gitea
/
Koha-clms
1
0
Fork 0
Code Issues Pull Requests Packages Projects Releases Wiki Activity
45,092 Commits 39 Branches 720 Tags 6 GiB
Perl 44.2%
JavaScript 41.1%
HTML 6%
XSLT 3.1%
Vue 1.9%
Other 3.2%
Go to file
Michał Górny b552f4b469 Bug 34023: Prevent HTML injection in "back to results" link from search page 
It is possible inject raw HTML into the "Back to search results" link by leading the user to a search with specially crafted URL.

For example, using the demo instance:

1. Visit https://koha.adminkuhn.ch/cgi-bin/koha/opac-search.pl?idx=&q=test&weight_search=1&%22%3Etest%3Ca%20foo=%22

2. Refresh the page (for some reason, "back to results" doesn't appear unless I do that at least once).

3. Click any result.

Note that the result page now contains:

  <a href="opac-search.pl?idx=&amp;q=test&amp;weight_search=1&amp;">test<a foo=%22" title="...

i.e. `">test<a ...` was successfully injected into the HTML.

I'm attaching a quick patch I've used to patch up our instance.  It just indiscriminately URI-escapes all parameter keys.  I didn't decode them back since as far as I understand all valid keys do not contain special characters.

Signed-off-by: Jonathan Druart <jonathan.druart@bugs.koha-community.org>

Signed-off-by: Marcel de Rooy <m.de.rooy@rijksmuseum.nl>
Signed-off-by: Tomas Cohen Arazi <tomascohen@theke.io>
(cherry picked from commit 863d8fed15)
Signed-off-by: danyonsewell <danyonsewell@catalyst.net.nz>
 		2023-08-04 00:59:11 +00:00
C4 Bug 30524: Core CSRF checking code 2023-08-04 00:48:16 +00:00
Koha Bug 33238: Fix bad suggestions query (Bug 29886 follow-up) 2023-05-23 20:43:31 +02:00
acqui Bug 29607: Store the discount amount correctly when importing and order from a file 2023-04-05 12:06:03 +02:00
admin Bug 31695: Type standard number is missing field ci_raw in field_config.yaml 2023-05-23 20:43:31 +02:00
api Bug 29105: Add effective_itemtype handling to items api 2022-08-26 14:47:57 +02:00
authorities Bug 30250: Use ApplyFrameworkDefaults when importing a record 2023-02-17 13:53:36 +01:00
basket Bug 17600: Standardize our EXPORT_OK 2021-07-16 08:58:47 +02:00
bin
…
catalogue Bug 22605: Add ability to edit a search on staff interface 2022-10-19 05:07:19 +02:00
cataloguing Bug 33375: Quote reserved keyword 'rank' in advanced editor 2023-05-23 20:43:31 +02:00
circ Bug 31492: Set CSRF token in circulation.pl 2023-01-26 14:11:26 +01:00
clubs Bug 17600: Standardize our EXPORT_OK 2021-07-16 08:58:47 +02:00
course_reserves Bug 30840: Add support for barcode filters to course reserves 2022-06-21 15:40:30 +02:00
debian Bug 33629: allow pbuilder to use network via build-git-snapshot 2023-05-23 20:43:32 +02:00
docs Update release notes for 21.11.13 release 2022-10-23 00:28:54 +02:00
errors Bug 17600: Standardize our EXPORT_OK 2021-07-16 08:58:47 +02:00
etc Bug 32716: larger proxy_buffer_size in NGINX example config 2023-05-23 20:43:31 +02:00
ill Bug 22614: Migrate original request 2021-09-21 20:22:57 +02:00
installer Bug 31432: Make 245$n$p visible by default in frameworks 2023-05-23 20:43:31 +02:00
koha-tmpl Bug 22990: Add CSRF protection to boraccount, pay and suggestion 2023-08-04 00:58:33 +00:00
labels Bug 31482: Label creator does not call barcodedecode 2022-11-15 18:12:13 +01:00
lib/CGI/Session/Serialize Bug 17600: Standardize our EXPORT_OK 2021-07-16 08:58:47 +02:00
members Bug 22990: Add CSRF protection to boraccount, pay and suggestion 2023-08-04 00:58:33 +00:00
misc Update release notes for 21.11.21 release 2023-05-25 15:52:29 +02:00
offline_circ Bug 30525: Items batch modification broken 2022-04-22 14:29:43 -04:00
opac Bug 34023: Prevent HTML injection in "back to results" link from search page 2023-08-04 00:59:11 +00:00
patron_lists Bug 16446: Add ability to add patrons to list by borrowernumber 2021-10-21 12:24:04 +02:00
