gitea
/
Koha-clms
1
0
Fork 0
Code Issues Pull Requests Packages Projects Releases Wiki Activity
59,297 Commits 39 Branches 720 Tags 6 GiB
Perl 44.2%
JavaScript 41.1%
HTML 6%
XSLT 3.1%
Vue 1.9%
Other 3.2%
Go to file
Sanjar Tulkinov Anvar o'g'li 1880e0f6f6
Bug 42736: Prevent SQL injection in reports/cat_issues_top.pl 
The "Most-circulated items" report built its SQL by concatenating the
Criteria and Filter request parameters directly into the query, with no
bind placeholders and no whitelist on the Criteria identifier. An
authenticated staff user with the reports permission could inject
arbitrary SQL and read any data reachable by the Koha database user.

This validates the Criteria parameter against a fixed allow-list of the
report's own column options (matching reports/cat_issues_top.tt) so it
is safe to use as a SQL identifier, and binds every Filter value with a
placeholder in both the column-header query and the main calculation
query. The Limit parameter is validated as a plain integer.

This mirrors the fix already applied to the sibling
reports/bor_issues_top.pl (bug 42369).

Test plan:
0. Apply the patch
1. koha-plack --restart kohadev
2. Go to Reports > Most-circulated items (reports/cat_issues_top.pl)
3. Run the report with various Criteria and Filter values, confirm the
   output is correct and no errors appear
4. Before the patch, a Filter value or the Criteria containing SQL (a
   single quote followed by a subquery) broke out of the query. After
   the patch, confirm such input is treated as a literal value: you get
   normal output or an empty result, with no SQL error, no delay, and no
   data leak

