This change improves the validation of the report ID passed by the user.
Test plan:
0. Apply the patch
1. koha-plack --restart kohadev
2. Create a SQL report
3. Go to /cgi-bin/koha/tools/scheduler.pl
4. Add in a Time, Date, and Email
5. Choose your report from the list
6. Click "Save"
7. Note that your report is saved
Signed-off-by: Phil Ringnalda <phil@chetcolibrary.org>
Signed-off-by: Marcel de Rooy <m.de.rooy@rijksmuseum.nl>
Signed-off-by: Fridolin Somers <fridolin.somers@biblibre.com>
This change replaces single quotes with double quotes to prevent XSS
for particular operations on the circ returns page.
Test plan:
0. Apply the patch
1. Go to http://localhost:8081/cgi-bin/koha/circ/returns.pl?print_slip=1&reserve_id=1
2. Note that a pring slip is generated
(you may need to allow popups)
3. To test the XSS is patched, try the proof-of-concept from the
bug report
Signed-off-by: Victor Grousset/tuxayo <victor@tuxayo.net>
Signed-off-by: Baptiste Wojtkowski <baptiste.wojtkowski@biblibre.com>
Signed-off-by: Marcel de Rooy <m.de.rooy@rijksmuseum.nl>
Signed-off-by: wainuiwitikapark <wainuiwitikapark@catalyst.net.nz>
(cherry picked from commit 89c6e32ee7)
Signed-off-by: Fridolin Somers <fridolin.somers@biblibre.com>
This change adds a Template::Toolkit filter which is invoked
via " | scrub_html type => 'note' ".
Test plan:
0. Apply the patch
1. prove t/Koha/Plugins/HtmlScrubber.t
Signed-off-by: Brendan Lawlor <blawlor@clamsnet.org>
Signed-off-by: Marcel de Rooy <m.de.rooy@rijksmuseum.nl>
Signed-off-by: wainuiwitikapark <wainuiwitikapark@catalyst.net.nz>
(cherry picked from commit c536935238)
Signed-off-by: Fridolin Somers <fridolin.somers@biblibre.com>
Test plan:
1) Run prove t/db_dependent/api/v1/erm_sushi_services.t - FAIL
2) Apply patch
3) Repeat step 1 - PASS
4) Inspect patch diff and note that last_audit has been added to the API definition
Signed-off-by: Paul Derscheid <paul.derscheid@lmscloud.de>
Please enter the commit message for your changes. Lines starting
Signed-off-by: wainuiwitikapark <wainuiwitikapark@catalyst.net.nz>
(cherry picked from commit 020a27cdd7)
Signed-off-by: Fridolin Somers <fridolin.somers@biblibre.com>
...and allow-guarantor functionality. Replaced by $c->auth->public($patron_id)
and/or $c->auth->public_guarantor($patron_id), where $patron_id is the patron's
id that owns the requested resource.
Old method, was applicable to both privileged and public routes:
api/v1/swagger/paths/route.yaml
x-koha-authorization:
allow-owner: true
allow-guarantor: true
New method, use public routes with no x-koha-authorization:
GET /public/route/{patron_id}
Koha/REST/V1/Controller#public_action:
sub public_action {
my $c = shift->openapi->valid_input or return;
my $patron_id = $c->param( 'patron_id' );
try {
# Throws an exception that will render a response of 401 if not
# authenticated and 403 if trying to access another user's resources
$c->auth->public($patron_id); #or $c->auth->public_guarantor($patron_id)
...
# other code
...
}
catch {
$c->unhandled_exception($_);
}
}
Another example of retrieving $patron_id when patron_id is not a request
parameter:
GET /public/another/object/{another_object_id}
my $patron_id = Another::Object->find($another_object_id)->borrowernumber;
try {
# 403 if $another_object_id does not belong to API user
$c->auth->public($patron_id);
...
