gitea
/
Koha-clms
1
0
Fork 0
Code Issues Pull Requests Packages Projects Releases Wiki Activity
Koha-clms/admin
History
David Cook f3965b7fb6 Bug 14521 - SQL injection in local use system preferences 
This patch fixes a SQL injection vulnerability in the local use
system preferences.

_TEST PLAN_

Before applying:

1) Go to Global System Preferences
2) Click on the "Local use" tab
3) Add a new preference with the value "') or '1' = '1' -- "
(be sure to include the space at the end after the comment --).
4) When the page refreshes, you should now see about 99 other system
preferences which shouldn't be showing up.

5) Apply the patch

6) Refresh the page
7) Note that you now only see a system preference for "') or '1' = '1' -- "
and the other actual local use system preferences.

Signed-off-by: Chris Cormack <chrisc@catalyst.net.nz>

Signed-off-by: Jonathan Druart <jonathan.druart@bugs.koha-community.org>
Signed-off-by: Mason James <mtj@kohaaloha.com>
 		2015-07-26 01:20:19 +12:00
..
searchengine/solr Bug 8233 : SearchEngine: Add a Koha::SearchEngine module 2012-07-06 16:51:58 +02:00
admin-home.pl bug_8083: parameters subpermissions: manage_circ_rules and parameters_remaining_permissions 2012-07-23 10:43:59 +02:00
aqbudget_user_search.pl Bug 7304: More permissions for budgets 2012-06-27 16:25:44 +02:00
aqbudgetperiods.pl Bug 9108: Followup: send the dateformat value from C4::Auth 2013-01-17 21:59:30 -05:00
aqbudgets.pl Bug 12168: fix spent and ordered budget values are wrong when depth >= 2 2014-05-19 21:54:41 +00:00
aqcontract.pl Bug 8913 [Revised] Improve acquisitions navigation 2013-02-20 09:17:21 -05:00
aqplan.pl Bug 766: remove disused routine buildCGISort 2014-05-04 23:03:24 +00:00
auth_subfields_structure.pl Bug 11508: fix untranslatable pull-down in auth_subfields_structure.pl 2014-04-19 14:40:41 +00:00
auth_tag_structure.pl Bug 11767 - Use validation plugin when creating new authority framework tag 2014-02-19 15:51:12 +00:00
authorised_values.pl Bug 13401 - sort branches alphabetically in admin/authorised_values.pl 2015-02-26 17:28:14 +13:00
authtypes.pl bug_8083: parameters subpermissions: manage_circ_rules and parameters_remaining_permissions 2012-07-23 10:43:59 +02:00
biblio_framework.pl bug_8083: parameters subpermissions: manage_circ_rules and parameters_remaining_permissions 2012-07-23 10:43:59 +02:00
branch_transfer_limits.pl Bug 8539: Library transfer limits page has incorrect permission 2014-08-26 22:26:52 +00:00
branches.pl Bug 8802: On editing a library group category type is not set 2015-07-26 01:20:13 +12:00
categorie.pl Bug 6739: make it possible to block expired patrons from OPAC actions 2014-05-05 01:49:05 +00:00
check_budget_parent.pl Bug 5385: POD Cleanups (part 1) 2010-11-12 10:06:55 +13:00
check_parent_total.pl Bug 11675: check allocated total correctly when editing a fund that has a parent fund 2014-03-11 17:09:31 +00:00
checkmarc.pl bug_8083: parameters subpermissions: manage_circ_rules and parameters_remaining_permissions 2012-07-23 10:43:59 +02:00
cities.pl bug_8083: parameters subpermissions: manage_circ_rules and parameters_remaining_permissions 2012-07-23 10:43:59 +02:00
classsources.pl bug_8083: parameters subpermissions: manage_circ_rules and parameters_remaining_permissions 2012-07-23 10:43:59 +02:00
clone-rules.pl bug_8083: parameters subpermissions: manage_circ_rules and parameters_remaining_permissions 2012-07-23 10:43:59 +02:00
currency.pl Bug 9593: improve parsing of prices from staged files 2014-05-04 22:02:08 +00:00
didyoumean.pl Bug 8726: ExplodedTerms suggestion plugin (functionality) 2012-09-28 17:08:21 +02:00
env_tz_test.pl bug_8083: parameters subpermissions: manage_circ_rules and parameters_remaining_permissions 2012-07-23 10:43:59 +02:00
fieldmapping.pl Bug 8713 - Warning message triggered by clicking Keywords to MARC mapping 2012-09-17 18:48:21 +02:00
import_export_framework.pl Bug 9114: Make frameworks import/export routines correctly use UTF-8 2014-03-14 14:37:31 +00:00
item_circulation_alerts.pl bug_8083: parameters subpermissions: manage_circ_rules and parameters_remaining_permissions 2012-07-23 10:43:59 +02:00
itemtypes.pl Bug 11351: (follow-up) ensure itemtypes.sip_media_type is set to NULL when cleared 2014-04-28 18:08:58 +00:00
koha2marclinks.pl bug_8083: parameters subpermissions: manage_circ_rules and parameters_remaining_permissions 2012-07-23 10:43:59 +02:00
marc_subfields_structure.pl Bug 8018: (followup) make the default more explicit 2013-12-27 00:34:50 +00:00
marctagstructure.pl Bug 11771 - Use validation plugin when creating new MARC framework tag 2014-02-19 00:03:24 +00:00
matching-rules.pl Bug 7475: Teach matching rules to handle authorities 2012-09-19 17:15:56 +02:00
oai_set_mappings.pl Bug 9295: Introduce operator equal/ notequal to OAI set mapping instead of hardcoded 'equal' value. 2013-10-10 23:03:30 +00:00
oai_sets.pl bug_8083: parameters subpermissions: manage_circ_rules and parameters_remaining_permissions 2012-07-23 10:43:59 +02:00
patron-attr-types.pl Bug 7919 : Display of values depending on the connexion library 2012-12-05 10:10:57 -05:00
preferences.pl Bug 12279: Diacritics in system preference editor broken 2014-06-02 16:38:24 +00:00
printers.pl bug_8083: parameters subpermissions: manage_circ_rules and parameters_remaining_permissions 2012-07-23 10:43:59 +02:00
smart-rules.pl Bug 7413: (follow-up) validate norenewalbefore values better 2014-04-08 22:46:28 +00:00
stopwords.pl bug_8083: parameters subpermissions: manage_circ_rules and parameters_remaining_permissions 2012-07-23 10:43:59 +02:00
systempreferences.pl Bug 14521 - SQL injection in local use system preferences 2015-07-26 01:20:19 +12:00
transport-cost-matrix.pl Bug 11531: make it possible to edit transport cost for a new libraries 2014-03-12 18:01:43 +00:00
z3950servers.pl Bug 10096 - Add a Z39.50 interface for authority searching 2013-10-04 14:26:29 +00:00