Go to file
Phil Ringnalda da3f4d02b5 Bug 37801: Search results with limits create URLs that cause XML errors in RSS and Atom output
The template for RSS and Atom feeds of search results (curiously named
opac-opensearch.tt) is careful to escape ampersands in the query_cgi param
while adding it to URLs, but doesn't escape the limit_cgi param at all. It
should.

Two drive-by fixes for Atom: because the <title> when your search has a limit
includes &nbsp;, which isn't an XML character entity, you couldn't get as far
as the error from the <link> URL, and as long as I was going to have blame for
the line, I couldn't bear to leave the stray undefined SEARCH_RESULT. in the
(hard-coded and bogus) <link rel="last">.

Test plan:
1. In the OPAC, Advanced search - check the boxes to limit by item type Books
   and Mixed Materials and search for the keyword Perl
2. At the top of the search results, click the orange RSS icon
3. That gives you an ugly "not well-formed" error, so in the URL for the page
   change the final "format=rss" to "format=atom"
4. That gives you an ugly "undefined entity" error, so apply the patch
5. Reload the page with the Atom feed, it should change from an error page
   to a garbled display of the feed. Click Back to go back to the RSS feed
   and reload it if it's still cached on the error page. That should give
   a pretty-printed display of the RSS feed without parsing errors

Sponsored-by: Chetco Community Public Library
Signed-off-by: Sukhmandeep Benipal <sukhmandeep.benipal@inLibro.com>

