gitea
/
Koha-clms
1
0
Fork 0
Code Issues Pull Requests Packages Projects Releases Wiki Activity
62,351 Commits 39 Branches 720 Tags 6 GiB
Perl 44.2%
JavaScript 41.1%
HTML 6%
XSLT 3.1%
Vue 1.9%
Other 3.2%
Go to file
Sanjar Tulkinov Anvar o'g'li 074e0b7261
Bug 42736: Prevent SQL injection in reports/cat_issues_top.pl 
The "Most-circulated items" report built its SQL by concatenating the
Criteria and Filter request parameters directly into the query, with no
bind placeholders and no whitelist on the Criteria identifier. An
authenticated staff user with the reports permission could inject
arbitrary SQL and read any data reachable by the Koha database user.

This validates the Criteria parameter against a fixed allow-list of the
report's own column options (matching reports/cat_issues_top.tt) so it
is safe to use as a SQL identifier, and binds every Filter value with a
placeholder in both the column-header query and the main calculation
query. The Limit parameter is validated as a plain integer.

This mirrors the fix already applied to the sibling
reports/bor_issues_top.pl (bug 42369).

Test plan:
0. Apply the patch
1. koha-plack --restart kohadev
2. Go to Reports > Most-circulated items (reports/cat_issues_top.pl)
3. Run the report with various Criteria and Filter values, confirm the
   output is correct and no errors appear
4. Before the patch, a Filter value or the Criteria containing SQL (a
   single quote followed by a subquery) broke out of the query. After
   the patch, confirm such input is treated as a literal value: you get
   normal output or an empty result, with no SQL error, no delay, and no
   data leak

