gitea
/
Koha-clms
1
0
Fork 0
Code Issues Pull Requests Packages Projects Releases Wiki Activity
Koha-clms/C4
History
Aleisha Amohia 87587a17e6 Bug 37784: [24.05] Do not show forbidden columns in reports dictionary 
This patch prevents forbidden columns from being selected using the reports dictionary.

To test:

1. Go to Reports -> View dictionary
2. Choose 'new dictionary'
3. After providing a name and description, select the 'patrons' table
4. Select the 'password' column and go Next
5. Notice it is possible to see a list of all the password hashes in the 'choose' selection box when asked to specify a value

6. Apply patch and restart services

7. Repeat steps 1-3
8. Notice the 'password' column and other forbidden columns are not available to be selected

9. Open the Inspector / developer tools in your browser and find the code for the columns selection
10. Change the value of one of the options in the code to "borrowers.password". So it may end up looking like this:

<option value="borrowers.password">Card number</option>

11. Choose that option from the dropdown and click Next.
12. Confirm you are redirected back to this page and warned about the column being used.

13. Ensure tests pass t/db_dependent/Reports/Guided.t

Sponsored-by: Reserve Bank of New Zealand
Signed-off-by: David Cook <dcook@prosentient.com.au>

Signed-off-by: Marcel de Rooy <m.de.rooy@rijksmuseum.nl>
Signed-off-by: Alex Buckley <alexbuckley@catalyst.net.nz>
(cherry picked from commit dbfb62c63b)
Signed-off-by: Fridolin Somers <fridolin.somers@biblibre.com>

