gitea
/
Koha-clms
1
0
Fork 0
Code Issues Pull Requests Packages Projects Releases Wiki Activity
58,493 Commits 39 Branches 720 Tags 6 GiB
Perl 44.2%
JavaScript 41.1%
HTML 6%
XSLT 3.1%
Vue 1.9%
Other 3.2%
Go to file
David Cook 39daea4c76
Bug 40538: Fix XSS in suspend hold modal 
This patch fixes a XSS vulnerability in the
suspend hold modal in the staff interface.

By building our Javascript using Web APIs rather
than with strings and jQuery's html() method,
we're able to securely handle malicious payloads.

Test plan:
0. Apply the patch
1. Go to http://localhost:8081/cgi-bin/koha/reserve/request.pl?biblionumber=29
2. Add a hold for "koha" patron
3. Go to http://localhost:8081/cgi-bin/koha/circ/circulation.pl?borrowernumber=51
4. Click "Holds" tab and click "Suspend"
5. Note the modal loads properly
6. Go to http://localhost:8081/cgi-bin/koha/members/moremember.pl?borrowernumber=51
7. Click "Holds" tab and click "Suspend"
8. Note the modal loads properly

Signed-off-by: Pedro Amorim <pedro.amorim@openfifth.co.uk>

Signed-off-by: Marcel de Rooy <m.de.rooy@rijksmuseum.nl>
Signed-off-by: Paul Derscheid <paul.derscheid@lmscloud.de>
 		2025-08-26 21:05:13 +02:00
C4 Bug 40620: Holds Queue will assign to the lowest item number if multiple branches have the same transport cost 2025-08-26 20:37:29 +02:00
Koha Bug 37115: Batch delete linked serials 2025-08-22 09:48:39 +02:00
acqui Bug 39572: Improve EDIFACT order confirmation message 2025-07-24 10:23:14 +02:00
admin Bug 40547: Background jobs should appear even when plugins disabled 2025-08-22 09:48:17 +02:00
api Bug 40542: Add strings embed to holds-related endpoints 2025-08-22 09:48:20 +02:00
authorities Bug 38514: Filter out autocomplete list of authorities with ConsiderHeadingUse 2025-08-22 09:47:58 +02:00
basket Bug 38664: Tidy the whole codebase 2025-02-11 14:58:24 +01:00
bin
…
bookings Bug 38664: Tidy the whole codebase 2025-02-11 14:58:24 +01:00
catalogue Bug 39325: Manual fixes 2025-04-28 18:51:23 +02:00
cataloguing Bug 37115: Delete linked serial when deleting a single item 2025-08-22 09:48:38 +02:00
circ Bug 40367: Improve display of messages on patron account 2025-08-22 09:48:15 +02:00
clubs Bug 38664: Tidy the whole codebase 2025-02-11 14:58:24 +01:00
course_reserves Bug 38664: Tidy the whole codebase 2025-02-11 14:58:24 +01:00
debian Bug 39906: (QA follow-up) Feature needs to be enabled specifically 2025-08-26 21:05:12 +02:00
docs Bug 40022: Sync teams in Koha, Wiki and release-tools 2025-07-10 22:47:12 +02:00
erm Bug 38664: Tidy the whole codebase 2025-02-11 14:58:24 +01:00
errors Bug 38664: Tidy the whole codebase 2025-02-11 14:58:24 +01:00
etc Bug 40304: Zebrasrv configs now work on ARM CPUs 2025-07-24 10:23:34 +02:00
ill Bug 40075: Only show pickup_location libraries 2025-08-22 09:48:34 +02:00
installer Bug 36127: Adjust default HOLDPLACED and HOLD_CHANGED notices to use TT 2025-08-22 09:48:39 +02:00
koha-tmpl Bug 40538: Fix XSS in suspend hold modal 2025-08-26 21:05:13 +02:00
labels Bug 38664: Tidy the whole codebase 2025-02-11 14:58:24 +01:00
lib Bug 38664: Tidy the whole codebase 2025-02-11 14:58:24 +01:00
members Bug 40367: Improve display of messages on patron account 2025-08-22 09:48:15 +02:00
misc Update release notes for 25.05.02 release 2025-07-24 22:53:42 +02:00
offline_circ Bug 38664: Tidy the whole codebase 2025-02-11 14:58:24 +01:00
opac Bug 40075: Only show pickup_location libraries in OPAC 2025-08-22 09:48:34 +02:00
