gitea
/
Koha-clms
1
0
Fork 0
Code Issues Pull Requests Packages Projects Releases Wiki Activity
Koha-clms/acqui
History
David Cook 6c6467cfb5
Bug 41591: Prevent inline rendering of invoice files 
This patch forces download of invoice files rather than showing
them inline where they can potentially perform XSS

Test plan:
0. Apply the patch
1. koha-plack --restart kohadev
2. Find or create an active vendor
3. Create a basket if one doesn't already exist
4. Receive a shipment for the vendor
5. Create an invoice
6. Go to the invoice
7. In the URL change invoice.pl to invoice-files.pl
(or turn on AcqEnableFiles and go to it that way)
8. Upload an image file (e.g. SVG) or PDF
9. Click on the filename
10. Note that instead of displaying in the browser,
the file will be downloaded

Signed-off-by: Jonathan Druart <jonathan.druart@bugs.koha-community.org>

Signed-off-by: Marcel de Rooy <m.de.rooy@rijksmuseum.nl>
Signed-off-by: Wainui Witika-Park <wainuiwitikapark@catalyst.net.nz>
 		2026-02-24 12:58:06 +13:00
..
acqui-home.pl Bug 30493: (QA follow-up) Fix for the only_my_library case as well 2024-10-07 19:07:20 +02:00
addorder.pl Bug 32457: Fix CGI vulnerability in addorder.pl 2022-12-15 13:59:18 +00:00
addorderiso2709.pl Bug 35254: [22.11.x] Add import_record_id to order inputs 2023-12-11 17:05:24 +01:00
ajax-getauthvaluedropbox.pl Bug 17600: Standardize our EXPORT_OK 2021-07-16 08:58:47 +02:00
basket.pl Bug 15348: Add estimated delivery date field to individual orders 2022-09-16 10:36:53 -03:00
basketgroup.pl Bug 31257: Add a new English 1 page layout to export basketgroup 2022-10-11 10:44:10 -03:00
basketheader.pl Bug 34509: Use select2 to load vendors on basket creation 2023-08-31 10:11:30 +00:00
booksellers.pl Bug 31017: Update field name to 'type' 2022-08-19 16:15:15 -03:00
cancelorder.pl Bug 29658: Fix crash on cancelling cancelled order 2022-09-12 16:14:47 -03:00
check_budget_total.pl Bug 17600: Standardize our EXPORT_OK 2021-07-16 08:58:47 +02:00
check_uniqueness.pl Bug 36511: Some scripts missing a dependency following Bug 24879 2024-04-15 07:49:13 +00:00
duplicate_orders.pl Bug 30718: Use flatpickr's altInput 2022-08-19 08:26:31 -03:00
edi_ean.pl Bug 17600: Standardize our EXPORT_OK 2021-07-16 08:58:47 +02:00
edifactmsgs.pl Bug 17600: Standardize our EXPORT_OK 2021-07-16 08:58:47 +02:00
edimsg.pl Bug 17600: Fix tests 2021-07-16 09:47:01 +02:00
finishreceive.pl Bug 29955: Move populate_order_with_prices to Koha namespace 2022-08-19 15:47:51 -03:00
histsearch.pl Bug 32377: Set param skiptotals on call of GetBudgetHierarchy in acqui/histsearch.pl 2023-02-01 15:18:30 +00:00
invoice-files.pl Bug 41591: Prevent inline rendering of invoice files 2026-02-24 12:58:06 +13:00
invoice.pl Bug 25763: Allow updating of order fund from invoice 2022-10-24 15:30:46 -03:00
invoices.pl Bug 31115: Add additional field filtering for invoice search 2022-10-24 14:11:07 -03:00
lateorders-export.pl Bug 15348: trivial code simplification 2022-09-16 10:36:53 -03:00
lateorders.pl Bug 33653: Use filter_by_active instead 2023-05-15 12:06:44 +00:00
moddeliverydate.pl Bug 15348: (follow-up) Fix modal to edit delivery date 2022-09-16 10:36:57 -03:00
modordernotes.pl Bug 17600: Standardize our EXPORT_OK 2021-07-16 08:58:47 +02:00
neworderempty.pl Bug 34908: Sort item types alphabetically by description when adding a new empty record as an order to a basket 2023-11-13 15:10:49 +00:00
newordersubscription.pl Bug 17600: Standardize our EXPORT_OK 2021-07-16 08:58:47 +02:00
newordersuggestion.pl Bug 23991: Move SearchSuggestion to Koha::Suggestions 2022-06-27 12:30:28 -03:00
ordered.pl Bug 17600: Standardize our EXPORT_OK 2021-07-16 08:58:47 +02:00
orderreceive.pl Bug 31459: (follow-up) Preserve budget period display 2022-10-24 15:26:24 -03:00
parcel.pl Bug 17600: Fix tests 2021-07-16 09:47:01 +02:00
parcels.pl Bug 31115: Add support for additional fields for invoices 2022-10-24 14:11:06 -03:00
showorder.pl Bug 17600: Standardize our EXPORT_OK 2021-07-16 08:58:47 +02:00
spent.pl Bug 17600: Standardize our EXPORT_OK 2021-07-16 08:58:47 +02:00
supplier.pl Bug 28082: Add acquisitions toolbar to vendors on vendor search page 2022-05-10 15:17:17 -10:00
transferorder.pl Bug 29859: Use iterator instead of as_list 2022-02-09 15:36:23 -10:00
uncertainprice.pl Bug 17600: Standardize our EXPORT_OK 2021-07-16 08:58:47 +02:00
updatesupplier.pl Bug 31017: Update field name to 'type' 2022-08-19 16:15:15 -03:00
z3950_search.pl Bug 17600: Standardize our EXPORT_OK 2021-07-16 08:58:47 +02:00