gitea
/
Koha-clms
1
0
Fork 0
Code Issues Pull Requests Packages Projects Releases Wiki Activity
60,006 Commits 39 Branches 720 Tags 6 GiB
Perl 44.2%
JavaScript 41.1%
HTML 6%
XSLT 3.1%
Vue 1.9%
Other 3.2%
Go to file
David Cook b6ec792aa5
Bug 41591: Prevent inline rendering of invoice files 
This patch forces download of invoice files rather than showing
them inline where they can potentially perform XSS

Test plan:
0. Apply the patch
1. koha-plack --restart kohadev
2. Find or create an active vendor
3. Create a basket if one doesn't already exist
4. Receive a shipment for the vendor
5. Create an invoice
6. Go to the invoice
7. In the URL change invoice.pl to invoice-files.pl
(or turn on AcqEnableFiles and go to it that way)
8. Upload an image file (e.g. SVG) or PDF
9. Click on the filename
10. Note that instead of displaying in the browser,
the file will be downloaded

Signed-off-by: Jonathan Druart <jonathan.druart@bugs.koha-community.org>

Signed-off-by: Marcel de Rooy <m.de.rooy@rijksmuseum.nl>
Signed-off-by: Chloé Zermatten <chloe.zermatten@openfifth.co.uk>
 		2026-02-23 16:41:31 +00:00
.github/workflows Bug 40027: Use GitHub workflow to automatically close PRs opened on the Koha repo there 2025-10-06 09:15:26 -06:00
C4 Bug 40719: Explicitly disable off RELATIVE file paths for plugins for user-entered templates 2026-02-16 15:24:10 +00:00
Koha Bug 40719: Explicitly turn off RELATIVE for TemplateUtils 2026-02-16 15:24:12 +00:00
acqui Bug 41591: Prevent inline rendering of invoice files 2026-02-23 16:41:31 +00:00
admin Bug 41334: Move modified_holds tables column settings under Tools section 2026-02-16 14:17:29 +00:00
api Bug 29668: Add API route to add a basket 2026-02-16 14:45:29 +00:00
authorities Bug 40163: Fix several http addresses in the code docs 2025-09-23 16:21:29 -06:00
basket Bug 40163: Fix several http addresses in the code docs 2025-09-23 16:21:29 -06:00
bin Bug 40163: (follow-up) Fix wrong GNU links and update test 2025-09-24 09:25:04 -06:00
bookings Bug 40163: Fix several http addresses in the code docs 2025-09-23 16:21:29 -06:00
catalogue Bug 40777: Flatten arrays 2026-02-16 14:34:32 +00:00
cataloguing Bug 29733: MARC21: Link 7xx linking fields to marc21_linking_section.pl value builder 2025-11-07 10:54:14 -07:00
circ Bug 41229: Fix desk and register session persistence on library change 2025-12-01 08:34:05 -07:00
clubs Bug 40163: Fix several http addresses in the code docs 2025-09-23 16:21:29 -06:00
course_reserves Bug 40163: Fix several http addresses in the code docs 2025-09-23 16:21:29 -06:00
debian Bug 27115: Use start-stop-daemon to stop in koha-sip 2026-02-16 14:14:14 +00:00
docs 25.11.00: Update history.txt 2025-12-05 13:31:39 -07:00
erm Bug 40163: Fix several http addresses in the code docs 2025-09-23 16:21:29 -06:00
errors Bug 28146: Respect ReplytoDefault in error pages 2025-10-09 14:58:41 -06:00
etc Bug 41032: Fix Open Fifth missing in plugin repos config 2025-11-26 10:40:25 -07:00
ill Bug 41009: Return to 'Manage request' page after editing 2026-02-16 15:21:28 +00:00
installer Bug 38876: (Rmaint follow-up) remove redundant atomic update file 2026-02-04 10:15:22 +00:00
koha-tmpl Bug 41591: Prevent inline rendering of invoice files 2026-02-23 16:41:31 +00:00
labels Bug 40163: Fix several http addresses in the code docs 2025-09-23 16:21:29 -06:00
lib Bug 38664: Tidy the whole codebase 2025-02-11 14:58:24 +01:00
members Bug 39014: (follow-up) Refactoring and renaming to can_be_guaranteed_by 2026-01-16 17:10:49 +00:00
misc Bug 40777: Move all biblio tests to the new package 2026-02-16 14:34:26 +00:00
offline_circ Bug 40163: Fix several http addresses in the code docs 2025-09-23 16:21:29 -06:00
opac Bug 41237: (QA follow-up): Utilize available logged in user object 2026-02-16 14:44:16 +00:00
patron_lists Bug 32176: Remove duplicated code to select patron from autocomplete 2025-10-31 15:26:25 -06:00
patroncards Bug 40163: Fix several http addresses in the code docs 2025-09-23 16:21:29 -06:00
plugins Bug 25952: Skip invalid repositories when searching for plugins 2025-11-21 08:41:52 -07:00
pos Bug 40625: Fix duplicate cashup records via POST/REDIRECT/GET pattern 2025-09-26 10:37:00 -06:00
preservation Bug 40163: Fix several http addresses in the code docs 2025-09-23 16:21:29 -06:00
recalls Bug 40163: Fix several http addresses in the code docs 2025-09-23 16:21:29 -06:00
