gitea
/
Koha-clms
1
0
Fork 0
Code Issues Pull Requests Packages Projects Releases Wiki Activity
28,665 Commits 39 Branches 720 Tags 6 GiB
Perl 44.2%
JavaScript 41.1%
HTML 6%
XSLT 3.1%
Vue 1.9%
Other 3.2%
Go to file
Amit Gupta aa628f89fd Bug 19127 - Stored XSS in csv-profiles.pl 
To Test
1. Hit the page /cgi-bin/koha/tools/csv-profiles.pl?op=add_form
2. Add a text in the field Profile name, Profile description
   and Profile MARC fields that contains js
3. Save the page.
4. Notice js is execute
5. Apply patch and reload, the js is escaped

Signed-off-by: Katrin Fischer <katrin.fischer.83@web.de>

Signed-off-by: Marcel de Rooy <m.de.rooy@rijksmuseum.nl>

Signed-off-by: Jonathan Druart <jonathan.druart@bugs.koha-community.org>
(cherry picked from commit 7a3ee2dd8cb233d083d8a7b8636eca7c6d518b8b)
Signed-off-by: Fridolin Somers <fridolin.somers@biblibre.com>
(cherry picked from commit 9b4777878f)
Signed-off-by: Katrin Fischer <katrin.fischer.83@web.de>
 		2017-09-19 23:15:10 +02:00
C4 Bug 18927: Use fully qualified subroutine names in C4::Items 2017-09-16 08:52:59 +02:00
Koha Bug 18900: wrong number format in receiving order 2017-09-16 01:23:53 +02:00
OpenILS
…
acqui Bug 18716: Remove CGI::param warns from updatesupplier.pl 2017-06-13 08:02:08 +02:00
admin Bug 18906: Display all funds the logged in user can use 2017-09-16 01:22:30 +02:00
api/v1 Bug 17086: Reword borrowers to patrons in Swagger tags for holds 2016-11-22 11:31:08 +00:00
authorities Bug 18019: [QA Follow-up] Also catch the delete from authorities detail 2017-04-02 19:18:25 +02:00
basket Bug 18124: Change the calls to generate and check CSRF tokens 2017-04-02 18:03:53 +02:00
catalogue Bug 18854 - Protect from DOS 2017-07-19 23:17:49 +02:00
cataloguing Bug 17922: Use correct number of digits when replacing date placeholders 2017-02-07 22:18:39 +01:00
circ Bug 19053: Keep auto_renew flag if a confirmation is needed 2017-09-10 10:58:16 +02:00
course_reserves Bug 18367 - (QA Followup) Only warn if doing a lookup and not having an item 2017-08-01 07:56:28 +02:00
debian Bug 18554: Adjust a few typos including responsability 2017-07-16 14:47:24 +02:00
docs Bug 7143: [QA Follow-up] Handling tabs 2017-01-22 20:29:05 +01:00
errors
…
etc Bug 18669 - RewriteCond affecting wrong rule in koha-httpd.conf 2017-06-05 14:54:35 +02:00
installer Bug 18741: Fix loading of SQL files in web installer 2017-09-10 11:16:25 +02:00
koha-tmpl Bug 19127 - Stored XSS in csv-profiles.pl 2017-09-19 23:15:10 +02:00
labels Bug 18535 - Clicking 'edit printer profile' in label creator causes software error 2017-05-14 11:52:51 +02:00
members Bug 19079 - XSS Flaws in Membership page 2017-08-20 15:47:21 +02:00
misc Bug 18927: Use fully qualified subroutine names in C4::Items 2017-09-16 08:52:59 +02:00
offline_circ Bug 15902 [QA Followup] - Use Koha::Patrons instead of Koha::Borrowers 2016-09-27 13:53:23 +00:00
opac Bug 16711: OPAC Password recovery: Handling if multiple accounts have the same mail address 2017-08-01 07:18:50 +02:00
patron_lists
…
patroncards Bug 17181: Simplify code 2017-06-28 07:49:04 +02:00
plugins Bug 16586: Koha Plugins: Limit results of GetPlugins by metadata 2016-09-09 12:13:39 +00:00
reports Bug 18898 - Some permissions for Reports can be bypassed 2017-09-16 01:20:13 +02:00
reserve Bug 15758: Koha::Libraries - Remove GetBranches 2016-09-08 14:36:03 +00:00
reviews Bug 15839: Koha::Reviews - Remove C4::Review residue 2016-09-09 10:31:00 +00:00
rotating_collections Bug 15758: Koha::Libraries - Remove GetBranches 2016-09-08 14:36:03 +00:00
serials Bug 18536: [QA Follow-up] Tiny regex simplification 2017-05-21 23:25:47 +02:00
services
…
skel
…
sms
…
suggestion Bug 18839: Suggestion.pl spelling mistake 2017-08-01 07:27:54 +02:00
svc Bug 17375: Search by dateofbirth - handle invalid dates 2016-10-27 13:18:32 +00:00
t Bug 18900: (QA followup) Make tests conditional to locale existence 2017-09-16 01:23:41 +02:00
tags
…
test
…
tmp/modified_authorities
…
tools Bug 19023 - inventory tool performance 2017-09-16 08:54:48 +02:00
virtualshelves Bug 15584 - Staff client list errors are incorrectly styled 2017-02-14 22:26:18 +01:00
xt Bug 18746: Add license and remove diag 2017-06-13 07:55:27 +02:00
.editorconfig
…
.htaccess
…
.mailmap Update mailmap - Jonathan Druart 2017-06-29 22:39:52 +02:00
INSTALL Bug 17626: Remove existing install instructions and link to the wiki pages instead 2016-11-22 11:29:07 +00:00
Koha.pm Increment version for 16.11.11 security release 2017-08-23 19:51:09 +02:00
LICENSE
…
MANIFEST.SKIP
…
Makefile.PL Bug 18373: Re-add UpgradeBackup.pm 2017-04-16 14:28:39 +02:00
README
…
README.md Bug 15465: Fix typo in bugs.k-c.org 2017-06-05 14:20:54 +02:00
README.robots
…
about.pl Bug 18931 - Follow up - Typo fix in SQL statement 2017-07-28 01:12:13 +02:00
changelanguage.pl
…
edithelp.pl
…
fix-perl-path.PL
…
help.pl
…
install-CPAN.pl
…
koha_perl_deps.pl
…
kohaversion.pl
…
mainpage.pl Bug 14610 - Add and update scripts 2016-10-26 12:15:14 +00:00
rewrite-config.PL
…

README.md

Koha is a free software integrated library system (ILS).

Koha is distributed under the GNU GPL version 3 or later.

Note: This is a synced mirror of the official Koha repo.

Note: Koha does not accept pull requests from git hosting sites.

Note: This project has its own bug tracker, to report a bug or submit a patch visit http://bugs.koha-community.org.

For guidelines on submitting patches for Koha please visit https://wiki.koha-community.org/wiki/SubmitingAPatch

The developers handbook can be found at https://wiki.koha-community.org/wiki/Developer_handbook

http://koha-community.org/

Koha Logo