Signed-off-by: Victor Grousset/tuxayo <victor@tuxayo.net>
Signed-off-by: Marcel de Rooy <m.de.rooy@rijksmuseum.nl>
Signed-off-by: Alex Buckley <alexbuckley@catalyst.net.nz>
(cherry picked from commit 8a1c0af3e4)
Signed-off-by: Fridolin Somers <fridolin.somers@biblibre.com>
To test:
1. perl -c Koha/REST/Plugin/Exceptions.pm
2. perl -c Koha/Exceptions/REST.pm
More tests coming in following patches.
Signed-off-by: Victor Grousset/tuxayo <victor@tuxayo.net>
Signed-off-by: Marcel de Rooy <m.de.rooy@rijksmuseum.nl>
Signed-off-by: Alex Buckley <alexbuckley@catalyst.net.nz>
(cherry picked from commit aa97527c37)
Signed-off-by: Fridolin Somers <fridolin.somers@biblibre.com>
For use_rfc3986() to work, we need at least Template::Toolkit 2.27.
Signed-off-by: Victor Grousset/tuxayo <victor@tuxayo.net>
Signed-off-by: Julian Maurice <julian.maurice@biblibre.com>
Signed-off-by: Alex Buckley <alexbuckley@catalyst.net.nz>
(cherry picked from commit 3371577b42)
Signed-off-by: Fridolin Somers <fridolin.somers@biblibre.com>
This change invokes Template::Filters->use_rfc3986 in the C4::Template
module.
Test plan:
0. Apply the patch
1. Note that "uri" and "url" filters now escape single quotes
Signed-off-by: Phil Ringnalda <phil@chetcolibrary.org>
Signed-off-by: Victor Grousset/tuxayo <victor@tuxayo.net>
Signed-off-by: Julian Maurice <julian.maurice@biblibre.com>
Signed-off-by: Alex Buckley <alexbuckley@catalyst.net.nz>
(cherry picked from commit 75e05bdd60)
Signed-off-by: Fridolin Somers <fridolin.somers@biblibre.com>
acqui/booksellers.tt and admin/currency.tt use | $HtmlTags without first
filtering the string they wrap.
Test plan:
1. Without the patch, load the URL in comment 1, note the alert()
2. Apply patch, load the URL in comment 1, no alert()
Sponsored-by: Chetco Community Public Library
Signed-off-by: Magnus Enger <magnus@libriotech.no>
Followed the test plan, works as advertised.
Signed-off-by: Jonathan Druart <jonathan.druart@bugs.koha-community.org>
Signed-off-by: Alex Buckley <alexbuckley@catalyst.net.nz>
(cherry picked from commit a5afd9c9c8)
Signed-off-by: Fridolin Somers <fridolin.somers@biblibre.com>
Combining three regexes into one. Typo replcing.
Adding a test with pipe in pwd.
Test plan:
Run t/SIP/Sip.t
Signed-off-by: Marcel de Rooy <m.de.rooy@rijksmuseum.nl>
Signed-off-by: Alex Buckley <alexbuckley@catalyst.net.nz>
(cherry picked from commit 34c0bd2c51)
Signed-off-by: Fridolin Somers <fridolin.somers@biblibre.com>
Koha's SIP2 server does a lot of logging, including all incoming
requests, in full. This means that passwords are logged, both for
the user the SIP2 client uses for logging into Koha, as well as
for the end users who provide a password to e.g. check something
out. This patch replaces passwords with three asterisks in
log strings, before they are written to the log.
To test, in ktd:
- Run the new tests:
$ prove t/db_dependent/SIP/Sip.t
- Tail the SIP2 logs:
$ sudo tail -f /var/log/koha/kohadev/sip*.log
- Telnet into the SIP2 server:
$ telnet localhost 6001
- Try logging in by pasting this into the telnet session:
"9300CNterm1|COmypassword|CPCPL|"
- Verify that "mypassword" is replaced by "***" in the logs
- Try different values for the password, including the correct password
which is "term1" in ktd
- Try other SIP2 messages that include password fields (AC, AD, CO)
Update 2024-12-03: Fix issues pointed out by QA.
