gitea
/
Koha-clms
1
0
Fork 0
Code Issues Pull Requests Packages Projects Releases Wiki Activity
25,704 Commits 39 Branches 720 Tags 6 GiB
Perl 44.2%
JavaScript 41.1%
HTML 6%
XSLT 3.1%
Vue 1.9%
Other 3.2%
Go to file
Jonathan Druart a503a522c2 Bug 16878: Fix XSS in opac-memberentry 
The vars are gotten from the url and sent to the template as it. They
must be escaped.

Test plan:
I have not managed to create the original issue, so there is no test
plan for the XSS fix, but you can confirm there is no regression.

Signed-off-by: Chris Cormack <chris@bigballofwax.co.nz>

Signed-off-by: Katrin Fischer <katrin.fischer.83@web.de>

Signed-off-by: Brendan Gallagher <brendan@bywatersolutions.com>
(cherry picked from commit 9bdea2e369)
Signed-off-by: Frédéric Demians <f.demians@tamil.fr>
(cherry picked from commit b505c6b7d6)
Signed-off-by: Julian Maurice <julian.maurice@biblibre.com>
 		2016-08-17 14:53:42 +02:00
C4 Bug 15397 - Pay selected does not works as expected 2016-08-17 14:10:38 +02:00
Koha Bug 16720: Remove DBIx ActionLogs.pm 2016-07-01 08:50:24 +02:00
OpenILS Bug 9239 QA follow-up: remove stray debug code 2013-03-16 21:32:34 -04:00
acqui Bug 16154: Fix some other occurrences 2016-05-16 14:43:23 +02:00
admin Bug 16612 - Cannot set "Until date" for "Enrollment period" for Patron Categories 2016-08-16 14:30:02 +02:00
api/v1 Bug 13799: Add types for patron's fields in Swagger spec 2015-11-04 13:47:33 -03:00
authorities Bug 16154: CGI->multi_param - Force scalar context 2016-05-16 14:42:43 +02:00
basket Bug 16447: Remove occurrence of the borrow permission which does no longer exist 2016-05-16 11:37:09 +02:00
catalogue Bug 16742: (follow-up)Remove unused template subject.tt 2016-08-16 15:09:34 +02:00
cataloguing Bug 16154: CGI->multi_param - Force scalar context 2016-05-16 14:42:43 +02:00
circ Bug 16780 - Specify due date always sets time as AM when using 12 hour time format 2016-08-16 16:23:05 +02:00
course_reserves Bug 16154: CGI->multi_param - Force scalar context 2016-05-16 14:42:43 +02:00
debian Bug 16777: Correct intranet search alias 2016-08-17 13:11:39 +02:00
docs Bug 7143: Updates for the 3.22 release 2015-11-10 11:01:07 -03:00
errors Bug 11944: use CGI( -utf8 ) everywhere 2015-01-13 13:07:21 -03:00
etc Bug 16777: Correct intranet search alias 2016-08-17 13:11:39 +02:00
install_misc Bug 16770: Remove 2 other occurrences of libmemoize-memcached-perl 2016-08-16 15:33:27 +02:00
installer Bug 16573: Update DB rev (3.22.09.002) 2016-08-17 14:06:31 +02:00
koha-tmpl Bug 16988 - Suspending a hold with AutoResumeSuspendedHolds disabled results in error 2016-08-17 14:52:49 +02:00
labels Bug 16154: CGI->multi_param - Assign a list 2016-05-16 14:42:51 +02:00
members Bug 14605 - Corrects the individual fine's description 2016-06-16 11:15:12 +02:00
misc Bug 12509 - Fix Untranslatable Restriction added by overdues process 2016-08-16 16:08:30 +02:00
offline_circ Bug 15764: Fix timestamp sent by KOCT 2016-02-26 15:47:37 +01:00
opac Bug 16878: Fix XSS in opac-memberentry 2016-08-17 14:53:42 +02:00
patron_lists Bug 16154: CGI->multi_param - Force scalar context 2016-05-16 14:42:43 +02:00
patroncards Bug 14138: Patroncard: Warn user if PDF creation fails 2016-08-17 12:42:40 +02:00
plugins Bug 14951: Remove C4::Dates from plugins/*.pl files 2015-10-06 10:29:42 -03:00
reports Bug 16760: fix Circulation Statistics wizard under Plack 2016-08-16 16:19:13 +02:00
reserve Bug 17028: Fix XSS in reserve/request.pl 2016-08-17 14:14:48 +02:00
reviews Bug 14779: Cannot paginate reviews 2015-09-07 11:38:26 -03:00
rotating_collections Bug 15066: Make transfer rotating collection works under Plack 2015-11-05 09:50:09 -03:00
selenium Adding selenium tests for filterMembers 2009-09-30 11:30:37 +02:00
serials Bug 12178: Update serial status to "claimed" when exporting to CSV 2016-08-17 11:33:26 +02:00
