gitea
/
Koha-clms
1
0
Fork 0
Code Issues Pull Requests Packages Projects Releases Wiki Activity
Koha-clms/C4
History
Aleisha Amohia 38364e9a17
Bug 37508: Throw error if password column is detected in SQL report 
This enhancement prevents SQL queries from being run if they would return a password field from the database table.

To test:

1. Run tests and notice they fail t/db_dependent/Reports/Guided.t

2. Apply patch and restart services

3. Create a public report with an SQL report which would access a password column in a database table
4. Try to run the report. Notice you are met with an error and the results are not shown.
5. Access the JSON URL, you should not get the results and should be shown an error
6. Confirm tests pass t/db_dependent/Reports/Guided.t

Sponsored-by: Reserve Bank of New Zealand
Signed-off-by: David Cook <dcook@prosentient.com.au>

Signed-off-by: Marcel de Rooy <m.de.rooy@rijksmuseum.nl>
Signed-off-by: Tomas Cohen Arazi <tomascohen@theke.io>
 		2024-08-13 02:03:22 -03:00
..
AuthoritiesMarc
…
Barcodes Bug 30718: Use flatpickr's altInput 2022-08-19 08:26:31 -03:00
ClassSortRoutine
…
ClassSplitRoutine
…
Creators Bug 10762: (QA follow-up) Perltidy 2023-10-25 10:35:31 -03:00
External
…
Form Bug 30318: Don't reset messaging preferences when form is empty 2024-05-23 16:59:36 +02:00
Heading Bug 21828: build $bib_heading_fields only once per invocation 2023-09-22 12:57:46 -03:00
ILSDI Bug 36335: Fix ILS-DI GetRecords bad encoding for UNIMARC 2024-05-29 11:21:32 +02:00
Installer Bug 30731: Remove Readonly::XS::MAGIC_COOKIE 2022-06-01 16:15:26 -03:00
Labels Bug 10762: (QA follow-up) Perltidy 2023-10-25 10:35:31 -03:00
Linker Bug 30280: Add support for subject headings from different thesaurus when using Elasticsearch 2022-10-03 10:00:04 -03:00
Members Bug 33239: Add the ability to run borrowers-force-messaging-defaults.pl only on a specified message name 2023-10-11 10:31:46 -03:00
OAI Bug 30308: Fix bulkmarcimport.pl broken by OAI-PMH:AutoUpdateSets(EmbedItemData) 2022-07-29 15:43:39 -03:00
Output
…
Patroncards Bug 34532: Silence warns in Patroncard.pm 2023-09-15 11:57:08 -03:00
Reports Bug 37508: Throw error if password column is detected in SQL report 2024-08-13 02:03:22 -03:00
SIP Bug 36948: (follow-up) Allow IPv[46] in port config 2024-07-17 15:54:10 +02:00
Search Bug 30718: Use flatpickr's altInput 2022-08-19 08:26:31 -03:00
Serials
…
Utils/DataTables Bug 34913: Fix perlcritic for VirtualShelves.pm 2024-01-31 13:49:30 +01:00
Accounts.pm Bug 29184: Fix warn about undefined replacecost 2022-09-08 10:50:30 -07:00
Acquisition.pm Bug 14092: (QA follow-up) Avoid fiddling with the hash in the template 2023-10-20 16:31:15 -03:00
Auth.pm Bug 36940: Resolve two warnings on undefined branchip 2024-07-19 09:37:23 +02:00
Auth_cas_servers.yaml.sample
…
Auth_with_cas.pm Bug 34893: (QA follow-up) Tidy code for qa script 2024-01-29 10:15:53 +01:00
Auth_with_ldap.pm Bug 36575: (bug 34893 follow-up) Return patron from LDAP 2024-06-06 10:59:48 +02:00
Auth_with_shibboleth.pm Bug 36575: (QA follow-up) Shibboleth POD and checkpw_internal call 2024-06-06 10:59:48 +02:00
AuthoritiesMarc.pm Bug 35989: (QA follow-up): Fix QA tests 2024-07-17 15:03:40 +02:00
Barcodes.pm
…
Biblio.pm Bug 36137: Make update_totalissues cron always skip the holds queue 2024-05-24 15:11:46 +02:00
Breeding.pm Bug 28166: (QA follow-up) Fix and tidy tests and code 2023-10-23 11:33:50 -03:00
Budgets.pm Bug 31631: Optionally use tax-exclusive values for calculating fund values 2023-10-18 15:41:35 -03:00
Calendar.pm Bug 32048: Added clear cache routine to delete_holiday_range_repeatable 2023-09-18 15:31:50 -03:00
Charset.pm
…
Circulation.pm Bug 37016: Invalid due date in SIP renew response 2024-07-22 11:40:54 +02:00
