gitea
/
Koha-clms
1
0
Fork 0
Code Issues Pull Requests Packages Projects Releases Wiki Activity
Koha-clms/t/db_dependent
History
Kyle M Hall 3d03eff4a4 Bug 33339: Prevent Formula Injection (CSV Injection) in CSV files 
The system is vulnerable to Formula Injection attacks as the data
stored within the database and exported as CSV/Excel is not being
sanitized or validated against implanted formula payloads

This patch modifies all uses of Text::CSV and derived classes to pass
the "formula" parameter with value of "empty" which replaces formulas
by empty string.

Test Plan:
1) Apply this patch
2) For guided_reports.pl, attempt to export CSV where you've set a column to a formula somehow
   ( such as "=1+3" )
3) Export that CSV file
4) Note the formula has not been exported
5) Repeat this plan for the remaining scripts that export CSV files
   where users can define the outputted data

Signed-off-by: Magnus Enger <magnus@libriotech.no>
Fixed two conflicts. I have tested that this works as advertised on:
- Reports (Download > Comma separated text (.csv)) [Text::CSV::Encoded]
- Circulation > Overdues > Download file of all overdues [Text::CSV_XS]
- misc/export_borrowers.pl [Text::CSV]
This covers all modules used, and both GUI and command line.

Signed-off-by: Chris Cormack <chris@bigballofwax.co.nz>

Signed-off-by: Marcel de Rooy <m.de.rooy@rijksmuseum.nl>
[EDIT] Change none to empty in the commit message ! None is the default,
doing nothing. Empty clears the formulas.
Signed-off-by: Lucas Gass <lucas@bywatersolutions.com>
 		2024-11-07 23:02:54 +00:00
..
Acquisition Bug 32132: Fix failing tests 2024-04-23 16:47:05 +01:00
Auth Bug 36056: Clarify subpermissions AND behavior 2024-03-07 17:35:40 +01:00
AuthoritiesMarc
…
Authority Bug 36917: (follow-up) Add FIXME for marcflavour 2024-05-24 15:36:43 +02:00
Biblio Bug 35993: (follow-up) Another fix for MarcOverlayRules.t 2024-05-02 15:03:41 +02:00
Budgets Bug 27550: Add unit test for CloneBudgetHierarchy 2022-09-22 08:18:43 -03:00
Circulation Bug 36687: (RM follow-up) Fix unit tests 2024-05-09 09:22:00 +01:00
CourseReserves Bug 32351: Fix CourseItems.t 2022-11-30 15:58:18 -03:00
Creators Bug 37720: (follow-up) Adjust tests 2024-10-01 13:42:28 +00:00
Exporter Bug 25503: Add failing test for _get_biblio_for_export 2023-05-10 15:26:19 -03:00
Holds Bug 36923: Remove warnings from Holds/LocalHoldsPriority.t 2024-05-24 15:36:46 +02:00
HoldsQueue Bug 35826: Add unit tests. 2024-04-26 18:06:18 +02:00
Illrequest Bug 34838: (QA follow-up): TypeDisclaimer tests - Add 'type' to request metadata 2024-06-27 16:21:40 +00:00
Items Bug 36010: Fix Items/AutomaticItemModificationByAge.t failing since Bug 32029 2024-03-07 16:36:46 +01:00
Koha Bug 38094: (follow-up) edit_catalogue implies fast_cataloguing 2024-10-23 22:46:35 +00:00
LDAP
…
Labels Bug 36687: (RM follow-up) Fix unit tests 2024-05-09 09:22:00 +01:00
Letters Bug 31383: Adjust and add tests 2023-10-20 14:43:57 -03:00
Members Bug 33947: Remove GetAllIssues 2023-10-20 11:03:03 -03:00
OAI
…
Patron Bug 25996: (follow-up) Log the entire object on deletion 2024-05-03 18:02:18 +02:00
Record Bug 33339: Prevent Formula Injection (CSV Injection) in CSV files 2024-11-07 23:02:54 +00:00
Reports Bug 37508: (QA follow-up) Use ->check_columns 2024-08-12 15:35:15 -03:00
