Koha-clms

Go to file

David Cook d4431c19a6 Bug 40748: Check for HTTP URLs and skip shell when using system() This change checks for HTTP(S) URLs and skips the shell when using system() so that shell metacharacters aren't interpreted. Test plan: 0. Apply the patch 1. Insert the following into the Babeltheque_url_update system preference: $(whoami > /tmp/rce.log) 2. koha-shell kohadev 3. perl misc/cronjobs/social_data/update_social_data.pl 4. Note the script says the following: $(whoami > /tmp/rce.log) is not a HTTP URL. Aborting. 5. Note also that /tmp/rce.log is not created 6. Change Babeltheque_url_update syspref to something like the following: http://localhost:8080 7. perl misc/cronjobs/social_data/update_social_data.pl 8. Note that the wget succeeds but the bunzip2 fails (as expected) since we haven't fetched a bzipped file 9. Try to create a payload that passes the HTTP URL test with shell metacharacters and note that they're not interpetted and instead just used as part of a URL string. Signed-off-by: Jake Deery <jake.deery@openfifth.co.uk> Signed-off-by: Jonathan Druart <jonathan.druart@bugs.koha-community.org> Signed-off-by: wainuiwitikapark <wainuiwitikapark@catalyst.net.nz>		2025-09-26 13:57:00 +12:00
C4	Revert "Bug 36092: Pass sessionID at the end of get_template_and_user"	2025-07-24 17:52:32 +12:00
Koha	[22.11.x] Bug 40579: Fix CSV formula injection vulnerabilities	2025-08-26 16:10:27 +12:00
acqui	Bug 30493: (QA follow-up) Fix for the only_my_library case as well	2024-10-07 19:07:20 +02:00
admin	Bug 33339: Prevent Formula Injection (CSV Injection) in CSV files	2024-11-07 23:29:11 +00:00
api	Bug 28907: REST - Remove allow-owner from public article requests cancel route	2025-02-24 18:37:36 +00:00
authorities	Bug 25387: (QA follow-up) Tidy	2024-10-07 19:14:03 +02:00
basket	Bug 33102: Display fields from biblioitems in OPAC/staff interface cart	2023-05-12 16:34:19 +01:00
bin	…
catalogue	Bug 35294: Fix typos in catalogue code comments	2024-10-07 19:06:09 +02:00
cataloguing	Bug 24879: Add check_cookie_auth when missing	2024-03-25 08:23:03 +00:00
circ	Bug 25835: Include overdues with fines in overdues_report permission	2025-06-23 02:58:10 +00:00
clubs	…
course_reserves	Bug 31893: Use checkauth and do not fetch about.tt template	2023-01-31 14:09:05 +00:00
debian	Bug 39906: (QA follow-up) Feature needs to be enabled specifically	2025-08-25 17:48:54 +12:00
docs	Bug 40022: [24.05.x] Add the 25.11 release team	2025-08-22 15:10:16 +12:00
erm	Bug 32922: Remove space in shebang	2023-02-24 07:51:37 +00:00
errors	…
etc	Bug 30843: Add mfa_range configuration option for TOTP	2023-10-17 16:56:21 +00:00
ill	…
installer	Increment version for 22.11.30 release	2025-08-26 18:13:58 +12:00
koha-tmpl	Merge remote-tracking branch 'upstream/22.11.x' into HEAD	2025-08-26 17:49:12 +12:00
labels	Bug 33339: Prevent Formula Injection (CSV Injection) in CSV files	2024-11-07 23:29:11 +00:00
lib/CGI/Session/Serialize	…
members	Bug 34910: (follow-up) alert in patron details	2023-11-13 15:22:12 +00:00
misc	Bug 40748: Check for HTTP URLs and skip shell when using system()	2025-09-26 13:57:00 +12:00
offline_circ	Bug 30016: Remove GetOpenIssue subroutine	2022-08-31 08:50:37 -03:00
opac	Bug 13342: Not logged user can place a review/comment	2025-07-24 18:05:26 +12:00
patron_lists	…
patroncards	…
plugins	Bug 30367: (follow-up) Same adjustment for gitlab	2023-05-12 15:58:09 +01:00
