gitea
/
Koha-clms
1
0
Fork 0
Code Issues Pull Requests Packages Projects Releases Wiki Activity
58,796 Commits 39 Branches 720 Tags 6 GiB
Perl 44.2%
JavaScript 41.1%
HTML 6%
XSLT 3.1%
Vue 1.9%
Other 3.2%
Go to file
David Cook 193268edbb
Bug 40748: Check for HTTP URLs and skip shell when using system() 
This change checks for HTTP(S) URLs and skips the shell when using
system() so that shell metacharacters aren't interpreted.

Test plan:
0. Apply the patch
1. Insert the following into the Babeltheque_url_update system preference:
$(whoami > /tmp/rce.log)
2. koha-shell kohadev
3. perl misc/cronjobs/social_data/update_social_data.pl
4. Note the script says the following:
$(whoami > /tmp/rce.log) is not a HTTP URL. Aborting.
5. Note also that /tmp/rce.log is not created
6. Change Babeltheque_url_update syspref to something like the following:
http://localhost:8080
7. perl misc/cronjobs/social_data/update_social_data.pl
8. Note that the wget succeeds but the bunzip2 fails (as expected) since
we haven't fetched a bzipped file
9. Try to create a payload that passes the HTTP URL test with shell
metacharacters and note that they're not interpetted and instead
just used as part of a URL string.

