Kyle M Hall 4c81c3262e Bug 33339: Prevent Formula Injection (CSV Injection) in CSV files ... The system is vulnerable to Formula Injection attacks as the data stored within the database and exported as CSV/Excel is not being sanitized or validated against implanted formula payloads This patch modifies all uses of Text::CSV and derived classes to pass the "formula" parameter with value of "empty" which replaces formulas by empty string. Test Plan: 1) Apply this patch 2) For guided_reports.pl, attempt to export CSV where you've set a column to a formula somehow ( such as "=1+3" ) 3) Export that CSV file 4) Note the formula has not been exported 5) Repeat this plan for the remaining scripts that export CSV files where users can define the outputted data Signed-off-by: Magnus Enger <magnus@libriotech.no> Fixed two conflicts. I have tested that this works as advertised on: - Reports (Download > Comma separated text (.csv)) [Text::CSV::Encoded] - Circulation > Overdues > Download file of all overdues [Text::CSV_XS] - misc/export_borrowers.pl [Text::CSV] This covers all modules used, and both GUI and command line. Signed-off-by: Chris Cormack <chris@bigballofwax.co.nz> Signed-off-by: Marcel de Rooy <m.de.rooy@rijksmuseum.nl> [EDIT] Change none to empty in the commit message ! None is the default, doing nothing. Empty clears the formulas. Signed-off-by: wainuiwitikapark <wainuiwitikapark@catalyst.net.nz> (cherry picked from commit 96152682bf) Signed-off-by: Lucas Gass <lucas@bywatersolutions.com>		2024-11-07 23:29:11 +00:00
..
Account	Bug 32894: Remove wrong caching from Koha:: methods - simple	2023-07-12 09:10:16 +00:00
Acquisition	Bug 33653: Use filter_by_active instead	2023-05-15 12:06:44 +00:00
App	…
ArticleRequest	…
Auth	Bug 30843: Add mfa_range configuration option for TOTP	2023-10-17 16:56:21 +00:00
Authority	…
BackgroundJob	Bug 34789: Update usage throughout Koha modules and Vue components	2023-10-12 15:45:38 +00:00
Biblio	Bug 33270: (QA follow-up) Do not change param hashref	2023-07-19 10:14:24 +00:00
BiblioUtils	…
Cache	…
Cash	…
Charges	…
Checkouts	Bug 33362: Allow return claims to be resolved even if the issue has since been delete from the database	2023-06-08 17:15:33 +00:00
Club	…
CodeList/Unimarc	…
Config	Bug 32478: Remove Koha::Config::SysPref->find since bypasses cache	2023-07-18 08:55:38 +00:00
Course	…
Database	Bug 32312: Add missing column descriptions to the statistics table	2023-11-13 15:28:45 +00:00
ERM	Bug 34789: Update usage throughout Koha modules and Vue components	2023-10-12 15:45:38 +00:00
Edifact	Bug 35173: Correctly concat error strings	2023-11-13 15:22:16 +00:00
Exceptions	Bug 37018: Add Koha::Exceptions::REST	2024-07-23 12:46:35 +02:00
Exporter	…
ExternalContent	Bug 33697: Remove RecordedBooks (rbdigital) integration	2023-06-12 10:28:24 +00:00
Filter/MARC	Bug 32464: Koha::Item->as_marc_field obsolete option mss	2023-06-12 11:42:33 +00:00
Hold	…
Illrequest	Bug 32799: Rename ILLSTATUS authorised value category to ILL_STATUS_ALIAS	2023-03-01 15:38:27 +00:00
Import	Bug 32437: (QA follow-up) Change to replace POD	2023-04-16 17:48:11 +01:00
Indexer	…