pos	Bug 34331: Use register from userenv if parameter not passed	2023-08-31 10:23:50 +00:00
recalls	Bug 34013: Recalls awaiting pickup doesn't show count on each tab	2023-07-18 11:21:31 +00:00
reports	Bug 37784: [24.05] (QA follow-up) Bail out to new definition	2025-03-24 15:33:19 +00:00
reserve	Bug 34634: Show expirationdate of expired holds on reserve/request.pl	2023-09-15 09:33:06 +00:00
reviews	…
rotating_collections	…
serials	Bug 39996: Fix subscription details display	2025-08-22 16:14:59 +12:00
services	…
skel	…
suggestion	Bug 35276: Remove authentication params from suggestion hash	2023-11-16 09:37:10 +00:00
svc	Bug 37508: Throw error if password column is detected in SQL report	2024-08-13 11:54:01 -03:00
t	Revert "Bug 36092: Add test"	2025-07-24 17:52:18 +12:00
tags	Bug 38969: Prevent XSS in tags/review.pl and Prevent JS error when adding tags with quote at the OPAC	2025-04-24 15:12:24 +00:00
tools	Bug 38357: Prevent holidays to be wrongly added	2025-03-31 09:42:12 +00:00
virtualshelves	Bug 34650: Remove unnecessary CSRF check on edit_form	2023-09-08 09:47:28 +00:00
xt	[22.11.x] Bug 40579: Add author test for CSV formula injection protection	2025-08-26 16:02:04 +12:00
.editorconfig	…
.eslintrc.json	…
.gitignore	Bug 35174: Add misc/translator/po to .gitignore	2023-11-22 09:37:30 +01:00
.htaccess	…
.mailmap	Update .mailmap	2023-07-18 09:22:47 +00:00
.perlcriticrc	…
.perltidyrc	Bug 30002: Adjust perltidy	2023-07-12 09:16:19 +00:00
.proverc.dist	…
.stylelintrc.json	Bug 31528: (follow-up) A few additional rules	2022-10-03 08:23:15 -03:00
INSTALL	…
Koha.pm	Increment version for 22.11.30 release	2025-08-26 18:13:58 +12:00
LICENSE	…
MANIFEST.SKIP	…
Makefile.PL	Bug 30002: (QA follow-up) Add .perltidyrc to Makefile.PL mapping	2023-07-12 09:41:28 +00:00
README	…
README.md	…
README.robots	…
about.pl	Bug 35174: Add a warning to the about page	2023-11-22 09:37:14 +01:00
app.psgi	Bug 36149: Add userenv middleware to app.psgi	2024-04-24 10:50:45 +00:00
build-resources.PL	Bug 32609: Use the current yarn.lock to generate node_modules	2023-03-10 12:27:47 +00:00
changelanguage.pl	…
cpanfile	Bug 38467: (follow-up) Update cpanfile	2025-02-19 14:33:45 +00:00
cypress.json	Bug 33408: Extend defaultCommandTimeout for cypress	2023-05-15 13:15:43 +00:00
fix-perl-path.PL	…
gulpfile.js	Bug 35174: Don't run gulp po commands if po dir is missing	2023-11-22 09:37:36 +01:00
help.pl	…
kohaversion.pl	…
mainpage.pl	Bug 30493: (QA follow-up) Fix for the only_my_library case as well	2024-10-07 19:07:20 +02:00
package.json	Bug 33066: Introduce a KohaTable Vue component	2023-05-11 17:01:22 +01:00
rewrite-config.PL	…
tsconfig.json	Bug 32030: Move cypress to t - fix build_js/watch_js	2022-11-08 09:44:52 -03:00
webpack.config.js	Bug 32806: Move main-erm.ts to modules/erm.ts	2023-02-28 18:54:57 +00:00
yarn.lock	Bug 33066: Introduce a KohaTable Vue component	2023-05-11 17:01:22 +01:00

README.md

Koha is a free software integrated library system (ILS).

Koha is distributed under the GNU GPL version 3 or later.

Note: Koha does not accept pull requests from git hosting sites.

Note: This project has its own bug tracker, to report a bug or submit a patch visit http://bugs.koha-community.org.

For guidelines on submitting patches for Koha please visit https://wiki.koha-community.org/wiki/SubmitingAPatch

The developers handbook can be found at https://wiki.koha-community.org/wiki/Developer_handbook

http://koha-community.org/