services Bug 9978: Replace license header with the correct license (GPLv3+) 2015-04-20 09:59:38 -03:00
skel Bug 11078: Add locking to rebuild_zebra 2014-02-28 22:21:41 +00:00
sms Bug 15258: Fix Perl scripts declaring unused variables 2015-12-31 14:32:53 +01:00
suggestion Bug 16154: CGI->multi_param - Declare a list 2016-05-16 14:38:51 +02:00
svc Bug 16508: Updating a syspref requires parameters_remaining_permissions 2016-06-16 10:28:16 +02:00
t Bug 16934: Add test for ModOrder 2016-08-17 13:47:30 +02:00
tags Bug 16154: CGI->multi_param - Assign a list 2016-05-16 14:42:51 +02:00
test Bug 14321: Final cleanup, removing obsolete files 2015-09-25 12:02:52 -03:00
tmp/modified_authorities changing DO_NOT_REMOVE to README.txt 2007-10-21 19:14:41 -05:00
tools Bug 16859: Fix wrong item field name in export.pl 2016-08-16 16:45:13 +02:00
virtualshelves Bug 16484 - Virtualshelves: Using no XSLTResultsDisplay breaks content display in intranet 2016-05-25 11:20:17 +02:00
xt Bug 13632: (QA followup) remove xt/permissions.t 2015-10-19 12:42:59 -03:00
.editorconfig Bug 12545: Add EditorConfig.org file to the source tree 2014-08-22 11:07:45 -03:00
.htaccess Fix file permissions: if it is not a script, it should not be executable. 2010-04-16 00:40:34 -04:00
.mailmap (RM followup) .mailmap updates 2015-05-22 17:02:21 -03:00
INSTALL Bug 7759, update of install files to use background indexing (and some whitespace tidy) 2012-04-20 16:11:52 +02:00
INSTALL.debian Bug 8092 follow-up: Add optional dependency on CHI 2012-06-09 13:08:18 +02:00
INSTALL.fedora7 Bug 9809: Remove one more occurrence of reserveconstraints 2015-08-26 10:27:01 -03:00
INSTALL.opensuse Bug 11757: remove dependency on POE 2014-02-15 01:38:15 +00:00
INSTALL.ubuntu Bug 7764: (follow-up) editorial tweaks 2013-10-04 16:27:55 +00:00
Koha.pm Bug 16573: Update DB rev (3.22.09.002) 2016-08-17 14:06:31 +02:00
LICENSE Bug 9440 - update Koha's LICENSE file from GPL2 to GPL3 2013-02-12 08:52:10 -05:00
MANIFEST.SKIP Bug 9546 : Updating make manifest tardist 2013-02-06 23:54:46 -05:00
Makefile.PL Bug 16770: Remove Memoize::Memcached dependency 2016-08-16 15:33:24 +02:00
README Bug 9440 - update Koha's LICENSE file from GPL2 to GPL3 2013-02-12 08:52:10 -05:00
README.robots Bug 6411 add another example to README.robots 2011-07-05 14:48:05 +12:00
about.pl Bug 12721 - Syspref StatisticsFields: Warning on About page and text change in System preferences 2016-05-09 10:40:44 +02:00
changelanguage.pl Bug 9978: (followup) Replace license header with the correct license (GPLv3+) 2015-04-20 09:59:43 -03:00
edithelp.pl Bug 16447: Remove occurrence of the borrow permission which does no longer exist 2016-05-16 11:37:09 +02:00
fix-perl-path.PL Bug 9978: (followup) Replace license header with the correct license (GPLv3+) 2015-04-20 09:59:43 -03:00
help.pl Bug 14812: Display the help in the correct language 2015-10-02 15:06:08 -03:00
install-CPAN.pl Bug 9978: Replace license header with the correct license (GPLv3+) 2015-04-20 09:59:38 -03:00
koha_perl_deps.pl bug 10548: fix count of missing required dependencies by koha_perl_deps.pl 2013-07-11 14:03:32 +00:00
kohaversion.pl Bug 13758: Move the Koha version from kohaversion.pl 2015-05-07 11:39:04 -03:00
mainpage.pl Bug 10904: (QA followup) Use branch limit if either IndependentBranches or IndependentBranchesPatronModifications is enabled 2015-11-02 12:34:46 -03:00
rewrite-config.PL Bug 16222: (QA followup) Add /api dir for the API 2016-04-21 09:33:01 +02:00

README 

Koha is a free software integrated library system.

Koha is distributed under the GNU GPL version 3 or later.
Please read the file LICENSE for more details.

To install or upgrade Koha, please see the INSTALL file appropriate
to your platform.

Report bugs at http://bugs.koha-community.org/

Visit the Koha Project website at http://www.koha-community.org/