gitea
/
Koha-clms
1
0
Fork 0
Code Issues Pull Requests Packages Projects Releases Wiki Activity
Koha-clms/admin
History
Galen Charlton 50d8aa80fb Bug 11666: remove SQL as an option for MARC framework exports and imports 
The SQL option for MARC framework imports was subject to a bug whereby
somebody could use it to gain access to arbitrary information in the
database by uploading an SQL file containing unexpected statements.

As it is difficult to securely sanitize SQL, this patch removes the
option to use SQL as an import or export format.

To test:

[1] Verify that SQL no longer appears as an import or export option
    for the MARC frameworks.
[2] Verify that exports and imports in CSV, Excel XML, and ODS formats
    still work.

Signed-off-by: Galen Charlton <gmc@esilibrary.com>
Signed-off-by: Tomas Cohen Arazi <tomascohen@gmail.com>
Works as advertised. The UI doesn't offer exporting/importing in the SQL format.
Crafting the URL to export SQL fallbacks to a spreadsheet format (ODS).

Signed-off-by: Katrin Fischer <Katrin.Fischer.83@web.de>
Works as described, passes all tests and QA script.

Signed-off-by: Galen Charlton <gmc@esilibrary.com>

Conflicts:
	koha-tmpl/intranet-tmpl/prog/en/modules/admin/biblio_framework.tt
 		2014-02-06 15:27:21 -05:00
..
admin-home.pl Bug 2505: Enabled warnings in admin-home.pl and roadtype.pl. 2009-09-06 09:13:14 -04:00
aqbudget_owner_search.pl bug_6253: Unified member Search() 2011-10-19 16:23:02 +13:00
aqbudgetperiods.pl Bug 6943: Added ability to duplicate a budget tree (from the edit sub menu) 2012-02-03 17:53:59 +01:00
aqbudgets.pl Bug 3969 follow-up = budget name field is budget_name, not name 2012-04-20 16:59:35 +02:00
aqcontract.pl Bug 7113: Standardize vendor id name in templates and scripts 2012-02-17 19:04:00 +01:00
aqplan.pl Bug 6752: Be stricter with utf-8 encoding of output 2012-01-27 12:11:06 +01:00
auth_subfields_structure.pl Bug 5462: modified intranet scripts to match templates 2011-02-03 09:57:24 +00:00
auth_tag_structure.pl Bug 5453: Move declarations out of conditionals 2011-07-15 15:50:20 +12:00
authorised_values.pl Bug 7795 - admin/authorised_values.pl breaks with plack 2012-03-26 18:08:28 +02:00
authtypes.pl Fix FSF address in directory admin/ 2010-03-16 20:17:50 -04:00
biblio_framework.pl Fix for Bug 4424, MARC Framework deletion incorrectly reports usage count 2010-04-29 20:59:29 -04:00
branch_transfer_limits.pl Bug 6842 FU : library transfer limits edits not stored 2012-02-01 22:47:56 +01:00
branches.pl bug_7264: [SIGNED-OFF] Branch popup on OPAC detail.Added opac_info field to branches table. 2012-03-22 11:50:00 +01:00
categorie.pl Fix for Bug 6872 - Can't set default SMS messaging options for patron category 2011-09-27 21:35:41 +13:00
check_budget_parent.pl Bug 5385: POD Cleanups (part 1) 2010-11-12 10:06:55 +13:00
check_parent_total.pl bug4438/MT5496 budget Exceeds total allocation 2011-03-14 20:45:58 +13:00
checkmarc.pl Bug 3768 (Bibliographic Framework Test) 2010-05-17 08:26:21 -04:00
cities.pl Fix for Bug 5433 - Separate state field for cities 2011-08-04 20:54:49 +12:00
classsources.pl Bug 2505 - Add commented use warnings where missing in the admin/ directory 2010-04-21 20:20:11 +12:00
clone-rules.pl Bug 2505 - Add commented use warnings where missing in the admin/ directory 2010-04-21 20:20:11 +12:00
currency.pl Bug 8907 - Last updated date does not appear on currency edit form 2012-10-25 09:16:22 +13:00
env_tz_test.pl Bug 2617: Add strict (and warnings), partial fix. 2009-03-11 08:36:55 -05:00
fieldmapping.pl Bug 8713 - Warning message triggered by clicking Keywords to MARC mapping 2012-09-19 14:47:33 +12:00
import_export_framework.pl Bug 11666: remove SQL as an option for MARC framework exports and imports 2014-02-06 15:27:21 -05:00
item_circulation_alerts.pl Bug 7798 - admin/item_circulation_alerts.pl plack scoping 2012-03-26 18:09:36 +02:00
itemtypes.pl BUG6436 Don't allow deletion of an itemtype used in items.itype 2011-06-03 14:24:54 +12:00
koha2marclinks.pl Using only default framework for koha2marclinks 2010-03-16 21:27:20 -04:00
marc_subfields_structure.pl Bug 8379 don't close dbh 2012-10-06 19:52:52 +13:00
marctagstructure.pl Bug 8849 - Error log generated when not a demo system 2012-10-25 09:18:33 +13:00
matching-rules.pl Bug 7800 - admin/matching-rules.pl plack scoping 2012-03-26 18:11:57 +02:00
oai_set_mappings.pl Bug 9201 OAI-PMH mapping value cannot be 0 2013-02-07 08:32:48 +13:00
oai_sets.pl Bug 6440: Implement OAI-PMH Sets 2012-03-20 11:38:26 +01:00
patron-attr-types.pl Bug 7801 - admin/patron-attr-types.pl plack scoping 2012-03-26 18:12:36 +02:00
preferences.pl Bug 8887: only display desired result when doing exact syspref search 2013-10-22 08:30:03 +13:00
printers.pl Bug 2505 - Add commented use warnings where missing in the admin/ directory 2010-04-21 20:20:11 +12:00
roadtype.pl Another bug 5004 fix, this time for road types 2010-11-19 09:29:48 +13:00
smart-rules.pl Bug 8772 - Uninitialized variable triggers error log entry in smart_rules.pl 2012-10-10 10:36:42 +13:00
stopwords.pl Fix FSF address in directory admin/ 2010-03-16 20:17:50 -04:00
systempreferences.pl Bug 8895 - Warning in systempreferences.pl: Use of uninitialized value in length... 2013-04-21 19:39:29 +12:00
z3950servers.pl Bug 10516 - Improve titles, breadcrumbs, and confirmation messages for Z39.50 server adds and updates 2013-09-17 19:50:18 +12:00