Signed-off-by: JesseM <jesse@bywatersolutions.com>
 		2025-03-24 15:32:38 +00:00
..
AuthoritiesMarc Bug 17600: Standardize our EXPORT_OK 2021-07-16 08:58:47 +02:00
Barcodes Bug 30718: Use flatpickr's altInput 2022-08-19 08:26:31 -03:00
ClassSortRoutine Bug 17600: Standardize our EXPORT_OK 2021-07-16 08:58:47 +02:00
ClassSplitRoutine Bug 28572: Remove C4::Debug 2021-06-22 12:04:32 +02:00
Creators Bug 32222: Fix capitalization in various "id is invalid" 2023-02-08 16:27:45 +00:00
External Bug 17600: Standardize our EXPORT_OK 2021-07-16 08:58:47 +02:00
Form Bug 28572: Remove C4::Debug 2021-06-22 12:04:32 +02:00
Heading Bug 33277: Add comments and missing thesauri 2023-05-15 10:41:29 +00:00
ILSDI Bug 34893: ILS-DI can return the wrong patron for AuthenticatePatron 2024-01-26 09:56:12 +01:00
Installer Bug 30731: Remove Readonly::XS::MAGIC_COOKIE 2022-06-01 16:15:26 -03:00
Labels Bug 33339: Prevent Formula Injection (CSV Injection) in CSV files 2024-11-07 23:29:11 +00:00
Linker Bug 30280: Add support for subject headings from different thesaurus when using Elasticsearch 2022-10-03 10:00:04 -03:00
Members Bug 17600: Standardize our EXPORT_OK 2021-07-16 08:58:47 +02:00
OAI Bug 30308: Fix bulkmarcimport.pl broken by OAI-PMH:AutoUpdateSets(EmbedItemData) 2022-07-29 15:43:39 -03:00
Output Bug 17600: Standardize our EXPORT_OK 2021-07-16 08:58:47 +02:00
Patroncards Bug 34532: Silence warns in Patroncard.pm 2023-10-12 15:31:48 +00:00
Reports Bug 37784: [24.05] Do not show forbidden columns in reports dictionary 2025-03-24 15:32:38 +00:00
SIP Bug 37816: (QA follow-up) Avoid repetition, typo and pipe test 2025-02-25 16:35:00 -05:00
Search Bug 30718: Use flatpickr's altInput 2022-08-19 08:26:31 -03:00
Serials Bug 17600: Standardize our EXPORT_OK 2021-07-16 08:58:47 +02:00
Utils Bug 29648: (QA follow-up) Minor POD fix 2022-04-27 11:20:45 -10:00
Accounts.pm Bug 29184: Fix warn about undefined replacecost 2022-09-08 10:50:30 -07:00
Acquisition.pm Bug 33339: Prevent Formula Injection (CSV Injection) in CSV files 2024-11-07 23:29:11 +00:00
Auth.pm Bug 36575: (QA follow-up) Shibboleth POD and checkpw_internal call 2024-05-29 07:17:42 +00:00
Auth_cas_servers.yaml.sample
…
Auth_with_cas.pm Bug 34893: (QA follow-up) Tidy code for qa script 2024-01-26 09:57:14 +01:00
Auth_with_ldap.pm Bug 36575: (bug 34893 follow-up) Return patron from LDAP 2024-05-29 07:16:11 +00:00
Auth_with_shibboleth.pm Bug 36575: (QA follow-up) Shibboleth POD and checkpw_internal call 2024-05-29 07:17:42 +00:00
AuthoritiesMarc.pm Bug 32279: Add GetAuthorizedHeading method export C4::AuthoritiesMarc 2023-04-16 18:08:50 +01:00
BackgroundJob.pm Bug 17600: Standardize our EXPORT_OK 2021-07-16 08:58:47 +02:00
Barcodes.pm Bug 17600: Standardize our EXPORT_OK 2021-07-16 08:58:47 +02:00
Biblio.pm Bug 34943: (QA follow-up) Use `before_biblio_action` and an `action` param 2024-03-26 15:31:26 +01:00
Breeding.pm Bug 33404: Fix serverhost and init $page 2023-07-18 13:27:56 +00:00
Budgets.pm Bug 27550: "Duplicate budget" does not keep users associated with that budget 2022-09-22 08:18:33 -03:00
Calendar.pm Bug 32048: Added clear cache routine to delete_holiday_range_repeatable 2023-10-12 16:00:20 +00:00
Charset.pm Bug 18984: Remove NORMARC support 2021-10-07 15:36:40 +02:00
Circulation.pm Bug 30362: Fix GetSoonestRenewDate to really return soonest renew date 2023-08-31 13:34:28 +00:00
ClassSortRoutine.pm Bug 29951: Fix EXPORT for C4::ClassS*Routine modules 2022-07-08 15:29:56 -03:00
ClassSource.pm Bug 29951: Fix EXPORT for C4::ClassS*Routine modules 2022-07-08 15:29:56 -03:00
ClassSplitRoutine.pm Bug 29951: Fix EXPORT for C4::ClassS*Routine modules 2022-07-08 15:29:56 -03:00
Context.pm Bug 36081: Use multivalue_preference 2025-02-26 12:17:31 -03:00
Contract.pm Bug 17600: Standardize our EXPORT_OK 2021-07-16 08:58:47 +02:00
CourseReserves.pm Bug 30016: Remove GetOpenIssue subroutine 2022-08-31 08:50:37 -03:00
Creators.pm Bug 17600: Standardize our EXPORT_OK 2021-07-16 08:58:47 +02:00