reports Bug 40287: Fix untranslatable strings in more statistics wizards 2026-01-16 15:54:33 +00:00
reserve Bug 41416: Add skip_fix_priority option to ModReserve 2026-02-16 14:18:54 +00:00
reviews Bug 40163: Fix several http addresses in the code docs 2025-09-23 16:21:29 -06:00
rotating_collections Bug 40163: Fix several http addresses in the code docs 2025-09-23 16:21:29 -06:00
serials Bug 37796: (follow-up) Correct call in showpredictionpattern.pl 2026-01-16 12:59:57 +00:00
services Bug 40163: Fix several http addresses in the code docs 2025-09-23 16:21:29 -06:00
sip2 Bug 37893: Fix http links 2025-11-18 11:21:20 -07:00
skel
…
suggestion (RMaint follow up): make suggestion.pl & opac-patron-consent.pl executable 2026-01-29 15:29:00 +00:00
svc Bug 40680: Fix svc/virtualshelves/search 2025-12-01 08:33:59 -07:00
t Bug 39584: Add Cypress tests for bookings lead and trail period behavior 2026-02-18 13:39:36 +00:00
tags Bug 40163: Fix several http addresses in the code docs 2025-09-23 16:21:29 -06:00
tools Bug 41438: Do not always unsuspend holds when using batch modify holds tool 2026-02-16 14:16:10 +00:00
virtualshelves Bug 40916: Fix another occurance 2025-10-06 09:15:22 -06:00
xt Bug 41167: Add test to compare both apache conf 2025-11-17 15:15:52 -07:00
.codespell-ignore Bug 40950: Add 'falsy' programming idiom to codespell dictionary 2025-10-06 09:15:23 -06:00
.editorconfig
…
.git-blame-ignore-revs Bug 39096: Add 'tidy all' commits to a git blame ignore file 2025-02-17 13:10:25 +01:00
.gitignore Bug 40838: Add generated bookings CSS assets to gitignore 2025-09-19 08:42:47 -06:00
.htaccess
…
.mailmap Bug 40041: (follow-up) Fix periods and add Robert Fox 2025-12-05 09:29:04 -07:00
.perlcriticrc
…
.perltidyrc
…
.prettierrc.js Bug 38664: Treat .vue files like other JS files 2025-02-11 14:58:25 +01:00
.proverc.dist
…
.stylelintrc.json
…
INSTALL
…
Koha.pm Bug 38876: DBRev 25.11.01.003 2026-02-03 13:42:37 +00:00
LICENSE Bug 40163: Fix several http addresses in the code docs 2025-09-23 16:21:29 -06:00
MANIFEST.SKIP
…
Makefile.PL Bug 37893: SIP2 VueJS module scaffolding 2025-11-18 11:20:45 -07:00
README
…
README.md Bug 40163: Fix several http addresses in the code docs 2025-09-23 16:21:29 -06:00
README.robots
…
SECURITY.md Bug 40527: Initial draft of SECURITY.md 2025-10-09 14:58:41 -06:00
about.pl Bug 40163: Fix several http addresses in the code docs 2025-09-23 16:21:29 -06:00
app.psgi Bug 40163: (follow-up) Fix wrong GNU links and update test 2025-09-24 09:25:04 -06:00
build-resources.PL Bug 40163: (follow-up) Fix wrong GNU links and update test 2025-09-24 09:25:04 -06:00
changelanguage.pl Bug 40163: Fix several http addresses in the code docs 2025-09-23 16:21:29 -06:00
cpanfile Bug 40663: Update GD::Barcode::QRcode to v2.01 2025-09-05 15:10:34 -06:00
cypress.config.ts Bug 41362: Allow Cypress tests to use KOHA_USER and KOHA_PASS as override 2026-02-03 11:59:44 +00:00
eslint.config.mjs
…
fix-perl-path.PL Bug 40163: (follow-up) Fix wrong GNU links and update test 2025-09-24 09:25:04 -06:00
gulpfile.js Bug 41327: Silence Sass deprecation warnings 2026-02-16 14:19:57 +00:00
help.pl Bug 40163: Fix several http addresses in the code docs 2025-09-23 16:21:29 -06:00
kohaversion.pl Bug 38664: Tidy the whole codebase 2025-02-11 14:58:24 +01:00
mainpage.pl Bug 40163: Fix several http addresses in the code docs 2025-09-23 16:21:29 -06:00
package.json Bug 41329: Add datatables.net@^1.13.1 jquery@^3.6.0 2026-02-03 11:57:28 +00:00
rewrite-config.PL Bug 40163: (follow-up) Fix wrong GNU links and update test 2025-09-24 09:25:04 -06:00
rspack.config.js Bug 36674: (follow-up) Stop emitting Cypress API client source maps 2025-12-02 10:07:13 -07:00
tsconfig.json
…
yarn.lock Bug 41329: Update yarn.lock 2026-02-03 12:52:55 +00:00

README.md

Koha is a free software integrated library system (ILS).

Koha is distributed under the GNU GPL version 3 or later.

Note: Koha does not accept pull requests from git hosting sites.

Note: This project has its own bug tracker, to report a bug or submit a patch visit https://bugs.koha-community.org.

For guidelines on submitting patches for Koha please visit https://wiki.koha-community.org/wiki/SubmitingAPatch

The developers handbook can be found at https://wiki.koha-community.org/wiki/Developer_handbook

https://koha-community.org/

Koha Logo