Signed-off-by: Jake Deery <jake.deery@openfifth.co.uk>

Signed-off-by: Jonathan Druart <jonathan.druart@bugs.koha-community.org>
Signed-off-by: Paul Derscheid <paul.derscheid@lmscloud.de>
 		2025-09-25 20:49:58 +02:00
C4 Bug 40675: Fix SIP message corruption from embedded line endings 2025-09-25 16:22:51 +02:00
Koha Bug 40858: Search merge conflict on files part of the git index 2025-09-25 16:22:57 +02:00
acqui Bug 39572: Improve EDIFACT order confirmation message 2025-07-24 10:23:14 +02:00
admin Bug 40734: Fix creating new library with additional fields 2025-09-25 16:22:41 +02:00
api Bug 40684: Adjust permissions for vendors 2025-09-25 16:22:58 +02:00
authorities Bug 38514: Filter out autocomplete list of authorities with ConsiderHeadingUse 2025-08-22 09:47:58 +02:00
basket Bug 38664: Tidy the whole codebase 2025-02-11 14:58:24 +01:00
bin
…
bookings Bug 38664: Tidy the whole codebase 2025-02-11 14:58:24 +01:00
catalogue Bug 37883: Add ability to filter search results location column by logged in location 2025-09-16 14:02:11 +02:00
cataloguing Bug 37116: Redirect to serial modification when modifying an item 2025-09-20 10:42:40 +02:00
circ Bug 40708: Return the specific error to the checkin page 2025-09-25 16:22:48 +02:00
clubs Bug 38664: Tidy the whole codebase 2025-02-11 14:58:24 +01:00
course_reserves Bug 38664: Tidy the whole codebase 2025-02-11 14:58:24 +01:00
debian Bug 40812: Move Theke sample plugin repo to GitHub 2025-09-25 16:22:44 +02:00
docs Bug 40022: Sync teams in Koha, Wiki and release-tools 2025-07-10 22:47:12 +02:00
erm Bug 38664: Tidy the whole codebase 2025-02-11 14:58:24 +01:00
errors Bug 38664: Tidy the whole codebase 2025-02-11 14:58:24 +01:00
etc Bug 40812: Move Theke sample plugin repo to GitHub 2025-09-25 16:22:44 +02:00
ill Bug 40075: Only show pickup_location libraries 2025-08-22 09:48:34 +02:00
installer Revert "Bug 36135: Add batch_modify_holds permissions" 2025-09-25 15:55:57 +02:00
koha-tmpl Bug 40876: Apply 'exact' to all attributes when column filtering 2025-09-25 19:32:21 +02:00
labels Bug 38664: Tidy the whole codebase 2025-02-11 14:58:24 +01:00
lib Bug 38664: Tidy the whole codebase 2025-02-11 14:58:24 +01:00
members Bug 40305: Fix 'tendered' vs 'collected' variable name inconsistency 2025-09-16 14:02:24 +02:00
misc Bug 40748: Check for HTTP URLs and skip shell when using system() 2025-09-25 20:49:58 +02:00
offline_circ Bug 40275: Use Koha::Patrons->find_by_identifier in the codebase 2025-09-20 10:43:37 +02:00
opac Bug 40585: Check on Biblios->find in addbybiblionumber scripts 2025-09-25 16:22:50 +02:00
patron_lists Bug 37266: patron_lists/delete.pl should have CSRF protection 2025-03-06 13:54:49 +01:00
patroncards Bug 39800: Error 500 when trying to delete patron card template 2025-05-19 09:49:41 +02:00
plugins Bug 38664: Tidy the whole codebase 2025-02-11 14:58:24 +01:00
pos Bug 40305: Fix 'tendered' vs 'collected' variable name inconsistency 2025-09-16 14:02:24 +02:00
preservation Bug 38664: Tidy the whole codebase 2025-02-11 14:58:24 +01:00
recalls Bug 38664: Tidy the whole codebase 2025-02-11 14:58:24 +01:00
reports Bug 40419: Fix wrong license 2025-07-24 10:23:34 +02:00
reserve Bug 9762: Log circulation overrides 2025-09-20 10:43:21 +02:00
reviews Bug 38664: Tidy the whole codebase 2025-02-11 14:58:24 +01:00
rotating_collections Bug 31930: Ignore whitespace before and after barcodes 2025-08-22 09:48:05 +02:00
serials Bug 40861: Remove warning from serials/acqui-search-result.pl 2025-09-25 16:22:55 +02:00
services Bug 38664: Tidy the whole codebase 2025-02-11 14:58:24 +01:00
skel
…
suggestion Bug 36155: Improve perfs of suggestion.pl when there are many budgets 2025-09-20 10:43:15 +02:00
svc Bug 9762: (follow-up) Add branchcode to Log circulation and add some override confirmations in action logs, fix typos 2025-09-20 10:43:26 +02:00
t Bug 40876: Apply 'exact' to all attributes when column filtering 2025-09-25 19:32:21 +02:00
tags Bug 38969: (QA follow-up) fix tidy 2025-04-28 18:51:18 +02:00
tools Bug 38633: Prevent holidays from being ignored 2025-09-25 16:22:52 +02:00
virtualshelves Bug 40585: (follow-up) Display error if no records were found 2025-09-25 16:22:50 +02:00
xt Bug 40858: Rename context 'all' with 'core' 2025-09-25 16:22:57 +02:00
.codespell-ignore Bug 39325: (QA follow-up) Adjust some issues 2025-04-28 18:51:30 +02:00
.editorconfig
…
.git-blame-ignore-revs Bug 39096: Add 'tidy all' commits to a git blame ignore file 2025-02-17 13:10:25 +01:00
.gitignore Bug 40838: Add generated bookings CSS assets to gitignore 2025-09-25 16:22:51 +02:00
.htaccess
…
.mailmap 25.05.00: Update .mailmap (part 4) 2025-05-26 10:19:09 -03:00
.perlcriticrc
…
.perltidyrc
…
.prettierrc.js Bug 38664: Treat .vue files like other JS files 2025-02-11 14:58:25 +01:00
.proverc.dist
…
.stylelintrc.json
…
INSTALL
…
Koha.pm Revert "Bug 36135: DBRev 25.05.03.008" 2025-09-25 15:55:53 +02:00
LICENSE
…
MANIFEST.SKIP
…
Makefile.PL Bug 40773: Do not map "vue/dist" files in Makefile 2025-09-25 16:22:38 +02:00
README
…
README.md
…
README.robots
…
about.pl Bug 40608: (follow-up) Add warning in about page 2025-09-20 10:42:34 +02:00
app.psgi
…
build-resources.PL
…
changelanguage.pl Bug 38664: Tidy the whole codebase 2025-02-11 14:58:24 +01:00
cpanfile Bug 40164: Add Template::Plugin::JSON dependency 2025-07-10 22:47:33 +02:00
cypress.config.ts Bug 40346: Use KOHA_INTRANET_URL for the baseUrl 2025-08-22 09:47:41 +02:00
eslint.config.mjs Bug 38524: Enable ESLint for .ts and .vue files 2025-01-16 15:56:17 +01:00
fix-perl-path.PL Bug 39325: (QA follow-up) Adjust some issues 2025-04-28 18:51:30 +02:00
gulpfile.js Bug 38664: Tidy the whole codebase 2025-02-11 14:58:24 +01:00
help.pl Bug 38664: Tidy the whole codebase 2025-02-11 14:58:24 +01:00
kohaversion.pl Bug 38664: Tidy the whole codebase 2025-02-11 14:58:24 +01:00
mainpage.pl Bug 38664: Tidy the whole codebase 2025-02-11 14:58:24 +01:00
package.json Bug 40170: Replace cypress-mysql with mysql2 - Cypress tests 2025-07-10 22:47:37 +02:00
rewrite-config.PL Bug 39834: Replace some tabs with spaces 2025-06-17 21:42:59 +02:00
rspack.config.js Bug 40173: Make http-client reusable from Cypress tests 2025-08-22 09:47:30 +02:00
tsconfig.json
…
yarn.lock Bug 40170: Update yarn.lock 2025-07-10 22:47:42 +02:00

README.md

Koha is a free software integrated library system (ILS).

Koha is distributed under the GNU GPL version 3 or later.

Note: Koha does not accept pull requests from git hosting sites.

Note: This project has its own bug tracker, to report a bug or submit a patch visit http://bugs.koha-community.org.

For guidelines on submitting patches for Koha please visit https://wiki.koha-community.org/wiki/SubmitingAPatch

The developers handbook can be found at https://wiki.koha-community.org/wiki/Developer_handbook

http://koha-community.org/

Koha Logo