HTML5Media.pm Bug 18984: Remove NORMARC support 2021-10-07 15:36:40 +02:00
Heading.pm Bug 33557: Add LinkerConsiderThesaurus system preference 2023-05-16 07:32:11 +01:00
HoldsQueue.pm Bug 34678: Allow new entries to overwrite hold_fill_targets 2023-11-13 15:22:14 +00:00
ImportBatch.pm Bug 34822: Process real time holds along with indexing 2023-10-17 16:56:24 +00:00
ImportExportFramework.pm Bug 33339: Prevent Formula Injection (CSV Injection) in CSV files 2024-11-07 23:29:11 +00:00
InstallAuth.pm Bug 26019: Koha should set SameSite attribute on cookies 2022-04-13 15:55:38 +02:00
Installer.pm Bug 34174: (bug 33341 follow-up) Fix Ris export 2023-07-18 13:32:49 +00:00
ItemCirculationAlertPreference.pm Bug 29844: Fix ->search occurrences 2022-02-09 15:36:23 -10:00
Items.pm Bug 34656: Do not update real Time Holds Queue when moving from cart to shelf 2023-10-12 15:31:50 +00:00
Koha.pm Bug 33341: Address some perlcritic errors in 5.36 2023-04-11 10:54:27 +00:00
Labels.pm Bug 21395: Make perlcritic happy 2020-06-29 12:37:02 +02:00
Languages.pm Bug 32775: (QA follow-up) Fix tab and indenting issues 2023-06-05 16:51:50 +00:00
Letters.pm Bug 37198: Improve GetPreparedLetter documentation 2024-10-07 19:17:57 +02:00
Linker.pm Bug 17600: Standardize our EXPORT_OK 2021-07-16 08:58:47 +02:00
Log.pm Bug 31203: Add End action to cronjobs and log viewer 2022-10-05 16:12:55 -03:00
MarcModificationTemplates.pm Bug 17600: Standardize our EXPORT_OK 2021-07-16 08:58:47 +02:00
Matcher.pm Bug 26611: Make authority record matching use required match checks 2023-06-08 17:15:33 +00:00
Members.pm Bug 33937: Remove incorrect export in C4::Members 2023-07-12 09:36:02 +00:00
Message.pm Bug 18398: (follow-up) Update POD & Unit tests 2023-05-09 21:34:01 +01:00
Output.pm Bug 30524: Core CSRF checking code 2023-07-28 11:13:55 +00:00
Overdues.pm Bug 34279: Don't enforce overduefinescap unless it is greater than 0 2023-08-18 10:37:11 +00:00
Patroncards.pm Bug 17600: Standardize our EXPORT_OK 2021-07-16 08:58:47 +02:00
Record.pm Bug 33339: Prevent Formula Injection (CSV Injection) in CSV files 2024-11-07 23:29:11 +00:00
Reports.pm Bug 17600: Standardize our EXPORT_OK 2021-07-16 08:58:47 +02:00
Reserves.pm Bug 17798: Confirm hold when printing slip from another patron's account 2023-11-14 13:42:15 -01:00
Ris.pm Bug 34174: (bug 33341 follow-up) Fix Ris export 2023-07-18 13:32:49 +00:00
RotatingCollections.pm Bug 17600: Standardize our EXPORT_OK 2021-07-16 08:58:47 +02:00
SMS.pm Bug 27673: Replace YAML with YAML::XS 2021-02-16 14:54:50 +01:00
Scheduler.pm Bug 17600: Standardize our EXPORT_OK 2021-07-16 08:58:47 +02:00
Scrubber.pm Bug 19613: Fix test for 22.11 2024-04-24 10:40:09 +00:00
Search.pm Bug 13976: Sort popularity numerically in Zebra 2023-04-16 17:46:38 +01:00
Serials.pm Bug 38829: Sanitize GetLateOrMissingIssues inputs 2025-02-19 14:33:45 +00:00
Service.pm Bug 17600: Standardize our EXPORT_OK 2021-07-16 08:58:47 +02:00
ShelfBrowser.pm Bug 29697: Replace GetMarcBiblio occurrences with $biblio->metadata->record 2022-07-22 15:24:11 -03:00
SocialData.pm Bug 17600: Standardize our EXPORT_OK 2021-07-16 08:58:47 +02:00
Stats.pm Bug 7021: Terminology - usercode -> categorycode 2022-09-22 09:31:28 -03:00
Suggestions.pm Bug 32027: Fix 'librarian interface' to use 'staff interface' in Pages/HTML customizations/News 2023-02-08 16:32:02 +00:00
TTParser.pm Bug 26673: Remove #!/usr/bin/env perl from .pm modules too 2020-10-26 00:14:42 +01:00
Tags.pm Bug 31517: (QA follow-up) Fix indentation 2022-11-04 19:30:56 -03:00
Templates.pm Bug 38467: Make uri and url filters rfc3986 when using C4::Template 2025-02-19 14:33:44 +00:00
TmplToken.pm
…
TmplTokenType.pm Bug 17600: Standardize our EXPORT_OK 2021-07-16 08:58:47 +02:00
UsageStats.pm Bug 30025: Replace AllowManualAuthorityEditing with RequireChoosingExistingAuthority 2022-09-16 16:48:34 -03:00
XISBN.pm Bug 30813: (QA follow-up) Adjust three use statements 2022-06-08 11:40:32 -03:00
XSLT.pm Bug 28375: (follow-up) Use C4::Context->interface 2022-10-20 11:50:53 -03:00