Signed-off-by: Victor Grousset/tuxayo <victor@tuxayo.net>
Signed-off-by: Marcel de Rooy <m.de.rooy@rijksmuseum.nl>
Signed-off-by: Alex Buckley <alexbuckley@catalyst.net.nz>
(cherry picked from commit cb20df02a8)
Signed-off-by: Fridolin Somers <fridolin.somers@biblibre.com>
Signed-off-by: Magnus Enger <magnus@libriotech.no>
The new test fails without this patch, and passes
when it is applied.
Signed-off-by: Marcel de Rooy <m.de.rooy@rijksmuseum.nl>
Signed-off-by: wainuiwitikapark <wainuiwitikapark@catalyst.net.nz>
(cherry picked from commit 580fa86f25)
Signed-off-by: Fridolin Somers <fridolin.somers@biblibre.com>
Signed-off-by: Nick Clemens <nick@bywatersolutions.com>
Signed-off-by: Martin Renvoize <martin.renvoize@ptfs-europe.com>
Signed-off-by: Alex Buckley <alexbuckley@catalyst.net.nz>
(cherry picked from commit da96f8cfe5)
Signed-off-by: Fridolin Somers <fridolin.somers@biblibre.com>
Some SUSHI providers return ServiceActive instead of the documented Service_Active:
https://countermetrics.stoplight.io/docs/counter-sushi-api/f0dd30f814944-server-status
This ensures the test connection does not fail regardless of what is used
Signed-off-by: David Nind <david@davidnind.com>
Signed-off-by: Nick Clemens <nick@bywatersolutions.com>
Signed-off-by: Martin Renvoize <martin.renvoize@ptfs-europe.com>
Signed-off-by: Alex Buckley <alexbuckley@catalyst.net.nz>
(cherry picked from commit f8fb37b3fa)
Signed-off-by: Fridolin Somers <fridolin.somers@biblibre.com>
Test plan:
1) Apply only tests patch, run:
prove t/db_dependent/Koha/ERM/EUsage/UsageDataProvider.t
2) Verify tests fail
3) Apply fix patch
4) Run tests again, verify they pass
Signed-off-by: David Nind <david@davidnind.com>
Signed-off-by: Nick Clemens <nick@bywatersolutions.com>
Signed-off-by: Martin Renvoize <martin.renvoize@ptfs-europe.com>
Signed-off-by: Alex Buckley <alexbuckley@catalyst.net.nz>
(cherry picked from commit dfd9bc68cd)
Signed-off-by: Fridolin Somers <fridolin.somers@biblibre.com>
This change adds some double quotes where quotes were missing,
and replaces single quotes with double quotes, which prevents XSS.
Test plan:
0. Apply the patch
1. Create a subscription
2. Using the ID from the subscription, go to this page:
http://localhost:8081/cgi-bin/koha/serials/subscription-detail.pl?
print_routing_list_issue=1&subscriptionid=<SUBSCRIPTIONID>
3. Note that you're able to generate a print slip
(You may need to allow popups)
4. To check the security vulnerability is fixed, try the proof-of-concepts
attached to the bug report
Signed-off-by: Victor Grousset/tuxayo <victor@tuxayo.net>
Signed-off-by: Julian Maurice <julian.maurice@biblibre.com>
Signed-off-by: Paul Derscheid <paul.derscheid@lmscloud.de>
Signed-off-by: wainuiwitikapark <wainuiwitikapark@catalyst.net.nz>
(cherry picked from commit e4295598a2)
Signed-off-by: Fridolin Somers <fridolin.somers@biblibre.com>
This change adds double quotes to some template strings where
quotes are missing all together or single quotes are used incorrectly.