Signed-off-by: Jonathan Druart <jonathan.druart@bugs.koha-community.org>
Signed-off-by: Katrin Fischer <katrin.fischer@bsz-bw.de>
(cherry picked from commit 8298e708b9)
Signed-off-by: Lucas Gass <lucas@bywatersolutions.com>
(cherry picked from commit be233aadae)
Signed-off-by: Fridolin Somers <fridolin.somers@biblibre.com>
2024-11-15 16:44:41 +01:00
C4 Bug 33339: Prevent Formula Injection (CSV Injection) in CSV files 2024-11-05 15:43:13 +01:00
Koha Bug 33339: (Follow up) Fix more cases of formula=empty 2024-11-05 15:43:15 +01:00
acqui Bug 10758: Show title of deleted biblio on basket page 2024-08-02 14:37:14 +02:00
admin Bug 33339: Prevent Formula Injection (CSV Injection) in CSV files 2024-11-05 15:43:13 +01:00
api Bug 29509: Update swagger specification and add permissions to users 2024-09-10 15:17:57 +02:00
authorities Bug 25387: (QA follow-up) Tidy 2024-07-19 11:30:08 +02:00
basket Bug 34731: Don't call SendQueuedMessages if message_id is bad 2023-09-12 09:44:59 -03:00
bin
…
bookings Bug 35574: Bookings tab from biblio details should only require manage_bookings permission 2024-01-03 15:48:28 +01:00
catalogue Bug 37425: Check for existence of biblio object before fetching cover images 2024-09-10 16:12:29 +02:00
cataloguing Bug 36792: Limit POSIX imports 2024-05-30 10:02:31 +02:00
circ Bug 33339: Prevent Formula Injection (CSV Injection) in CSV files 2024-11-05 15:43:13 +01:00
clubs Bug 25079: Show club enrollment question answers in staff client 2023-06-23 11:00:54 -03:00
course_reserves Bug 20256: Use new methods 2023-02-02 11:59:26 -03:00
debian Bug 33563: Add comments for Elasticsearch security config 2024-07-19 11:27:56 +02:00
docs Bug 37003: (follow-up) Amend 22.11 RMaint 2024-07-19 11:10:06 +02:00
erm Bug 32922: Remove space in shebang 2023-02-20 09:44:06 -03:00
errors Bug 29420: HTTP status code incorrect when calling error pages directly under Plack/PSGI 2022-04-20 09:03:39 -10:00
etc Bug 33563: Add comments for Elasticsearch security config 2024-07-19 11:27:56 +02:00
ill Bug 35930: Add guards for plugins_enabled 2024-02-15 10:51:57 +01:00
installer Increment version for 23.11.10 release 2024-11-07 14:28:06 +01:00
koha-tmpl Bug 37801: Search results with limits create URLs that cause XML errors in RSS and Atom output 2024-11-15 16:44:41 +01:00
labels Bug 33339: Prevent Formula Injection (CSV Injection) in CSV files 2024-11-05 15:43:13 +01:00
lib/CGI/Session/Serialize Bug 17600: Standardize our EXPORT_OK 2021-07-16 08:58:47 +02:00
members Bug 33849: Do not reset new patrons home library when error occurs 2024-05-29 13:57:54 +02:00
misc Update release notes for 23.11.10 release 2024-11-07 14:38:42 +01:00
offline_circ Bug 34529: Offline circulation should be able to accept userid as well as cardnumber 2023-11-06 11:34:44 -03:00
opac Bug 37339: Set messaging preferences from default on self registration 2024-10-21 15:35:16 +02:00
patron_lists Bug 34977: (QA follow-up) Tidy code 2023-11-08 11:41:33 -03:00
patroncards Bug 24001: Fix patron card template edition 2022-04-28 10:49:20 -10:00
plugins Bug 35536: Refine verbose handling in some Koha::Plugins calls 2024-07-22 14:00:11 +02:00
pos Bug 34731: Don't call SendQueuedMessages if message_id is bad 2023-09-12 09:44:59 -03:00
preservation Bug 34030: Add a "print slips" action links to print in batch 2023-10-23 11:33:55 -03:00
recalls Bug 34013: Recalls awaiting pickup doesn't show count on each tab 2023-06-23 10:01:04 -03:00
reports Bug 33339: Prevent Formula Injection (CSV Injection) in CSV files 2024-11-05 15:43:13 +01:00
reserve Bug 35559: Revert changes from bug 34634 2024-05-24 14:43:23 +02:00
reviews Bug 17600: Standardize our EXPORT_OK 2021-07-16 08:58:47 +02:00
rotating_collections Bug 17600: Standardize our EXPORT_OK 2021-07-16 08:58:47 +02:00
serials Bug 33339: Prevent Formula Injection (CSV Injection) in CSV files 2024-11-05 15:43:13 +01:00
services Bug 17600: Standardize our EXPORT_OK 2021-07-16 08:58:47 +02:00
skel
…
suggestion Bug 37337: Pass the save $op when biblio_exists 2024-09-17 15:55:11 +02:00
svc Bug 37508: Throw error if password column is detected in SQL report 2024-08-13 02:03:22 -03:00
t Bug 37575: Typo 'AutoCreateAuthorites' in about.pl 2024-11-15 16:35:53 +01:00
tags Bug 30718: Use flatpickr's altInput 2022-08-19 08:26:31 -03:00
tools Bug 33339: Prevent Formula Injection (CSV Injection) in CSV files 2024-11-05 15:43:13 +01:00
virtualshelves Bug 37285: (QA follow-up) Perl Tidy 2024-09-10 16:49:41 +02:00
xt Bug 37018: Add 400 response definition to all routes 2024-07-25 09:58:11 +02:00
.editorconfig Bug 27375: Set YAML file settings in .editorconfig 2021-11-03 15:40:52 +01:00
.eslintrc.json
…
.gitignore Bug 35174: Add misc/translator/po to .gitignore 2023-11-16 08:56:36 +01:00
.htaccess
…
.mailmap Bug 36943: (follow-up) 24.05.00 - Update .mailmap 2024-05-30 10:03:25 +02:00
.perlcriticrc Bug 25898: Prohibit indirect object notation 2020-10-15 12:56:30 +02:00
.perltidyrc Bug 30002: Adjust perltidy 2023-06-08 08:32:42 -03:00
.proverc.dist Bug 19821: Install sample data, ES mappings and Version syspref 2021-10-25 11:27:40 +02:00
.stylelintrc.json Bug 31528: (follow-up) A few additional rules 2022-10-03 08:23:15 -03:00
INSTALL Bug 26617: Update INSTALL file to include koha-testing-docker and Gitlab links 2020-10-15 12:56:30 +02:00
Koha.pm Increment version for 23.11.10 release 2024-11-07 14:28:06 +01:00
LICENSE
…
MANIFEST.SKIP
…
Makefile.PL Bug 35759: (bug 30708 follow-up) Generated dist file not installed for preservation module 2024-01-17 10:06:28 +01:00
README
…
README.md Bug 27092: Remove note about "synced repo" from README.md 2020-11-25 16:31:58 +01:00
README.robots
…
about.pl Bug 36134: Read complete Elasticsearch configuration in about.pl 2024-03-11 11:20:07 +01:00
app.psgi Bug 36149: Add userenv middleware to app.psgi 2024-04-24 07:36:20 +02:00
build-resources.PL Bug 32609: Use the current yarn.lock to generate node_modules 2023-02-10 11:07:57 -03:00
changelanguage.pl Bug 25898: Prohibit indirect object notation 2020-10-15 12:56:30 +02:00
cpanfile Bug 34064: Add SQL::Translator dependency to cpanfile 2023-10-10 10:54:04 -03:00
cypress.config.ts Bug 34319: Upgrade cypress 9.7.0 to 12.17.2 2023-09-05 11:52:25 -03:00
fix-perl-path.PL Bug 28606: Remove $DEBUG and $ENV{DEBUG} 2021-06-24 11:53:44 +02:00
gulpfile.js Bug 36730: (Bug 35428 follow-up) po files (sometimes) fail to update 2024-05-24 16:12:44 +02:00
help.pl Bug 17600: Standardize our EXPORT_OK 2021-07-16 08:58:47 +02:00
kohaversion.pl
…
mainpage.pl Bug 30493: (QA follow-up) Fix for the only_my_library case as well 2024-07-19 11:05:22 +02:00
package.json Bug 34319: Upgrade cypress 9.7.0 to 12.17.2 2023-09-05 11:52:25 -03:00
rewrite-config.PL Bug 28519: Put CGI::Session::Serialize::yamlxs in lib directory 2021-06-17 10:07:36 +02:00
tsconfig.json Bug 32030: Move cypress to t - fix build_js/watch_js 2022-11-08 09:44:52 -03:00
webpack.config.js Bug 30708: Vue app 2023-10-18 15:41:40 -03:00
yarn.lock Bug 34319: Update yarn.lock 2023-09-05 11:52:25 -03:00

README.md

Koha is a free software integrated library system (ILS).

Koha is distributed under the GNU GPL version 3 or later.

Note: Koha does not accept pull requests from git hosting sites.

Note: This project has its own bug tracker, to report a bug or submit a patch visit http://bugs.koha-community.org.

For guidelines on submitting patches for Koha please visit https://wiki.koha-community.org/wiki/SubmitingAPatch

The developers handbook can be found at https://wiki.koha-community.org/wiki/Developer_handbook

http://koha-community.org/

Koha Logo