gitea
/
Koha-clms
1
0
Fork 0
Code Issues Pull Requests Packages Projects Releases Wiki Activity
26,680 Commits 39 Branches 720 Tags 6 GiB
Perl 44.2%
JavaScript 41.1%
HTML 6%
XSLT 3.1%
Vue 1.9%
Other 3.2%
Go to file
Jonathan Druart f01720808a Bug 16593: Do not allow patrons to delete search history of others patrons 
A malicious user can delete the search history of all other users by
correctly guessing the ID value assigned to the victim's search. As
searches are assigned values sequentially, an attacker could quickly
remove the searches belonging to all of the application's users.

To reproduce:
Login with patron A
launch a search
Note the id generated for this search history:
select id from search_history order by id desc limit 1;
Login with patron B
Hit /cgi-bin/koha/opac-search-history.pl?action=delete&id=<ID>
Note that the row is deleted in the DB

Test plan
Confirm that this patch fixes the issue.
The same test can be made at the staff interface

Reported by Alex Middleton at Dionach

Signed-off-by: Chris Cormack <chrisc@catalyst.net.nz>

Signed-off-by: Kyle M Hall <kyle@bywatersolutions.com>

Signed-off-by: Kyle M Hall <kyle@bywatersolutions.com>
 		2016-06-24 11:47:29 +00:00
C4 Bug 16534: (followup) - Tidy AddIssue 2016-06-24 11:45:01 +00:00
Koha Bug 16720: Remove DBIx ActionLogs.pm 2016-06-17 14:37:55 +00:00
OpenILS
…
acqui Bug 15531: (QA followup) Fix several small issues 2016-04-29 13:07:18 +00:00
admin Bug 13074: Use Koha::Cache to cache the defaults values of a MARC record 2016-06-17 14:29:59 +00:00
api/v1 Bug 13903: (QA followup) change routes to /holds 2016-05-04 13:54:01 +00:00
authorities Bug 16154: CGI->multi_param - Force scalar context 2016-04-26 23:16:43 +00:00
basket Bug 16447: Remove occurrence of the borrow permission which does no longer exist 2016-05-05 21:28:14 +00:00
catalogue Bug 16593: Do not allow patrons to delete search history of others patrons 2016-06-24 11:47:29 +00:00
cataloguing Bug 16154: CGI->multi_param - Force scalar context 2016-04-26 23:16:43 +00:00
circ Bug 16527: Restore sticky due date behavior 2016-06-24 11:46:35 +00:00
course_reserves Bug 16154: CGI->multi_param - Force scalar context 2016-04-26 23:16:43 +00:00
debian Bug 16647: update debian/control for 16.* 2016-06-10 17:06:36 +00:00
docs Revert "Bug 7143 - Bug for tracking changes to the about page" 2016-06-04 15:46:28 +03:00
errors Bug 15288: Error pages: Code duplication removal and better translatability 2016-01-27 05:57:34 +00:00
etc Bug 15555: Index 024$a into Identifier-other:u url register when source $2 is uri 2016-04-29 13:19:28 +00:00
install_misc Bug 15303 Letsencrypt option for Debian package installations 2016-04-29 13:04:31 +00:00
installer Bug 10459 - DBRev 16.06.00.002 2016-06-10 17:15:21 +00:00
koha-tmpl Bug 16534: (followup) Correct tiny typo 2016-06-24 11:45:01 +00:00
labels Bug 16154: CGI->multi_param - Assign a list 2016-04-26 23:16:43 +00:00
members Bug 14605 - Corrects the individual fine's description 2016-06-10 17:34:08 +00:00
misc Bug 16672: Fix typo unqiue vs unique 2016-06-17 15:45:54 +00:00
offline_circ Bug 15764: Fix timestamp sent by KOCT 2016-02-23 20:53:18 +00:00
opac Bug 16593: Do not allow patrons to delete search history of others patrons 2016-06-24 11:47:29 +00:00
patron_lists Bug 16154: CGI->multi_param - Force scalar context 2016-04-26 23:16:43 +00:00
patroncards Bug 16747 - Patron card creator broken with version 16.05 2016-06-21 20:48:50 +00:00
plugins Bug 14951: Remove C4::Dates from plugins/*.pl files 2015-10-06 10:29:42 -03:00