Item	Bug 24606: (QA follow-up) Add test for encoding/decoding	2022-11-18 12:04:27 -03:00
Library	Bug 32894: Remove wrong caching from Koha:: methods - simple	2023-07-12 09:10:16 +00:00
List	…
MetadataRecord	…
Middleware	Bug 36149: (follow-up) POD and tidy	2024-04-24 10:49:47 +00:00
Misc	…
Notice	…
Number	…
OAI/Server	Bug 34467: OAI GetRecord bad encoding for Unimarc	2023-10-17 17:35:41 +00:00
Object	Bug 32894: Remove wrong caching from Koha:: methods - simple	2023-07-12 09:10:16 +00:00
Objects	Bug 33329: Correctly handle UNIMARC encoding for biblios	2023-05-12 15:35:38 +01:00
Old	Bug 34609: Add biblio method to Old::Hold	2023-09-08 09:47:27 +00:00
Patron	Bug 34731: (follow-up) Fix conditional variable declaration	2023-11-13 14:28:51 +00:00
Patrons	Bug 33339: Prevent Formula Injection (CSV Injection) in CSV files	2024-11-07 23:29:11 +00:00
Plugins	Bug 29672: Clear cache of enabled plugins when a plugin's state change	2022-11-03 11:28:16 -03:00
REST	Bug 36937: Remove warning from unit tests	2024-10-07 19:03:03 +02:00
RecordProcessor	…
Result	…
SMS	…
SMTP	…
Schema	Bug 35180: DBIC schema	2023-11-13 15:28:48 +00:00
SearchEngine	Bug 36879: Spurious warning in QueryBuilder	2024-10-07 19:20:19 +02:00
Serial	…
Sitemapper	…
Subscription	…
SuggestionEngine	…
Tags	…
Template/Plugin	Bug 30524: (QA follow-up) Only generate CSRF token if it will be used	2023-07-28 11:15:08 +00:00
UI	Bug 34266: Default to biblioitems.itemtype only if it's a valid itemtype	2023-09-15 09:33:04 +00:00
Util	…
XSLT	Bug 12758: Add new module call in Koha::XSLT::Base	2022-11-09 09:52:25 -03:00
Z3950Responder	…
pdfformat	Bug 33340: Correct formatting of English 1-page order PDF when it covers multiple pages	2023-06-07 12:18:10 +00:00
Account.pm	Bug 34620: Do not throw expection if payment type is writeoff	2023-09-15 09:33:08 +00:00
ActionLog.pm	…
ActionLogs.pm	…
AdditionalContent.pm	…
AdditionalContents.pm	…
AdditionalField.pm	…
AdditionalFieldValue.pm	…
AdditionalFieldValues.pm	…
AdditionalFields.pm	…
AdvancedEditorMacro.pm	…
AdvancedEditorMacros.pm	…
ApiKey.pm	…
ApiKeys.pm	…
ArticleRequest.pm	Bug 32894: (QA follow-up) Fix typo	2023-07-12 09:10:19 +00:00
ArticleRequests.pm	…
AudioAlert.pm	…
AudioAlerts.pm	…
AuthUtils.pm	Bug 33341: Address some perlcritic errors in 5.36	2023-04-11 10:54:27 +00:00
AuthorisedValue.pm	Bug 30920: (follow-up) Flush on delete	2023-03-14 10:10:44 +00:00
AuthorisedValueCategories.pm	…
AuthorisedValueCategory.pm	Bug 32997: Add REST API endpoint to list authorised values for multiple given categories	2023-03-03 12:10:59 +00:00
AuthorisedValues.pm	Bug 34051: Cache empty hashref for non-existent authorised values	2023-07-18 10:31:49 +00:00
Authorities.pm	Bug 33083: Add a generic class to handle methods for collections of records	2023-03-21 09:33:58 +00:00
Authority.pm	Bug 35343: Add record accessor method to Koha::Authority	2023-11-16 09:09:25 +00:00
BackgroundJob.pm	Bug 34990: Add persistent header when sending msg to RabbitMQ	2023-11-13 14:19:27 +00:00
BackgroundJobs.pm	Bug 31969: Use filter_by_last_update	2022-11-25 09:40:09 -03:00
Biblio.pm	Revert "Bug 33496: Add 'host_items' param to Koha::Biblio->items"	2023-07-19 10:52:40 +01:00