Reserves Bug 17798: Confirm hold when printing slip from another patron's account 2023-11-06 08:42:41 -03:00
SIP Bug 36605: Add update_lastseen to handle_patron_status for SIP 2024-04-29 09:35:41 +02:00
Search
…
Serials Bug 23775: Claiming a serial issue doesn't create the next one 2023-07-03 10:35:09 -03:00
Template/Plugin Bug 29393: (QA follow-up) Tidy and make executable the new test 2024-04-29 17:38:01 +02:00
Utils Bug 34913: Adjust C4::Utils::DataTables::VirtualShelves 2024-01-26 15:13:42 +01:00
api/v1 Bug 37018: Add 400 response definition to all routes 2024-07-25 15:10:22 +00:00
cronjobs
…
data Bug 35418: Add TR_B2 tests 2023-11-29 17:36:11 -03:00
misc/translator
…
mojo Bug 36598: (QA follow-up): tidy up code 2024-09-30 15:28:48 +00:00
selenium Bug 37373: (follow-up) Add id and adjust tests 2024-08-29 17:36:02 +00:00
www Bug 32693: Fix history.t 2024-05-08 18:23:57 +02:00
00-strict.t Bug 36999: Fix 00-strict.t fails to find koha_perl_deps.pl 2024-07-18 17:33:55 +00:00
Accounts.t Bug 34912: Add 14 hours to 1970 date in Account(s).t 2023-10-04 09:15:39 -04:00
Acquisition.t Bug 32132: (RM follow-up) Use testbuilder in Acquisitions.t 2024-04-24 10:08:28 +01:00
Amazon.t
…
ArticleRequests.t
…
AudioAlerts.t
…
Auth.t Bug 36575: (QA follow-up) 2024-06-06 10:49:20 +02:00
AuthUtils.t
…
Auth_with_cas.t
…
Auth_with_ldap.t Bug 29930: Regression tests 2024-01-26 15:13:48 +01:00
Auth_with_shibboleth.t Bug 33778: (QA follow-up) Update for master 2023-06-29 11:11:10 -03:00
AuthorisedValues.t Bug 28869: Unit tests 2024-05-17 10:36:24 +02:00
AuthoritiesMarc.t Bug 35989: (QA follow-up): Fix QA tests 2024-06-27 13:35:23 +00:00
AuthoritiesMarc_GetTagsLabels.t
…
Barcodes.t
…
Barcodes_ValueBuilder.t
…
Biblio.t Bug 36474: Unit tests 2024-09-24 15:22:52 +00:00
Biblio_holdsqueue.t
…
Breeding.t Bug 28166: (QA follow-up) Fix and tidy tests and code 2023-10-23 11:33:50 -03:00
Breeding_Auth.t Bug 33404: Add unit tests 2023-07-05 12:17:22 -03:00
Budgets.t Bug 31631: (QA follow-up) Tidy code 2023-10-18 15:41:37 -03:00
Cache.t
…
Calendar.t Bug 33727: (QA follow-up) perl tidy whole file 2023-07-14 12:14:37 -03:00
Charset.t
…
Circulation.t Bug 37016: Unit tests 2024-07-19 14:30:09 +00:00
Circulation_holdsqueue.t Bug 32496: Reduce unnecessary unblessings of objects in Circulation.pm 2023-09-22 10:52:39 -03:00
Clubs.t
…
Context.t Bug 32687: Get server version in Context::get_versions 2023-02-24 17:52:28 -03:00
Contract.t
…
CourseReserves.t Bug 36687: (RM follow-up) Fix unit tests 2024-05-09 09:22:00 +01:00
DecreaseLoanHighHolds.t Bug 32496: Reduce unnecessary unblessings of objects in Circulation.pm 2023-09-22 10:52:39 -03:00
Filter_MARC_ViewPolicy.t Bug 32648: Clear cache in Filter_MARC_ViewPolicy.t 2023-05-16 11:24:26 +02:00
Fines.t
…
FrameworkPlugin.t Bug 37146: Add tests 2024-07-25 14:21:56 +00:00
Heading.t Bug 33557: Add LinkerConsiderThesaurus system preference 2023-05-10 15:26:26 -03:00
Heading_MARC21.t Bug 33277: Do not search using thesaurus when linking non 6XX fields 2023-05-10 15:26:22 -03:00
Hold.t Bug 34032: (QA follow-up) Tidy code 2024-04-29 09:35:38 +02:00
Holds.t Bug 17617: Unit tests 2023-11-08 11:41:26 -03:00
HoldsQueue.t Bug 32565: (follow-up) Tidy 2024-04-30 14:32:07 +02:00
Holidays.t Bug 27249: Replace DateTime->now by dt_from_string 2023-10-17 14:45:34 -03:00
ILSDI_Services.t Bug 34893: (QA follow-up) Tidy code for qa script 2024-02-02 17:31:47 +01:00