ClassSortRoutine.pm Bug 29951: Fix EXPORT for C4::ClassS*Routine modules 2022-07-08 15:29:56 -03:00
ClassSource.pm Bug 29951: Fix EXPORT for C4::ClassS*Routine modules 2022-07-08 15:29:56 -03:00
ClassSplitRoutine.pm Bug 29951: Fix EXPORT for C4::ClassS*Routine modules 2022-07-08 15:29:56 -03:00
Context.pm Bug 36793: Fix case of $var in Context->delete_preference 2024-05-29 15:11:02 +02:00
Contract.pm
…
CourseReserves.pm Bug 30016: Remove GetOpenIssue subroutine 2022-08-31 08:50:37 -03:00
Creators.pm
…
HTML5Media.pm
…
Heading.pm Bug 33557: Add LinkerConsiderThesaurus system preference 2023-05-10 15:26:26 -03:00
HoldsQueue.pm Bug 32565: (follow-up) Tidy 2024-05-24 14:13:40 +02:00
ImportBatch.pm Bug 35438: Remove skip_intermediate_commit parameter 2024-01-17 10:30:13 +01:00
ImportExportFramework.pm Bug 13952: (follow-up) JS translatability, clean warns, other 2022-04-04 16:23:46 +02:00
InstallAuth.pm Bug 26019: Koha should set SameSite attribute on cookies 2022-04-13 15:55:38 +02:00
Installer.pm Bug 34174: (bug 33341 follow-up) Fix Ris export 2023-07-06 12:24:12 -03:00
ItemCirculationAlertPreference.pm
…
Items.pm Bug 32029: Automatic item modifications by age add biblio table 2024-03-11 11:16:47 +01:00
Koha.pm Bug 35833: Fix warnings from C4/Koha 2024-02-01 15:06:57 +01:00
Labels.pm
…
Languages.pm Bug 35582: Supress possible warning 2024-05-24 14:03:30 +02:00
Letters.pm Bug 37198: Improve GetPreparedLetter documentation 2024-07-22 11:54:37 +02:00
Linker.pm
…
Log.pm Bug 32057: (QA follow-up) Remove pretty flag 2023-03-14 08:49:34 -03:00
MarcModificationTemplates.pm
…
Matcher.pm Bug 26611: Make authority record matching use required match checks 2023-05-24 11:21:31 -03:00
Members.pm Bug 26170: Add protected status for patrons 2023-11-01 17:23:06 -03:00
Message.pm Bug 18398: (follow-up) Update POD & Unit tests 2023-03-31 13:13:35 +02:00
Output.pm Bug 30524: Core CSRF checking code 2023-08-07 20:59:58 -03:00
Overdues.pm Bug 36128: Use of uninitialized value in string eq at /usr/share/koha/lib/C4/Overdues.pm 2024-07-22 11:49:04 +02:00
Patroncards.pm
…
Record.pm Bug 35588: Scope authorised value desc lookup according to field/subfield 2024-01-03 17:05:14 +01:00
Reports.pm
…
Reserves.pm Bug 34972: Remove GetOtherReserves 2024-05-22 14:44:24 +02:00
Ris.pm Bug 34174: (bug 33341 follow-up) Fix Ris export 2023-07-06 12:24:12 -03:00
RotatingCollections.pm Bug 31735: Avoid re-fetcing objects from database by passing them directly instead of ids to various subroutines 2023-05-12 12:40:21 -03:00
SMS.pm Bug 36307: SMS::Send driver errors are not captured and stored 2024-05-23 14:02:52 +02:00
Scheduler.pm
…
Scrubber.pm Bug 36328: (QA follow-up) Expand tests and reorder elements to clarify differences 2024-04-24 07:36:20 +02:00
Search.pm Bug 35833: Silence few warnings from searching 2024-02-01 15:06:57 +01:00
Serials.pm Bug 36939: Remove a warning from Serials.t 2024-05-30 10:20:04 +02:00
Service.pm
…
ShelfBrowser.pm Bug 29697: Replace GetMarcBiblio occurrences with $biblio->metadata->record 2022-07-22 15:24:11 -03:00
SocialData.pm Bug 33833: Add two FIXMEs to SocialData::get_report 2023-09-05 14:35:35 -03:00
Stats.pm Bug 33608: (QA follow-up) Remove ->insert method 2023-10-25 11:07:59 -03:00
Suggestions.pm Bug 33236: (follow-up) Remove export of NewSuggestion 2023-06-06 10:08:36 -03:00
TTParser.pm
…
Tags.pm Bug 36785: Typo unreconized and bilbio in tags code 2024-05-29 15:12:56 +02:00
Templates.pm Bug 35070: Tidy 2024-01-08 15:18:37 +01:00
TmplToken.pm
…
TmplTokenType.pm
…
UsageStats.pm Bug 26176: (QA follow-up) Branch -> Library 2024-06-06 10:53:04 +02:00
XISBN.pm Bug 30813: (QA follow-up) Adjust three use statements 2022-06-08 11:40:32 -03:00
XSLT.pm Bug 33217: Tidy 2023-11-08 17:52:42 -03:00