BiblioFramework.pm	…
BiblioFrameworks.pm	…
BiblioUtils.pm	…
Biblioitem.pm	…
Biblioitems.pm	…
Biblios.pm	Bug 33974: (follow-up) biblionumber column needs special handling	2023-07-18 14:44:58 +00:00
Cache.pm	…
Caches.pm	…
Calendar.pm	Bug 27249: Prevent infinite loop when searching for an open day	2023-11-13 13:45:36 +00:00
Checkout.pm	…
Checkouts.pm	…
CirculationRule.pm	Bug 32894: Remove wrong caching from Koha:: methods - simple	2023-07-12 09:10:16 +00:00
CirculationRules.pm	Bug 32271: (QA follow-up) Correction to 'can_be_blank' logic	2023-08-18 10:36:12 +00:00
Cities.pm	…
City.pm	…
ClassSortRule.pm	…
ClassSortRules.pm	…
ClassSource.pm	Bug 30920: (follow-up) Flush on delete	2023-03-14 10:10:44 +00:00
ClassSources.pm	…
ClassSplitRule.pm	…
ClassSplitRules.pm	…
Club.pm	…
Clubs.pm	…
Config.pm	Bug 31393: Koha::Config: handle the special case for 'content' attribute	2023-11-13 15:28:46 +00:00
CookieManager.pm	…
Course.pm	…
Courses.pm	…
CoverImage.pm	…
CoverImages.pm	…
CsvProfile.pm	…
CsvProfiles.pm	…
CurbsidePickup.pm	…
CurbsidePickupIssue.pm	…
CurbsidePickupIssues.pm	…
CurbsidePickupOpeningSlot.pm	…
CurbsidePickupOpeningSlots.pm	…
CurbsidePickupPolicies.pm	…
CurbsidePickupPolicy.pm	Bug 32891: Fix slot selection in last hour	2023-02-24 11:11:09 +00:00
CurbsidePickups.pm	…
Database.pm	…
DateUtils.pm	Bug 33611: Ensure dt_from_string always returns a new object	2023-05-15 10:34:22 +00:00
Desk.pm	…
Desks.pm	…
EDI.pm	Bug 28672: (QA follow-up) Method calls cannot be interpolated directly	2023-02-09 12:08:00 -01:00
Edifact.pm	…
Email.pm	…
Encryption.pm	Bug 33934: Add more detail to 'No encryption_key in koha-conf.xml'	2023-06-12 11:53:36 +00:00
Exception.pm	…
Exceptions.pm	Bug 31378: Add 'parameter' parameter to Koha::Exceptions::MissingParameter	2022-11-08 14:31:15 -03:00
ExternalContent.pm	…
FrameworkPlugin.pm	Bug 37146: Prevent path traversal by validating input	2024-07-23 10:13:59 +02:00
Hold.pm	Bug 34333: Add Koha::Hold->cancellation_requested	2023-10-12 16:00:19 +00:00
Holds.pm	Bug 32529: Add Koha::Holds->filter_by_found	2023-01-13 15:51:33 +00:00
I18N.pm	Bug 35174: Do not explode if po dir does not exist	2023-11-22 09:36:47 +01:00
Illbackend.pm	Bug 34223: (follow-up) Ensure consistent ordering of statuses	2023-09-15 10:19:57 +00:00
Illcomment.pm	…
Illcomments.pm	…
Illrequest.pm	Bug 35105: Fix patron accessor in Illrequest.pm	2023-11-13 14:28:49 +00:00
Illrequestattribute.pm	Bug 22440: Add standard accessors for later usage	2023-05-12 08:16:29 +01:00
Illrequestattributes.pm	Bug 22440: New ILL requests table	2023-05-12 08:16:29 +01:00
Illrequests.pm	Bug 22440: Add Koha::Illrequests->filter_by_visible	2023-05-12 08:16:28 +01:00
ImportBatch.pm	…
ImportBatchProfile.pm	…
ImportBatchProfiles.pm	…
ImportBatches.pm	…
Item.pm	Bug 35167: Make 'effective_not_for_loan_status' fallback to 0 if itype has it undef	2023-11-13 15:10:52 +00:00
ItemType.pm	Bug 30920: (follow-up) Flush on delete	2023-03-14 10:10:44 +00:00
ItemTypes.pm	…
Items.pm	Bug 31105: Holds to pull counts items from other branches when independentbranches is active	2022-09-23 09:44:18 -03:00