ImportBatch.t Bug 32804: (QA follow-up) Typo ahs and fix ImportBatch.t 2023-03-17 09:59:12 -03:00
ImportExportFramework.t
…
Installer.t
…
Items.t Bug 36535: (bug 33568 follow-up) Add missing tests 2024-04-26 14:14:48 +02:00
Koha.t Bug 34812: Move subtests to db_dependent/Koha.t 2023-09-18 12:06:27 -03:00
Koha_Database.t
…
Koha_Elasticsearch.t Bug 35138: Fix Koha_Elasticsearch.t 2024-04-30 12:00:59 +02:00
Koha_ExternalContent_OverDrive.t
…
Koha_MetadataRecord_Authority.t
…
Koha_Misc_Files.t
…
Languages.t Bug 32775: (QA follow-up) remove useless empty line 2023-05-15 18:23:54 -03:00
Letters.t Bug 37623: Make t/db_dependent/Letters.t idempotent 2024-09-12 21:55:29 +00:00
LibraryGroups.t
…
Linker_Default.t Bug 35125: Respect LinkerConsiderThesaurus in update_cache 2024-10-25 21:35:48 +00:00
Linker_FirstMatch.t
…
Log.t Bug 25159: (QA follow-up) Tidy changes 2024-05-02 16:47:44 +02:00
MarcModificationTemplates.t Bug 24480: (follow-up) Adjust tests 2023-11-03 12:04:35 -03:00
Matcher.t Bug 33869: Move Matcher.t to t/db_dependent 2023-09-01 11:07:45 -03:00
Members.t Bug 26170: Add protected status for patrons 2023-11-01 17:23:06 -03:00
Message.t Bug 33192: (QA follow-up) Fix it-IT sample data and unit tests 2023-04-14 11:35:40 -03:00
MungeMarcPrice.t
…
Overdues.t Bug 36128: (QA follow-up) Add regression test 2024-07-19 15:21:50 +00:00
Passwordrecovery.t Bug 31739: Password recovery from staff fails if previous expired reset-entry exists. 2022-10-24 14:12:16 -03:00
PatronLists.t Bug 32730: Add Patron Lists tab to patron details and circulation pages 2023-11-01 17:23:09 -03:00
Patroncards.t
…
Patrons.t Bug 36508: Unit tests 2024-04-30 14:32:04 +02:00
Prices.t Bug 34967: Move to db_dependent 2023-10-03 09:24:50 -04:00
Record.t
…
RecordProcessor_EmbedSeeFromHeadings.t
…
Reports.t
…
Reserves.t Bug 36687: (RM follow-up) Fix unit tests 2024-05-09 09:22:00 +01:00
RotatingCollections.t Bug 29144: Remove opac_info from a few tests 2022-09-16 09:55:20 -03:00
Search.t Bug 36924: Remove warning "Value not allowed for auto_incr itemnumber in Item" 2024-05-23 17:51:15 +02:00
Serials.t Bug 37476: Unit tests 2024-08-29 16:59:23 +00:00
Serials_2.t
…
Service.t
…
ShelfBrowser.t
…
Sitemapper.t Bug 33871: Test where parameter in Sitemapper.t 2023-09-01 11:23:26 -03:00
SocialData.t Bug 33833: Move to db_dependent 2023-09-05 14:35:36 -03:00
StockRotationItems.t
…
StockRotationRotas.t
…
StockRotationStages.t
…
SuggestionEngine_ExplodedTerms.t
…
Suggestions.t Bug 19097: Adjust some GetMarcFromKohaField calls 2024-04-29 09:35:47 +02:00
TablesSettings.t
…
Tags.t Bug 31517: Remove unused get_tag function 2022-11-04 19:30:56 -03:00
Templates.t
…
TestBuilder.t Bug 28966: (QA follow-up) Fix failing unit tests 2023-07-26 15:41:12 -03:00
Upload.t Bug 31598: Fix random failure on Jenkins for Upload.t 2022-09-22 08:07:01 -03:00
UsageStats.t
…
Virtualshelves.t Bug 30418: Unit tests 2023-05-15 18:23:58 -03:00
XISBN.t
…
XSLT.t Bug 33733: Move to db_dependent 2023-05-16 12:38:16 +02:00
check_kohastructure.t
…
check_sysprefs.t Bug 29948: Adjust sysprefs.sql 2024-05-13 16:24:17 +02:00
db_structure.t
…
rollingloans.t Bug 32496: Reduce unnecessary unblessings of objects in Circulation.pm 2023-09-22 10:52:39 -03:00
sysprefs.t Bug 36793: Unit test 2024-05-17 10:36:34 +02:00
yaml.t
…
zebra_config.pl
…