Test plan:
0. Apply the patch
1. Go to http://localhost:8081/cgi-bin/koha/catalogue/search.pl?q=test
2. Click on "Gairm"
3. Use the search result navigation box to go to the next result
On the left of the page. Just bellow the breadcrumb and
left of the record title.
4. Note that everything loads correctly
5. To test that the security hole has been fixed, try some of the
proof-of-concept attacks provided for biblionumber and searchid
Signed-off-by: Victor Grousset/tuxayo <victor@tuxayo.net>
Signed-off-by: Baptiste Wojtkowski <baptiste.wojtkowski@biblibre.com>
Signed-off-by: Paul Derscheid <paul.derscheid@lmscloud.de>
Signed-off-by: wainuiwitikapark <wainuiwitikapark@catalyst.net.nz>
(cherry picked from commit 6456c0b98d)
Signed-off-by: Fridolin Somers <fridolin.somers@biblibre.com>
This change prevents CSV Formula injection on DataTables exports
by escaping formula with a single quote prefix as per OWASP recommendations.
Test plan:
0. Apply patch
1. Go to http://localhost:8081/cgi-bin/koha/members/memberentry.pl
?op=edit_form&destination=circ&borrowernumber=51
2. Add the following in a "Circulation note"
=SUM(1+1)
3. Go to http://localhost:8081/cgi-bin/koha/members/member.pl
?quicksearch=1&circsearch=1&searchmember=koha
4. Click "Export" and choose "Excel" and "CSV"
5. Open those downloaded files in Excel
6. Note that the =SUM(1+1) function is prefixed with a single quote,
and is not automatically executed
Signed-off-by: Magnus Enger <magnus@libriotech.no>
Works as advertised. The problematic "cell" is exported as "'=SUM(1+1)".
Signed-off-by: Chris Cormack <chris@bigballofwax.co.nz>
Signed-off-by: Paul Derscheid <paul.derscheid@lmscloud.de>
Signed-off-by: wainuiwitikapark <wainuiwitikapark@catalyst.net.nz>
(cherry picked from commit dcb5cc1051)
Signed-off-by: Fridolin Somers <fridolin.somers@biblibre.com>
This just replicates the logic of bug 36060 for the 23.11.x branch.
Follow the same test plan as for that bug.
Signed-off-by: Baptiste <baptiste.wojtkowski@biblibre.com>
to test:
1- try to save an agreement with 81+ characters in License Info
2- it does not save
3- apply patch, updatedatabase
4- repeat 1, it works!
Signed-off-by: Lucas Gass <lucas@bywatersolutions.com>
Signed-off-by: Katrin Fischer <katrin.fischer@bsz-bw.de>
(cherry picked from commit 2512392b2a)
Signed-off-by: Paul Derscheid <paul.derscheid@lmscloud.de>
Signed-off-by: wainuiwitikapark <wainuiwitikapark@catalyst.net.nz>
(cherry picked from commit b0693468ff)
Signed-off-by: Fridolin Somers <fridolin.somers@biblibre.com>
To test from the OPAC:
1 - create a list with more than 10 items
2 - print the list -> there is a pagination and that only 10 items
are printed
3 - Apply patch
4 - print the list again -> every items are being printed
Signed-off-by: Sam Sowanick <sam.sowanick@corvallisoregon.gov>
Signed-off-by: Marcel de Rooy <m.de.rooy@rijksmuseum.nl>
[EDIT] Tidied: added a few spaces.
Signed-off-by: Katrin Fischer <katrin.fischer@bsz-bw.de>
(cherry picked from commit 8d0e7ff906)
Signed-off-by: wainuiwitikapark <wainuiwitikapark@catalyst.net.nz>
(cherry picked from commit 29a6f938e4)
Signed-off-by: Fridolin Somers <fridolin.somers@biblibre.com>
The database columns for liblibrarian and libopac in marc_tag_structure and
marc_subfield_structure are 255 characters, but the HTML maxlength in
/koha-tmpl/intranet-tmpl/prog/en/modules/admin/marctagstructure.tt and
/koha-tmpl/intranet-tmpl/prog/en/modules/admin/marc_subfields_structure.tt
limit tags to 100 characters and subfields to 80 characters.