Signed-off-by: Sanjar Tulkinov Anvar o'g'li <sanjarbiy11@gmail.com>
Signed-off-by: David Cook <dcook@prosentient.com.au>
Signed-off-by: Aleisha Amohia <aleisha@catalyst.net.nz>
Signed-off-by: Pedro Amorim <pedro.amorim@openfifth.co.uk>
 		2026-08-26 09:23:29 +00:00
.github/workflows Bug 40027: Use GitHub workflow to automatically close PRs opened on the Koha repo there 2025-10-06 09:15:26 -06:00
C4 Bug 39959: Add a total column to the invoices table 2026-08-25 08:56:32 +00:00
Koha Bug 39337: (follow-up) Default to not suppressing OAI records 2026-08-25 08:56:28 +00:00
acqui Bug 12278: Add a total column to the table in parcels.pl 2026-08-25 08:56:29 +00:00
admin Bug 34166: Add total column to suggestions table 2026-08-21 15:58:24 +00:00
api Bug 42207: Allow library embed on GET /patrons/{patron_id} 2026-08-21 15:58:25 +00:00
authorities Bug 21453: Copy data to the correct subfields when linking authorities with authorities 2026-04-23 09:24:58 -06:00
basket Bug 40163: Fix several http addresses in the code docs 2025-09-23 16:21:29 -06:00
bin Bug 40163: (follow-up) Fix wrong GNU links and update test 2025-09-24 09:25:04 -06:00
bookings Bug 40163: Fix several http addresses in the code docs 2025-09-23 16:21:29 -06:00
catalogue Bug 42567: Remove C4::Koha::GetNormalizedEAN in favor of MetadataExtractor 2026-08-20 15:34:10 +00:00
cataloguing Bug 42512: Pass already checked/cleaned MARC::Record to Metadata Extractor 2026-07-16 10:54:18 +00:00
circ Bug 42930: Replace title with borrowertitle 2026-07-27 12:12:51 +00:00
clubs Bug 40163: Fix several http addresses in the code docs 2025-09-23 16:21:29 -06:00
course_reserves Bug 40163: Fix several http addresses in the code docs 2025-09-23 16:21:29 -06:00
debian Bug 43159: Restore localisation of PERL5LIB and KOHA_HOME 2026-07-31 13:40:33 +00:00
docs Bug 42726: Add 26.11 release team 2026-06-02 15:07:16 +00:00
erm Bug 40163: Fix several http addresses in the code docs 2025-09-23 16:21:29 -06:00
errors Bug 28146: Respect ReplytoDefault in error pages 2025-10-09 14:58:41 -06:00
etc Bug 37762: VueJS ILL Module 2026-05-08 12:25:38 -06:00
ill Bug 37762: Circulation: Hook to checkouts/checkins 2026-05-08 12:25:43 -06:00
installer Bug 43342: Remove line due to template toolkit 2026-08-21 14:31:40 +00:00
koha-tmpl Bug 42322: (follow-up) Correct markup of ILL sidebar menu 2026-08-25 08:56:45 +00:00
labels Bug 42764: Fix spelling errors across the codebase 2026-06-03 16:09:04 +00:00
lib Bug 41521: Silent perlcritic warnings 2026-03-24 09:55:54 +01:00
members Bug 43245: Redirect user if no email was provided 2026-08-14 12:09:30 +00:00
misc Bug 35061: Fix documentation for -pf|preserve-field in import_patrons.pl 2026-08-21 15:58:20 +00:00
offline_circ Bug 40492: Improvements to offline circ actions table 2026-07-28 14:32:44 +00:00
opac Bug 39337: Add is_opac_suppressed helper to C4::Context 2026-08-25 08:56:25 +00:00
patron_lists Bug 32176: Remove duplicated code to select patron from autocomplete 2025-10-31 15:26:25 -06:00
patroncards Bug 42747: (QA follow-up) Parameterize query, dedupe, and log rejections 2026-08-11 12:39:40 +00:00
plugins Bug 25952: Skip invalid repositories when searching for plugins 2025-11-21 08:41:52 -07:00
pos Bug 40445: (QA follow-up) Show cashup summary modal when completing from registers.pl 2026-07-27 12:12:41 +00:00
preservation Bug 35267: Apply preferences to preview and mailing 2026-04-17 09:18:06 -06:00
recalls Bug 40163: Fix several http addresses in the code docs 2025-09-23 16:21:29 -06:00
reports Bug 42736: Prevent SQL injection in reports/cat_issues_top.pl 2026-08-26 09:23:29 +00:00
reserve Bug 42999: Fix $valid_items flag contamination in reserve/request.pl 2026-07-16 17:05:21 +00:00
reviews Bug 40163: Fix several http addresses in the code docs 2025-09-23 16:21:29 -06:00
rotating_collections Bug 40163: Fix several http addresses in the code docs 2025-09-23 16:21:29 -06:00
