searches to work using QueryParser 2014-08-13 10:31:40 +02:00
install_misc Bug 11757: remove dependency on POE 2014-05-19 16:03:14 +02:00
installer Increment version for 3.14.15 release 2015-04-23 09:42:50 +02:00
koha-tmpl Bug 14423 : Multiple XSS vulnerabilities in serials-search 2015-06-23 14:40:24 +02:00
labels Bug 11222: fix crash that can occur in search for items to add to label batch 2013-12-13 09:53:16 +01:00
members Bug 10277 - Add C4::Context->IsSuperLibrarian() 2014-08-07 09:36:50 +02:00
misc Merge remote-tracking branch 'translator/3.14.15-translate' into 3.14.x 2015-04-23 09:38:09 +02:00
offline_circ Bug 10240: (follow-up) don't display patrons as lost or gone-no-address incorrectly 2013-10-11 01:57:05 +00:00
opac Bug 14412: SQL injection possible 2015-06-23 11:28:25 +02:00
patron_lists Bug 10565: (follow-up) add new user permission for patron list management 2013-10-14 22:43:03 +00:00
patroncards Bug 10636 - patronimage should have borrowernumber as PK, not cardnumber 2013-10-14 21:08:02 +00:00
plugins Bug 7804 - Add Koha Plugin System - QA Followup 2 2013-03-20 14:50:19 -04:00
reports Bug 14426: Escape or use placeholders for sql parameters 2015-06-23 14:26:05 +02:00
reserve Bug 10277 - Add C4::Context->IsSuperLibrarian() 2014-08-07 09:36:50 +02:00
reviews Bug 1623 - Provide view of approved comments 2011-12-27 18:26:50 +01:00
rotating_collections Bug 9605: rotating collections permissions are wrong 2013-03-30 22:11:05 -04:00
selenium Adding selenium tests for filterMembers 2009-09-30 11:30:37 +02:00
serials Bug 10277 - Add C4::Context->IsSuperLibrarian() 2014-08-07 09:36:50 +02:00
services Bug 11715: require authentication for various staff scripts 2014-06-26 14:08:24 +02:00
skel Bug 11078: Add locking to rebuild_zebra 2014-05-27 12:41:28 +02:00
sms Bug 10611: Use mysql_auto_reconnect instead of ping 2014-05-16 12:04:53 +02:00
suggestion Bug 10519: Suggestions: 'Organize by' and correct display of tab descriptions broken 2015-01-23 13:50:25 +01:00
svc Bug 13801: svc/bib - Set charset to utf-8 on printing header 2015-04-22 09:17:00 +02:00
t Bug 14408: Allow integers in template paths 2015-06-23 12:10:01 +02:00
tags Bug 10730: Use DataTables on the tag review page 2013-09-25 16:47:59 +00:00
test Bug 5449: JSON malformed in Koha - Blocker with jQuery 1.4.x 2011-03-12 08:53:41 +13:00
tmp/modified_authorities
…
tools Bug 12631: Inventory: fix "wrong place" and "item not scanned" 2015-04-22 09:06:26 +02:00
virtualshelves Bug 11248: fix encoding issue on emailing a list (INTRANET) 2014-08-13 09:58:54 +02:00
xt Bug 12076: better detect an untranslatable template construct 2014-08-06 10:59:18 +02:00
.htaccess Fix file permissions: if it is not a script, it should not be executable. 2010-04-16 00:40:34 -04:00
.mailmap 7439 Mailmap for master 2012-01-27 12:27:58 +01:00
INSTALL Bug 7759, update of install files to use background indexing (and some whitespace tidy) 2012-04-20 16:11:52 +02:00
INSTALL.debian Bug 8092 follow-up: Add optional dependency on CHI 2012-06-09 13:08:18 +02:00
INSTALL.fedora7 Bug 11757: remove dependency on POE 2014-05-19 16:03:14 +02:00
INSTALL.opensuse Bug 11757: remove dependency on POE 2014-05-19 16:03:14 +02:00
INSTALL.ubuntu Bug 7764: (follow-up) editorial tweaks 2013-10-04 16:27:55 +00:00
LICENSE Bug 9440 - update Koha's LICENSE file from GPL2 to GPL3 2013-02-12 08:52:10 -05:00
MANIFEST.SKIP Bug 9546 : Updating make manifest tardist 2013-02-06 23:54:46 -05:00
Makefile.PL Bug 10729: Add phrases configuration for ICU 2014-06-03 11:23:08 +02:00
README Bug 9440 - update Koha's LICENSE file from GPL2 to GPL3 2013-02-12 08:52:10 -05:00
README.robots Bug 6411 add another example to README.robots 2011-07-05 14:48:05 +12:00
about.pl Bug 11772: Show warning on About page:System information if no active currency is defined 2014-06-03 14:35:51 +02:00
changelanguage.pl Bug 6755 Problems with switching languages 2011-09-23 09:47:09 +12:00
edithelp.pl Bug 11661: sanitize file names supplied to edithelp.pl 2014-02-06 19:59:02 +01:00
fix-perl-path.PL
…
help.pl Bug 11238: contruct links to the appropriate manual version dynamically 2013-12-13 09:23:01 +01:00
install-CPAN.pl Bug 5370: Fix all the references to koha.org 2010-11-08 09:41:49 +13:00
koha_perl_deps.pl bug 10548: fix count of missing required dependencies by koha_perl_deps.pl 2013-07-11 14:03:32 +00:00
kohaversion.pl Increment version for 3.14.15 release 2015-04-23 09:42:50 +02:00
mainpage.pl Bug 10080 - Change system pref IndependantBranches to IndependentBranches 2013-05-22 07:58:23 -07:00
rewrite-config.PL Bug 10729: Add phrases configuration for ICU 2014-06-03 11:23:08 +02:00

README 

Koha is a free software integrated library system.

Koha is distributed under the GNU GPL version 3 or later.
Please read the file LICENSE for more details.

To install or upgrade Koha, please see the INSTALL file appropriate
to your platform.

Report bugs at http://bugs.koha-community.org/

Visit the Koha Project website at http://www.koha-community.org/