Test plan:
1. Apply patch, restart_all
2. Administration - MARC bibliographic framework - for Default, Actions -
MARC Structure
3. For the 000 tag, Actions - Edit tag
4. In both the "Description in staff interface" and "Description in OPAC"
paste the 255 character string
1234567890 1234567890 1234567890 1234567890 1234567890 1234567890 1234567890 1234567890 1234567890 1234567890 1234567890 1234567890 1234567890 1234567890 1234567890 1234567890 1234567890 1234567890 1234567890 1234567890 1234567890 1234567890 1234567890 12
and click Save changes
5. Verify that the display shows all 255 characters, then Actions - Edit tag
and verify that the two inputs reloaded with all 255 characters, and that
you cannot type a 256th character, then click Cancel
6. For the 000 tag, Actions - Edit subfields
7. Paste the same string in both the staff interface and OPAC inputs, Save
changes, verify that all 255 characters show, click Edit subfields, verify
that all 255 characters reloaded in the inputs, verify that you cannot
type a 256th character
Sponsored-by: Chetco Community Public Library
Signed-off-by: Shi Yao Wang <shi-yao.wang@inlibro.com>
Signed-off-by: Lucas Gass <lucas@bywatersolutions.com>
Signed-off-by: Katrin Fischer <katrin.fischer@bsz-bw.de>
(cherry picked from commit a9044f4b34)
Signed-off-by: Paul Derscheid <paul.derscheid@lmscloud.de>
(cherry picked from commit a567f9b818)
Signed-off-by: Fridolin Somers <fridolin.somers@biblibre.com>
This patch updates the teams.yaml to include the voted in 25.05
release team.
Test plan
1/ Check against https://wiki.koha-community.org/wiki/Release_Teams
Signed-off-by: Katrin Fischer <katrin.fischer@bsz-bw.de>
Signed-off-by: wainuiwitikapark <wainuiwitikapark@catalyst.net.nz>
(cherry picked from commit f8ee288523)
Signed-off-by: Fridolin Somers <fridolin.somers@biblibre.com>
Might have been broken by the bootstrap 5 upgrade, but not sure.
Not sure why the click does not trigger the modal.
1. Place an order in acquisitions
1.1. Go to Acquisitions
1.2. Click 'Search' next to 'Search vendors'
1.3. Click 'Add to basket' next to 'My basket'
1.4. Search for an existing record (e.g. search for Shakespeare)
1.5. Click 'Add order' next to a result or in the detailed record
1.6. In the item form, choose an item type
1.7. Click 'Add item'
1.8. Choose a fund
1.9. Enter a price in 'Vendor price'
1.10. Click 'Save'
1.11. Click 'Close basket'
1.12. Click 'Yes, close'
2. Receive the order
2.1. Click 'Receive shipments'
2.2. Enter a value in 'Vendor invoice'
2.3. Click 'Next'
2.4. Click 'Receive' next to your order
=> The modal is shown
Signed-off-by: Michaela Sieber <michaela.sieber@kit.edu>
Signed-off-by: Owen Leonard <oleonard@myacpl.org>
Signed-off-by: Emily Lamancusa <emily.lamancusa@montgomerycountymd.gov>
Signed-off-by: Katrin Fischer <katrin.fischer@bsz-bw.de>
(cherry picked from commit ef455af344)
Signed-off-by: Lucas Gass <lucas@bywatersolutions.com>
(cherry picked from commit 15c702da91)
Signed-off-by: Fridolin Somers <fridolin.somers@biblibre.com>
17:39:54 koha_1 | # Failed test 'updated_on correctly saved on newly created user'
17:39:54 koha_1 | # at t/db_dependent/Auth_with_shibboleth.t line 319.