KeyboardShortcut.pm	…
KeyboardShortcuts.pm	…
Libraries.pm	…
Library.pm	Bug 30920: (follow-up) Flush on delete	2023-03-14 10:10:44 +00:00
Linktracker.pm	…
Localization.pm	Bug 30920: (follow-up) Flush on delete	2023-03-14 10:10:44 +00:00
Localizations.pm	…
Logger.pm	Bug 33020: (QA follow-up) POD and chmod	2023-03-01 09:29:07 +00:00
Manual.pm	Bug 33790: Fix and add various links to the manual	2023-07-18 13:45:58 +00:00
MarcOverlayRule.pm	…
MarcOverlayRules.pm	…
MarcSubfieldStructure.pm	…
MarcSubfieldStructures.pm	…
MessageAttribute.pm	…
MessageAttributes.pm	…
MetaSearcher.pm	…
MetadataIterator.pm	…
MetadataRecord.pm	…
MoreUtils.pm	…
OAuth.pm	…
OAuthAccessToken.pm	…
OAuthAccessTokens.pm	…
Object.pm	Bug 33161: (follow-up) Remove stray variables and fix POD	2023-03-20 16:49:42 +00:00
Objects.pm	…
Patron.pm	Bug 19613: Use the 'note' profile	2024-04-24 10:36:37 +00:00
Patrons.pm	Bug 31937: Fix Patrons::search_unsubscribed - sharpen condition	2022-11-17 13:41:24 -03:00
Plugins.pm	Bug 29672: (QA follow-up) Add POD	2022-11-03 11:29:43 -03:00
ProblemReport.pm	…
ProblemReports.pm	…
PseudonymizedTransaction.pm	…
PseudonymizedTransactions.pm	…
Quote.pm	…
Quotes.pm	…
RDF.pm	…
Rating.pm	…
Ratings.pm	…
Recall.pm	Bug 18398: Update C4::Message enqueue to use $patron->notice_email_address	2023-05-09 21:33:44 +01:00
Recalls.pm	Bug 31147: Recalls should not adjust due time for related checkouts	2023-07-18 14:23:19 +00:00
RecordProcessor.pm	…
Report.pm	Bug 37508: (QA follow-up) Move check to Koha::Report, extend	2024-08-13 11:54:03 -03:00
Reports.pm	…
Review.pm	…
Reviews.pm	…
Schema.pm	…
Script.pm	…
SearchEngine.pm	…
SearchField.pm	…
SearchFields.pm	…
SearchFilter.pm	Bug 17170: (QA follow-up) Spec cleanup	2022-10-21 11:15:22 -03:00
SearchFilters.pm	Bug 17170: DB Updates	2022-10-21 11:15:13 -03:00
SearchMarcMap.pm	…
SearchMarcMaps.pm	…
Serial.pm	…
Serials.pm	…
Session.pm	Bug 36098: Default to 'file' if pref does not exist	2024-04-03 08:04:40 +00:00
SharedContent.pm	…
SimpleMARC.pm	Bug 31644: Check if subfield defined, not for truth	2022-10-24 11:53:18 -03:00
Sitemapper.pm	…
Statistic.pm	…
Statistics.pm	…
StockRotationItem.pm	…
StockRotationItems.pm	…
StockRotationRota.pm	…
StockRotationRotas.pm	…
StockRotationStage.pm	…
StockRotationStages.pm	…
Subscription.pm	…
Subscriptions.pm	…
Suggestion.pm	Bug 32942: (follow-up) Restore missing statuses	2023-10-12 16:00:24 +00:00
SuggestionEngine.pm	…
Suggestions.pm	Bug 33238: Fix bad suggestions query (Bug 29886 follow-up)	2023-04-18 12:21:47 +00:00
Tag.pm	…
Tags.pm	…
Token.pm	Bug 34755: Backport Koha::Token change from bug 34478	2024-04-03 08:08:47 +00:00
TrackedLink.pm	…
TrackedLinks.pm	…
UploadedFile.pm	…
UploadedFiles.pm	…
Uploader.pm	Bug 36818: Escape characters in file names uploaded	2024-05-29 08:01:58 +00:00
Virtualshelf.pm	Bug 32894: Remove wrong caching from Koha:: methods - simple	2023-07-12 09:10:16 +00:00
Virtualshelfcontent.pm	…
Virtualshelfcontents.pm	…
Virtualshelfshare.pm	Bug 32894: Make ->sharee looks like others	2023-07-12 09:10:19 +00:00
Virtualshelfshares.pm	…
Virtualshelves.pm	…
Z3950Responder.pm	…
Z3950Server.pm	…
Z3950Servers.pm	…