gitea
/
Koha-clms
1
0
Fork 0
Code Issues Pull Requests Packages Projects Releases Wiki Activity
51,136 Commits 39 Branches 720 Tags 6 GiB
Perl 44.2%
JavaScript 41.1%
HTML 6%
XSLT 3.1%
Vue 1.9%
Other 3.2%
Go to file
Phil Ringnalda bc8238fcbd Bug 37655: Basic editor needs to HTML-escape the bib record title used as a heading 
We stick the title of a bib record you are editing in the basic editor into
an <h1> without escaping any HTML it might contain. We should instead escape
it.

Test plan:

1. Without the patch, search for any record in the catalog and click Edit
   record (if you are in the advanced editor, switch to the basic one)
2. Tab 2, Field 245, Subfield a, paste <script>alert('boo ❤')</script><h2>
   at the end of the subfield
3. Save, then from the record detail page select Edit - Edit record
4. You will have gotten an alert(), and the entire form will be the size
   of an <h2>. That's ugly, so go back to the detail page.
5. Apply patch, restart_all
6. Edit - Edit record
7. Now you should not get an alert, the whole title inluding the <script>
   should display in italics, and the "(Record number nnn)" after it should
   not be italicized.

Signed-off-by: David Cook <dcook@prosentient.com.au>
Signed-off-by: wainuiwitikapark <wainuiwitikapark@catalyst.net.nz>
 		2024-09-11 05:00:41 +00:00
C4 Bug 37508: (QA follow-up) Move sth error check up 2024-08-13 11:05:37 -03:00
Koha Bug 37508: (QA follow-up) Move check to Koha::Report, extend 2024-08-13 11:05:35 -03:00
acqui Bug 35927: Selecting MARC framework again doesn't work when adding to basket from an external source 2024-05-30 19:10:54 +00:00
admin Bug 33099: Add missing MARC21 Match authority mappings so "Search all headings" search works 2024-05-30 19:29:19 +00:00
api Bug 37018: Add 400 response definition to all routes 2024-07-23 04:42:52 +00:00
authorities Bug 36792: Limit POSIX imports 2024-05-31 15:56:28 +00:00
basket Bug 34731: Don't call SendQueuedMessages if message_id is bad 2023-09-14 07:54:48 -10:00
bin
…
catalogue Bug 36834: (Bug 29697 follow-up) Koha explodes when trying to open in Labeled MARC view a bibliographic record with an invalid biblionumber 2024-05-31 13:11:16 +00:00
cataloguing Bug 36792: Limit POSIX imports 2024-05-31 15:56:28 +00:00
circ Bug 37210: Properly escape SQL query parameters by using bind values 2024-07-23 23:16:39 +00:00
clubs Bug 30718: Use flatpickr's altInput 2022-08-19 08:26:31 -03:00
course_reserves Bug 20256: Use new methods 2023-02-02 11:59:26 -03:00
debian Bug 36531: Serve text/javascript compressed, like application/javascript is 2024-05-28 17:46:35 +00:00
docs Bug 35504: Corrections to wiki team 2024-02-02 16:16:48 +00:00
erm Bug 32922: Remove space in shebang 2023-02-20 09:44:06 -03:00
errors
…
etc Bug 34041: (follow-up) escape double dashes to prevent issues 2024-05-30 19:07:54 +00:00
ill Bug 28909: Allow illview to use backend template 2022-08-09 13:21:39 -03:00
installer Increment version for 23.05.14 release 2024-08-13 11:05:38 -03:00
koha-tmpl Bug 37655: Basic editor needs to HTML-escape the bib record title used as a heading 2024-09-11 05:00:41 +00:00
labels Bug 36511: Some scripts missing a dependency following Bug 24879 2024-04-11 14:28:13 +00:00
lib/CGI/Session/Serialize
…
members Bug 33849: Do not reset new patrons home library when error occurs 2024-05-30 19:15:53 +00:00
misc Update release notes for 23.05.14 release 2024-08-14 07:59:13 +02:00
offline_circ Bug 33961: Remove built-in offline circ tool 2023-07-17 08:18:59 +01:00
opac Bug 13342: Not logged user can place a review/comment 2024-09-11 03:46:30 +00:00
patron_lists
…