serials Bug 43239: Preserve item item type if previousitemtype column is undefined 2026-08-12 15:49:49 +00:00
services Bug 40163: Fix several http addresses in the code docs 2025-09-23 16:21:29 -06:00
sip2 Bug 37893: Fix http links 2025-11-18 11:21:20 -07:00
skel
…
suggestion Bug 42919: Retain suggestion form values when duplicate warning is shown 2026-07-16 17:05:13 +00:00
svc Bug 42084: (QA follow-up) Simplify 2026-06-03 12:08:17 +00:00
t Bug 42322: Add Cypress tests 2026-08-25 08:56:46 +00:00
tags Bug 42254: (QA follow-up) Remove unused var, fixing a FIXME 2026-04-28 15:48:24 -06:00
tools Bug 41105: (QA follow-up) DRY out gender label rendering 2026-08-14 12:09:18 +00:00
virtualshelves Bug 42567: Remove C4::Koha::GetNormalizedEAN in favor of MetadataExtractor 2026-08-20 15:34:10 +00:00
xt Bug 42714: RM follow-up: Fix tests 2026-08-13 11:28:40 +00:00
.codespell-ignore Bug 42764: Fix false positives caused by POD letter-code formatting 2026-06-03 16:09:05 +00:00
.editorconfig
…
.git-blame-ignore-revs Bug 39096: Add 'tidy all' commits to a git blame ignore file 2025-02-17 13:10:25 +01:00
.gitignore Bug 26355: Add a Vue island for the self-renewal modal 2026-05-01 09:30:00 -06:00
.htaccess
…
.mailmap Bug 40041: (follow-up) Fix periods and add Robert Fox 2025-12-05 09:29:04 -07:00
.nvmrc Bug 42353: Store the node version in .nvmrc 2026-04-15 09:14:53 -06:00
.perlcriticrc
…
.perltidyrc
…
.prettierrc.js Bug 38664: Treat .vue files like other JS files 2025-02-11 14:58:25 +01:00
.proverc.dist
…
.stylelintrc.json
…
INSTALL
…
Koha.pm Bug 41029: DBRev 26.06.00.016 2026-08-19 16:07:59 +00:00
LICENSE Bug 40163: Fix several http addresses in the code docs 2025-09-23 16:21:29 -06:00
MANIFEST.SKIP
…
Makefile.PL Bug 42886: Add missing rtl 2026-07-16 10:54:35 +00:00
README
…
README.md Bug 40163: Fix several http addresses in the code docs 2025-09-23 16:21:29 -06:00
README.robots
…
SECURITY.md Bug 40527: Initial draft of SECURITY.md 2025-10-09 14:58:41 -06:00
about.pl Bug 42453: Remove warning 2026-06-29 15:39:07 +00:00
app.psgi Bug 38365: Integrate CSP middleware into Plack apps 2026-03-16 11:57:12 +01:00
build-resources.PL Bug 40163: (follow-up) Fix wrong GNU links and update test 2025-09-24 09:25:04 -06:00
changelanguage.pl Bug 40163: Fix several http addresses in the code docs 2025-09-23 16:21:29 -06:00
cpanfile Bug 41717: Bump PDF::Reuse and PDF::Reuse::Barcode versions 2026-07-28 14:32:22 +00:00
cypress.config.ts Bug 42772: Cypress.env => cy.env 2026-07-20 12:45:01 +00:00
eslint.config.mjs Bug 38524: Enable ESLint for .ts and .vue files 2025-01-16 15:56:17 +01:00
fix-perl-path.PL Bug 40163: (follow-up) Fix wrong GNU links and update test 2025-09-24 09:25:04 -06:00
gulpfile.js Bug 42356: Silence Sass if-function deprecation warning 2026-04-17 09:18:15 -06:00
help.pl Bug 40163: Fix several http addresses in the code docs 2025-09-23 16:21:29 -06:00
kohaversion.pl Bug 38664: Tidy the whole codebase 2025-02-11 14:58:24 +01:00
mainpage.pl Bug 40163: Fix several http addresses in the code docs 2025-09-23 16:21:29 -06:00
package.json Bug 43091: Clean the OPAC Vue dist directory in js:clean 2026-08-03 13:00:37 +00:00
rewrite-config.PL Bug 40163: (follow-up) Fix wrong GNU links and update test 2025-09-24 09:25:04 -06:00
rspack.config.js Bug 43091: Stop emitting staff-only Vue islands into the OPAC dist 2026-08-03 13:00:36 +00:00
tsconfig.json
…
yarn.lock Bug 42772: Adjust yarn.lock 2026-07-20 12:45:02 +00:00

README.md

Koha is a free software integrated library system (ILS).

Koha is distributed under the GNU GPL version 3 or later.

Note: Koha does not accept pull requests from git hosting sites.

Note: This project has its own bug tracker, to report a bug or submit a patch visit https://bugs.koha-community.org.

For guidelines on submitting patches for Koha please visit https://wiki.koha-community.org/wiki/SubmitingAPatch

The developers handbook can be found at https://wiki.koha-community.org/wiki/Developer_handbook

https://koha-community.org/

Koha Logo