gitea
/
Koha-clms
1
0
Fork 0
Code Issues Pull Requests Packages Projects Releases Wiki Activity
Koha-clms/tools
History
Jonathan Druart d2b2c61ff9
Bug 24878: Add authentication checks to the calendar tool 
There is a security hole in 2 scripts that are used by the UI to edit
holidays.

To test:
1) Go to Tools -> Calendar, for Centerville
   Check no holiday for 30/4/2020
2) To add a new holiday without login execute
   a curl command with necessary parameters
3) Reload page from 1), verify the new holiday
   edit and delete the holiday
4) Apply the patch
5) Do 2) again, this time you get a lengthy output,
   with the magic words:

   <title>Koha &rsaquo;
       Log in to Koha
   </title>

Signed-off-by: Bernardo Gonzalez Kriegel <bgkriegel@gmail.com>
Signed-off-by: Nick Clemens <nick@bywatersolutions.com>
Signed-off-by: Martin Renvoize <martin.renvoize@ptfs-europe.com>
 		2020-03-26 11:35:00 +00:00
..
csv-profiles
…
quotes Bug 20017: use Modern::Perl in Tools perl scripts 2018-02-05 09:46:45 -03:00
access_files.pl Bug 24545: Fix license statements 2020-02-24 13:31:26 +00:00
ajax-inventory.pl Bug 11944: use CGI( -utf8 ) everywhere 2015-01-13 13:07:21 -03:00
automatic_item_modification_by_age.pl Bug 16889: Remove C4::Items::biblioitems_columns and use Koha::Biblioitems->columns instead 2016-07-15 18:12:13 +00:00
background-job-progress.pl Bug 20017: use Modern::Perl in Tools perl scripts 2018-02-05 09:46:45 -03:00
batchMod.pl Bug 23463: Fix safe_return return value in deletion tools 2020-03-23 09:26:33 +00:00
batch_delete_records.pl Bug 23463: Fix safe_return return value in deletion tools 2020-03-23 09:26:33 +00:00
batch_extend_due_dates.pl Bug 23463: Replace a new occurrence of ModItem 2020-03-23 10:37:29 +00:00
batch_record_modification.pl Bug 18127: Add batch modified records to an existing list 2020-03-10 15:20:18 +00:00
batch_records_ajax.pl Bug 24545: Fix license statements 2020-02-24 13:31:26 +00:00
cleanborrowers.pl Bug 16966: move parameters to hashref 2017-03-03 17:20:05 +00:00
copy-holidays.pl Bug 20017: use Modern::Perl in Tools perl scripts 2018-02-05 09:46:45 -03:00
csv-profiles.pl Bug 8612: [Follow-up] Make usage and type different columns in table 2017-06-05 12:02:08 -03:00
exceptionHolidays.pl Bug 24878: Add authentication checks to the calendar tool 2020-03-26 11:35:00 +00:00
export.pl Bug 14647: (follow-up) Changes to script 2020-02-20 08:59:31 +00:00
holidays.pl Bug 20017: use Modern::Perl in Tools perl scripts 2018-02-05 09:46:45 -03:00
import_borrowers.pl Bug 20443: Move C4::Members::AttributeTypes::GetAttributeTypes to Koha::Patron::Attribute::Types 2020-03-23 13:44:35 +00:00
inventory.pl Bug 23463: Replace ModItem with Koha::Item->store 2020-03-23 09:26:30 +00:00
koha-news.pl Bug 22888: Use DataTables for Koha news table filtering 2019-06-24 14:58:02 +01:00
letter.pl Bug 23084: Replace grep {^$var$} with grep {$_ eq $var} 2020-02-17 10:44:45 +00:00
manage-marc-import.pl Bug 20180: [sql_modes] Remove GROUP BY clause in manage-marc-import.pl 2018-04-09 16:15:17 -03:00
marc_modification_templates.pl Bug 13560: Add an 'Add' option for marc modification templates 2018-07-19 17:22:18 +00:00
modborrowers.pl Bug 20443: Use search_with_library_limits for attribute types 2020-03-23 13:49:22 +00:00
newHolidays.pl Bug 24878: Add authentication checks to the calendar tool 2020-03-26 11:35:00 +00:00
overduerules.pl Bug 21746: Remove NO_LIBRARY_SET 2020-03-02 10:20:42 +00:00
picture-upload.pl Bug 21993: Display a user-friendly message when the CSRF token is wrong 2019-01-25 20:38:32 +00:00
quotes-upload.pl Bug 20017: use Modern::Perl in Tools perl scripts 2018-02-05 09:46:45 -03:00
quotes.pl Bug 20017: use Modern::Perl in Tools perl scripts 2018-02-05 09:46:45 -03:00
scheduler.pl Bug 20017: use Modern::Perl in Tools perl scripts 2018-02-05 09:46:45 -03:00
showdiffmarc.pl Bug 24545: Fix license statements 2020-02-24 13:31:26 +00:00
stage-marc-import.pl Bug 21333: Add ability to add to basket from a new file 2018-09-26 19:05:53 +00:00
stockrotation.pl Bug 24545: Fix license statements 2020-02-24 13:31:26 +00:00
tools-home.pl Bug 18403: Patron reviews 2018-02-12 15:41:41 -03:00
upload-cover-image.pl Bug 20564: Don't use system to unzip files 2018-09-19 13:54:26 +00:00
upload-file.pl Bug 17501: Rename Upload to Uploader 2017-01-20 14:20:06 +00:00
upload.pl Bug 19633: Use alphanumeric error codes in upload 2018-08-10 10:10:46 +00:00
viewlog.pl Bug 10352: Get add operations too 2020-01-10 08:37:19 +00:00