patroncards Bug 24001: Fix patron card template edition 2022-04-28 10:49:20 -10:00
plugins Bug 30367: (follow-up) Same adjustment for gitlab 2023-05-05 10:18:57 -03:00
pos Bug 34731: Don't call SendQueuedMessages if message_id is bad 2023-09-14 07:54:48 -10:00
recalls Bug 34013: Recalls awaiting pickup doesn't show count on each tab 2023-07-17 14:51:00 +01:00
reports Bug 37508: Don't return Internal server error when running report 2024-08-13 11:05:36 -03:00
reserve Bug 35979: Check pref before inserting holds_queue background jobs 2024-05-28 20:22:48 +00:00
reviews
…
rotating_collections
…
serials Bug 37247: [23.05.x] Send Koha::Subscription to template 2024-07-25 02:17:34 +00:00
services
…
skel
…
suggestion Bug 34963: Restore the ability to blank fields when editing a suggestion 2024-05-28 19:45:09 +00:00
svc Bug 37508: Throw error if password column is detected in SQL report 2024-08-13 11:05:32 -03:00
t Bug 37508: (QA follow-up) Use ->check_columns 2024-08-13 11:05:36 -03:00
tags Bug 30718: Use flatpickr's altInput 2022-08-19 08:26:31 -03:00
tools Bug 37488: Validate paths in datalink.txt/idlink.txt files 2024-08-13 11:05:30 -03:00
virtualshelves Bug 36858: Remove warnings 2024-05-31 13:21:45 +00:00
xt Bug 37018: Add 400 response definition to all routes 2024-07-23 04:42:52 +00:00
.editorconfig
…
.eslintrc.json
…
.gitignore Bug 35174: Add misc/translator/po to .gitignore 2023-11-22 09:34:59 +01:00
.htaccess
…
.mailmap Bug 36943: (follow-up) 24.05.00 - Update .mailmap 2024-05-31 15:30:58 +00:00
.perlcriticrc
…
.perltidyrc Bug 30002: Adjust perltidy 2023-07-12 07:55:00 +01:00
.proverc.dist
…
.stylelintrc.json Bug 31528: (follow-up) A few additional rules 2022-10-03 08:23:15 -03:00
INSTALL
…
Koha.pm Increment version for 23.05.14 release 2024-08-13 11:05:38 -03:00
LICENSE
…
MANIFEST.SKIP
…
Makefile.PL Bug 26700: Remove occurrences in Makefile.PL 2023-07-17 11:01:46 +01:00
README
…
README.md
…
README.robots
…
about.pl Bug 36134: Read complete Elasticsearch configuration in about.pl 2024-03-19 20:05:37 +00:00
app.psgi Bug 36149: Add userenv middleware to app.psgi 2024-05-01 15:35:19 +00:00
build-resources.PL Bug 32609: Use the current yarn.lock to generate node_modules 2023-02-10 11:07:57 -03:00
changelanguage.pl
…
cpanfile Bug 33964: (QA follow-up) Remove library from cpanfile 2023-08-07 20:05:46 -10:00
cypress.json Bug 33408: Extend defaultCommandTimeout for cypress 2023-04-13 11:48:00 -03:00
fix-perl-path.PL
…
gulpfile.js Bug 36730: (Bug 35428 follow-up) po files (sometimes) fail to update 2024-05-28 21:44:03 +00:00
help.pl
…
kohaversion.pl
…
mainpage.pl Bug 35019: Add a CSRF token when deleting news 2023-10-25 20:22:12 -10:00
package.json Bug 33066: Introduce a KohaTable Vue component 2023-04-10 07:38:28 -03:00
rewrite-config.PL
…
tsconfig.json Bug 32030: Move cypress to t - fix build_js/watch_js 2022-11-08 09:44:52 -03:00
webpack.config.js Bug 32806: Move main-erm.ts to modules/erm.ts 2023-02-27 11:12:01 -03:00
yarn.lock Bug 33066: Introduce a KohaTable Vue component 2023-04-10 07:38:28 -03:00

README.md

Koha is a free software integrated library system (ILS).

Koha is distributed under the GNU GPL version 3 or later.

Note: Koha does not accept pull requests from git hosting sites.

Note: This project has its own bug tracker, to report a bug or submit a patch visit http://bugs.koha-community.org.

For guidelines on submitting patches for Koha please visit https://wiki.koha-community.org/wiki/SubmitingAPatch

The developers handbook can be found at https://wiki.koha-community.org/wiki/Developer_handbook

http://koha-community.org/

Koha Logo