patroncards Bug 24001: Fix patron card template edition 2022-05-06 13:47:21 -04:00
plugins Bug 29787: Add plugin version to plugin search results 2022-04-15 06:36:54 -04:00
pos Bug 28481: (RM follow-up) formatting 2021-12-17 10:04:21 -05:00
reports Bug 27513: Add notes to variables for report parameters template 2023-05-23 20:43:30 +02:00
reserve Bug 33198: Don't calculate pickup locations per bib unless placing multiple holds 2023-05-03 20:39:47 +02:00
reviews Bug 17600: Standardize our EXPORT_OK 2021-07-16 08:58:47 +02:00
rotating_collections Bug 17600: Standardize our EXPORT_OK 2021-07-16 08:58:47 +02:00
serials Bug 29608: Made so doesn't require full permission 2022-11-14 14:31:53 +01:00
services Bug 17600: Standardize our EXPORT_OK 2021-07-16 08:58:47 +02:00
skel
…
suggestion Bug 22990: Add CSRF protection to boraccount, pay and suggestion 2023-08-04 00:58:33 +00:00
svc Bug 31682: Silence automatic linker warn 2022-12-14 15:32:21 +01:00
t Bug 30524: Core CSRF checking code 2023-08-04 00:48:16 +00:00
tags Bug 29469: (bug 17600 follow-up) Fix tag approval/rejection from staff 2021-11-16 15:49:22 +01:00
tools Bug 34368: Add CSRF token to Content Management pages 2023-08-04 00:50:43 +00:00
virtualshelves Bug 22990: Add CSRF protection to boraccount, pay and suggestion 2023-08-04 00:58:33 +00:00
xt Bug 32741: Regression tests 2023-02-17 13:08:30 +01:00
.editorconfig Bug 27375: Set YAML file settings in .editorconfig 2021-11-03 15:40:52 +01:00
.eslintrc.json
…
.gitignore
…
.htaccess
…
.mailmap 21.11.00 - Update .mailmap 2021-11-26 12:26:22 +01:00
.perlcriticrc Bug 25898: Prohibit indirect object notation 2020-10-15 12:56:30 +02:00
.proverc.dist Bug 19821: Install sample data, ES mappings and Version syspref 2021-10-25 11:27:40 +02:00
.scss-lint.yml
…
INSTALL Bug 26617: Update INSTALL file to include koha-testing-docker and Gitlab links 2020-10-15 12:56:30 +02:00
Koha.pm Increment version for Koha 21.11.21 release 2023-05-25 15:47:27 +02:00
LICENSE
…
MANIFEST.SKIP
…
Makefile.PL Bug 18984: Remove NORMARC support 2021-10-07 15:36:40 +02:00
README
…
README.md Bug 27092: Remove note about "synced repo" from README.md 2020-11-25 16:31:58 +01:00
README.robots
…
about.pl Bug 27667: Display a warning for records missing in Elasticsearch 2022-08-26 14:59:04 +02:00
app.psgi Bug 20582: Fix PSGI file when behind a reverse proxy 2020-10-06 12:00:04 +02:00
changelanguage.pl Bug 25898: Prohibit indirect object notation 2020-10-15 12:56:30 +02:00
cpanfile Bug 31588: Update cpanfile for new OpenAPI versions (21.11) 2022-12-16 14:42:00 +01:00
fix-perl-path.PL Bug 28606: Remove $DEBUG and $ENV{DEBUG} 2021-06-24 11:53:44 +02:00
gulpfile.js Bug 18984: Remove NORMARC support 2021-10-07 15:36:40 +02:00
help.pl Bug 17600: Standardize our EXPORT_OK 2021-07-16 08:58:47 +02:00
koha_perl_deps.pl Bug 17600: Standardize our EXPORT_OK 2021-07-16 08:58:47 +02:00
kohaversion.pl
…
mainpage.pl Bug 29020: Add link on the mainpage for users without admin access 2021-10-19 09:29:09 +02:00
package.json Bug 27939: Update yarn.lock file 2021-03-16 12:04:06 +01:00
rewrite-config.PL Bug 28519: Put CGI::Session::Serialize::yamlxs in lib directory 2021-06-17 10:07:36 +02:00
yarn.lock Bug 27939: Update yarn.lock file 2021-03-16 12:04:06 +01:00

README.md

Koha is a free software integrated library system (ILS).

Koha is distributed under the GNU GPL version 3 or later.

Note: Koha does not accept pull requests from git hosting sites.

Note: This project has its own bug tracker, to report a bug or submit a patch visit http://bugs.koha-community.org.

For guidelines on submitting patches for Koha please visit https://wiki.koha-community.org/wiki/SubmitingAPatch

The developers handbook can be found at https://wiki.koha-community.org/wiki/Developer_handbook

http://koha-community.org/

Koha Logo