Signed-off-by: Sanjar Tulkinov Anvar o'g'li <sanjarbiy11@gmail.com>
Signed-off-by: David Cook <dcook@prosentient.com.au>
Signed-off-by: Aleisha Amohia <aleisha@catalyst.net.nz>
Signed-off-by: Wainui Witika-Park <wainuiwitikapark@catalyst.net.nz>
 		2026-08-19 12:30:41 +12:00
.github/workflows Bug 40027: Use GitHub workflow to automatically close PRs opened on the Koha repo there 2025-10-23 23:06:52 +02:00
C4 RMAINT followup for Bug 42847 - remove extra parentheses 2026-08-18 16:00:18 +12:00
Koha Merge remote-tracking branch 'upstream/25.05.x' into HEAD 2026-08-05 16:20:01 +12:00
acqui Bug 41594: [25.05.x] Disable access to invoice-files.pl if AcqEnableFiles disabled 2026-04-21 12:02:52 -06:00
admin Bug 41076: [25.05.x] Adjust perl tidiness 2026-02-24 08:35:34 -07:00
api Bug 41594: [25.05.x] Add Cypress tests 2026-04-21 12:02:52 -06:00
authorities Bug 40163: Fix several http addresses in the code docs 2026-01-07 14:32:30 +00:00
basket Bug 40163: Fix several http addresses in the code docs 2026-01-07 14:32:30 +00:00
bin Bug 40163: (follow-up) Fix wrong GNU links and update test 2026-01-07 14:32:37 +00:00
bookings Bug 40163: Fix several http addresses in the code docs 2026-01-07 14:32:30 +00:00
catalogue Bug 34879: Remove unused file from Koha 2026-03-30 18:02:28 -04:00
cataloguing Bug 42262: encodeURIComponent for the 006 value 2026-07-13 11:54:07 +12:00
circ Bug 21941: Fix GROUP BY in circ/reserveratios.pl 2026-07-21 14:26:09 +12:00
clubs Bug 40163: Fix several http addresses in the code docs 2026-01-07 14:32:30 +00:00
course_reserves Bug 40163: Fix several http addresses in the code docs 2026-01-07 14:32:30 +00:00
debian Bug 41337: Add missing Bash variable to `koha-create` 2026-07-17 13:01:58 +12:00
docs Bug 42726: Add 26.11 release team 2026-06-23 13:46:37 +12:00
erm Bug 40163: Fix several http addresses in the code docs 2026-01-07 14:32:30 +00:00
errors Bug 40163: Fix several http addresses in the code docs 2026-01-07 14:32:30 +00:00
etc Bug 39164: (QA follow-up) Add setting to koha conf files 2026-06-19 12:47:43 +12:00
ill Bug 41076: [25.05.x] Adjust perl tidiness 2026-02-24 08:35:34 -07:00
installer Increment version for 25.05.13 release 2026-08-05 16:33:35 +12:00
koha-tmpl Bug 8127: Fix filters use in 'Most-circulated items report' 2026-08-19 12:30:36 +12:00
labels Bug 40163: Fix several http addresses in the code docs 2026-01-07 14:32:30 +00:00
lib Bug 38664: Tidy the whole codebase 2025-02-11 14:58:24 +01:00
members Bug 41761: Do not update accountlines.date when editing a note 2026-07-20 14:40:14 +12:00
misc Update release notes for 25.05.13 release 2026-08-05 16:38:06 +12:00
offline_circ Bug 40163: Fix several http addresses in the code docs 2026-01-07 14:32:30 +00:00
opac Merge remote-tracking branch 'upstream/25.05.x' into HEAD 2026-08-05 16:20:01 +12:00
patron_lists Bug 40163: Fix several http addresses in the code docs 2026-01-07 14:32:30 +00:00
patroncards Bug 42747: (QA follow-up) Parameterize query, dedupe, and log rejections 2026-08-05 15:18:23 +12:00
plugins Bug 40163: Fix several http addresses in the code docs 2026-01-07 14:32:30 +00:00
pos Bug 40163: Fix several http addresses in the code docs 2026-01-07 14:32:30 +00:00
preservation Bug 40163: Fix several http addresses in the code docs 2026-01-07 14:32:30 +00:00
recalls Bug 40163: Fix several http addresses in the code docs 2026-01-07 14:32:30 +00:00
reports Bug 42736: Prevent SQL injection in reports/cat_issues_top.pl 2026-08-19 12:30:41 +12:00
reserve Bug 41076: [25.05.x] Adjust perl tidiness 2026-02-24 08:35:34 -07:00
reviews Bug 40163: Fix several http addresses in the code docs 2026-01-07 14:32:30 +00:00
rotating_collections Bug 40163: Fix several http addresses in the code docs 2026-01-07 14:32:30 +00:00
serials Bug 38009: Add a generate next button in serials receive page 2026-06-24 15:06:37 +12:00
services Bug 40163: Fix several http addresses in the code docs 2026-01-07 14:32:30 +00:00
skel
…
suggestion Bug 42071: Add 'show' to options that load a single suggestion 2026-05-23 15:58:41 -04:00
svc Bug 41518: Only show autorenewal text if autorenewal allowed 2026-05-23 15:58:47 -04:00
t Bug 30233: (follow-up) Add tests for _apply_substitution and combined modifiers 2026-08-14 13:32:54 +12:00
tags Bug 42254: (QA follow-up) Remove unused var, fixing a FIXME 2026-04-28 15:57:07 -06:00
tools Bug 42746: (QA follow-up) Sanitize agefield and substitution field at the sink too 2026-08-05 15:41:06 +12:00
virtualshelves Bug 40163: Fix several http addresses in the code docs 2026-01-07 14:32:30 +00:00
xt Bug 41076: [25.05.x] Adjust perl tidiness 2026-02-24 08:35:34 -07:00
.codespell-ignore Bug 39325: (QA follow-up) Adjust some issues 2025-04-28 18:51:30 +02:00
.editorconfig
…
.git-blame-ignore-revs Bug 39096: Add 'tidy all' commits to a git blame ignore file 2025-02-17 13:10:25 +01:00
.gitignore Bug 40838: Add generated bookings CSS assets to gitignore 2025-09-25 16:22:51 +02:00
.htaccess
…
.mailmap Bug 40041: Remove duplicated or unecessary entries 2025-10-29 10:02:28 +01:00
.perlcriticrc
…
.perltidyrc
…
.prettierrc.js Bug 38664: Treat .vue files like other JS files 2025-02-11 14:58:25 +01:00
.proverc.dist
…
.stylelintrc.json
…
INSTALL
…
Koha.pm Increment version for 25.05.13 release 2026-08-05 16:33:35 +12:00
LICENSE Bug 40163: Fix several http addresses in the code docs 2026-01-07 14:32:30 +00:00
MANIFEST.SKIP
…
Makefile.PL Bug 41076: [25.05.x] Adjust perl tidiness 2026-02-24 08:35:34 -07:00
README
…
README.md Bug 40163: Fix several http addresses in the code docs 2026-01-07 14:32:30 +00:00
README.robots
…
SECURITY.md Bug 40527: Initial draft of SECURITY.md 2026-01-05 17:42:04 +00:00
about.pl Bug 40163: Fix several http addresses in the code docs 2026-01-07 14:32:30 +00:00
app.psgi Bug 40163: (follow-up) Fix wrong GNU links and update test 2026-01-07 14:32:37 +00:00
build-resources.PL Bug 40163: (follow-up) Fix wrong GNU links and update test 2026-01-07 14:32:37 +00:00
changelanguage.pl Bug 40163: Fix several http addresses in the code docs 2026-01-07 14:32:30 +00:00
cpanfile Bug 42317: Update minimum version for MARC::File::XML 2026-07-13 11:54:33 +12:00
cypress.config.ts Bug 40346: Use KOHA_INTRANET_URL for the baseUrl 2025-08-22 09:47:41 +02:00
eslint.config.mjs
…
fix-perl-path.PL Bug 40163: (follow-up) Fix wrong GNU links and update test 2026-01-07 14:32:37 +00:00
gulpfile.js Bug 38664: Tidy the whole codebase 2025-02-11 14:58:24 +01:00
help.pl Bug 40163: Fix several http addresses in the code docs 2026-01-07 14:32:30 +00:00
kohaversion.pl Bug 38664: Tidy the whole codebase 2025-02-11 14:58:24 +01:00
mainpage.pl Bug 40163: Fix several http addresses in the code docs 2026-01-07 14:32:30 +00:00
package.json Bug 36674: (follow-up) Stop emitting Cypress API client source maps 2026-02-17 16:34:56 +00:00
rewrite-config.PL Bug 40163: (follow-up) Fix wrong GNU links and update test 2026-01-07 14:32:37 +00:00
rspack.config.js Bug 36674: (follow-up) Stop emitting Cypress API client source maps 2026-02-17 16:34:56 +00:00
tsconfig.json
…
yarn.lock Bug 40170: Update yarn.lock 2025-07-10 22:47:42 +02:00

README.md

Koha is a free software integrated library system (ILS).

Koha is distributed under the GNU GPL version 3 or later.

Note: Koha does not accept pull requests from git hosting sites.

Note: This project has its own bug tracker, to report a bug or submit a patch visit https://bugs.koha-community.org.

For guidelines on submitting patches for Koha please visit https://wiki.koha-community.org/wiki/SubmitingAPatch

The developers handbook can be found at https://wiki.koha-community.org/wiki/Developer_handbook

https://koha-community.org/

Koha Logo