17:39:54 koha_1 | # Structures begin differing at:
17:39:54 koha_1 | # $got->[0] = '2024-11-19 16:39:30'
17:39:54 koha_1 | # $expected->[0] = '2024-11-19 16:39:29'
17:39:54 koha_1 | # Looks like you failed 1 test of 54.
We must use t::lib::Dates::compare to compare datetimes in tests.
Signed-off-by: Katrin Fischer <katrin.fischer@bsz-bw.de>
(cherry picked from commit ed25a48ccf)
Signed-off-by: Lucas Gass <lucas@bywatersolutions.com>
(cherry picked from commit 3b31cf80c3)
Signed-off-by: Fridolin Somers <fridolin.somers@biblibre.com>
Extend patch of 135a to cover all choices with all possible values as
described by IFLA for 135a.
Signed-off-by: David Nind <david@davidnind.com>
Signed-off-by: Marcel de Rooy <m.de.rooy@rijksmuseum.nl>
Signed-off-by: Katrin Fischer <katrin.fischer@bsz-bw.de>
(cherry picked from commit 9a72d3c757)
Signed-off-by: Lucas Gass <lucas@bywatersolutions.com>
(cherry picked from commit 5a07b6a869)
Signed-off-by: Fridolin Somers <fridolin.somers@biblibre.com>
This patch add more values to selection of 135a in UNIMARC
Test Plan:
1) Add on default framework the field 135a and check the Editor option
2) Set on plugin section the value of unimarc_field_135a.pl
3) Open cataloguing editor and use 135 field tag editor to select a value
4) Apply patch
5) Open cataloguing editor and use 135 field tag editor to select a value,
after patch you have more options to select
Signed-off-by: David Nind <david@davidnind.com>
Signed-off-by: Marcel de Rooy <m.de.rooy@rijksmuseum.nl>
Signed-off-by: Katrin Fischer <katrin.fischer@bsz-bw.de>
(cherry picked from commit 3fa03e2e66)
Signed-off-by: Lucas Gass <lucas@bywatersolutions.com>
(cherry picked from commit 4f7327c5c1)
Signed-off-by: Fridolin Somers <fridolin.somers@biblibre.com>
The schema says that subscription_frequencies.displayorder can be null, and
everything else deals with it being null just fine, but if you try to save
a new frequency without specifying display order with strict_sql_modes set,
you get an error.
Test plan:
1. Without the patch, Serials - Manage frequencies - New frequency
2. Description is mandatory, so fill it in, then click Save
3. Boom! Apply patch, restart_all
4. Repeat steps 1-2, and verify that no error is thrown and the new
frequency shows up (at the top of the list since nothing comes before
something)
5. New frequency, fill in Description, try typing something other than a
number in Display order and saving. You should be told to follow the
directions that only numeric characters are allowed
Sponsored-by: Chetco Community Public Library
Signed-off-by: David Nind <david@davidnind.com>
Signed-off-by: Aleisha Amohia <aleishaamohia@hotmail.com>
Signed-off-by: Katrin Fischer <katrin.fischer@bsz-bw.de>
(cherry picked from commit 77c003ed54)
Signed-off-by: Lucas Gass <lucas@bywatersolutions.com>
(cherry picked from commit 20c59c0171)
Signed-off-by: Fridolin Somers <fridolin.somers@biblibre.com>
David Cook
Jonathan Druart
Matt Blenkinsop
Lari Taskula
Phil Ringnalda
Marcel de Rooy
Magnus Enger
Julian Maurice
Fridolin Somers
Nick Clemens
Pedro Amorim
Lucas Gass
Martin Renvoize
wainuiwitikapark
Andrew Fuerste Henry
George Veranis
Didier Gautheron