reports Bug 16594: Fix obvious QA issues from bug 11371 2016-06-17 14:53:45 +00:00
reserve Bug 16693: Remove reserve/renewscript.pl 2016-06-17 15:58:03 +00:00
reviews Bug 14779: Cannot paginate reviews 2015-09-07 11:38:26 -03:00
rotating_collections Bug 15066: Make transfer rotating collection works under Plack 2015-11-05 09:50:09 -03:00
selenium
…
serials Bug 16154: Fix some other occurrences 2016-04-26 23:16:44 +00:00
services Bug 9978: Replace license header with the correct license (GPLv3+) 2015-04-20 09:59:38 -03:00
skel
…
sms Bug 15258: Fix Perl scripts declaring unused variables 2015-12-30 17:24:45 -07:00
suggestion Bug 16154: CGI->multi_param - Declare a list 2016-04-26 23:16:42 +00:00
svc Bug 16508: Updating a syspref requires parameters_remaining_permissions 2016-06-06 17:33:18 +00:00
t Bug 16534: Add tests for AddIssue 2016-06-24 11:45:00 +00:00
tags Bug 16154: CGI->multi_param - Assign a list 2016-04-26 23:16:43 +00:00
test Bug 9819 - 'stopwords'-related code removed 2015-12-30 15:49:35 +00:00
tmp/modified_authorities
…
tools Bug 16148 - Revised layout and behavior of marc modification template management 2016-06-17 16:11:43 +00:00
virtualshelves Bug 16484 - Virtualshelves: Using no XSLTResultsDisplay breaks content display in intranet 2016-05-23 17:25:24 +00:00
xt Bug 16174: (QA followup) Fix remaining tests 2016-04-01 19:11:33 +00:00
.editorconfig
…
.htaccess
…
.mailmap (RM followup) .mailmap updates 2015-05-22 17:02:21 -03:00
INSTALL
…
INSTALL.debian
…
INSTALL.fedora7 Bug 13642 - Remove MARC::Crosswalk::DublinCore from Koha 2016-01-27 06:23:08 +00:00
INSTALL.opensuse
…
INSTALL.ubuntu
…
Koha.pm Bug 10459 - DBRev 16.06.00.002 2016-06-10 17:15:21 +00:00
LICENSE
…
MANIFEST.SKIP
…
Makefile.PL Bug 16222: (QA followup) Add /api dir for the API 2016-04-20 21:18:36 +00:00
README
…
README.md Bug 15465 [QA Followup] - Update wording, switch logo, add links 2016-02-24 04:02:26 +00:00
README.robots
…
about.pl Bug 12721 - Syspref StatisticsFields: Warning on About page and text change in System preferences 2016-04-29 02:48:30 +00:00
changelanguage.pl Bug 9978: (followup) Replace license header with the correct license (GPLv3+) 2015-04-20 09:59:43 -03:00
edithelp.pl Bug 16447: Remove occurrence of the borrow permission which does no longer exist 2016-05-05 21:28:14 +00:00
fix-perl-path.PL Bug 9978: (followup) Replace license header with the correct license (GPLv3+) 2015-04-20 09:59:43 -03:00
help.pl Bug 14812: Display the help in the correct language 2015-10-02 15:06:08 -03:00
install-CPAN.pl Bug 9978: Replace license header with the correct license (GPLv3+) 2015-04-20 09:59:38 -03:00
koha_perl_deps.pl
…
kohaversion.pl Bug 13758: Move the Koha version from kohaversion.pl 2015-05-07 11:39:04 -03:00
mainpage.pl Bug 15548: Move new patron related code to Patron* 2016-03-03 14:38:26 -07:00
rewrite-config.PL Bug 16222: (QA followup) Add /api dir for the API 2016-04-20 21:18:36 +00:00

README.md

Koha is a free software integrated library system (ILS).

Koha is distributed under the GNU GPL version 3 or later.

Note: This is a synced mirror of the official Koha repo.

Note: Koha does not accept pull requests from git hosting sites.

Note: This project has its own bug tracker, to report a bug or submit a patch visit http://bugs.koha-comminity.org.

For guidelines on submitting patches for Koha please visit https://wiki.koha-community.org/wiki/SubmitingAPatch

The developers handbook can be found at https://wiki.koha-community.org/wiki/Developer_handbook

http://koha-community.org/

Koha Logo