patron_lists Bug 37266: patron_lists/delete.pl should have CSRF protection 2025-03-06 13:54:49 +01:00
patroncards Bug 39800: Error 500 when trying to delete patron card template 2025-05-19 09:49:41 +02:00
plugins Bug 38664: Tidy the whole codebase 2025-02-11 14:58:24 +01:00
pos Bug 38664: Tidy the whole codebase 2025-02-11 14:58:24 +01:00
preservation Bug 38664: Tidy the whole codebase 2025-02-11 14:58:24 +01:00
recalls Bug 38664: Tidy the whole codebase 2025-02-11 14:58:24 +01:00
reports Bug 40419: Fix wrong license 2025-07-24 10:23:34 +02:00
reserve Bug 38412: Display warning on biblio level 2025-08-22 09:48:24 +02:00
reviews Bug 38664: Tidy the whole codebase 2025-02-11 14:58:24 +01:00
rotating_collections Bug 31930: Ignore whitespace before and after barcodes 2025-08-22 09:48:05 +02:00
serials Bug 34971: (QA follow-up) Op is now cud-reopen 2025-02-12 15:28:17 +01:00
services Bug 38664: Tidy the whole codebase 2025-02-11 14:58:24 +01:00
skel
…
suggestion Bug 33430: (follow-up) Fix the data filtering from the left menu 2025-05-19 18:54:22 +02:00
svc Bug 39325: Manual fixes 2025-04-28 18:51:23 +02:00
t Bug 40296: Fix failing Returns.t test 2025-08-26 20:37:27 +02:00
tags Bug 38969: (QA follow-up) fix tidy 2025-04-28 18:51:18 +02:00
tools Bug 37115: Batch delete linked serials 2025-08-22 09:48:39 +02:00
virtualshelves Bug 37434: Sort by publicationyear when copyrightdate is set in UNIMARC 2025-02-13 16:18:02 +01:00
xt Bug 40541: Add missing new line at the end of files when missing 2025-08-22 09:48:20 +02:00
.codespell-ignore Bug 39325: (QA follow-up) Adjust some issues 2025-04-28 18:51:30 +02:00
.editorconfig
…
.git-blame-ignore-revs Bug 39096: Add 'tidy all' commits to a git blame ignore file 2025-02-17 13:10:25 +01:00
.gitignore Bug 40539: Add cypress videos and screenshots to gitignore 2025-08-22 09:48:22 +02:00
.htaccess
…
.mailmap 25.05.00: Update .mailmap (part 4) 2025-05-26 10:19:09 -03:00
.perlcriticrc
…
.perltidyrc Bug 30002: Adjust perltidy 2023-06-08 08:32:42 -03:00
.prettierrc.js Bug 38664: Treat .vue files like other JS files 2025-02-11 14:58:25 +01:00
.proverc.dist
…
.stylelintrc.json Bug 31528: (follow-up) A few additional rules 2022-10-03 08:23:15 -03:00
INSTALL
…
Koha.pm Increment version for 25.05.02 release 2025-07-24 22:49:30 +02:00
LICENSE
…
MANIFEST.SKIP
…
Makefile.PL Bug 39834: Replace some tabs with spaces 2025-06-17 21:42:59 +02:00
README
…
README.md
…
README.robots
…
about.pl Bug 40466: Zebra status misleading in "Server information" tab 2025-08-22 09:47:49 +02:00
app.psgi Bug 36149: Add userenv middleware to app.psgi 2024-05-14 15:04:37 -03:00
build-resources.PL Bug 32609: Use the current yarn.lock to generate node_modules 2023-02-10 11:07:57 -03:00
changelanguage.pl Bug 38664: Tidy the whole codebase 2025-02-11 14:58:24 +01:00
cpanfile Bug 40164: Add Template::Plugin::JSON dependency 2025-07-10 22:47:33 +02:00
cypress.config.ts Bug 40346: Use KOHA_INTRANET_URL for the baseUrl 2025-08-22 09:47:41 +02:00
eslint.config.mjs Bug 38524: Enable ESLint for .ts and .vue files 2025-01-16 15:56:17 +01:00
fix-perl-path.PL Bug 39325: (QA follow-up) Adjust some issues 2025-04-28 18:51:30 +02:00
gulpfile.js Bug 38664: Tidy the whole codebase 2025-02-11 14:58:24 +01:00
help.pl Bug 38664: Tidy the whole codebase 2025-02-11 14:58:24 +01:00
kohaversion.pl Bug 38664: Tidy the whole codebase 2025-02-11 14:58:24 +01:00
mainpage.pl Bug 38664: Tidy the whole codebase 2025-02-11 14:58:24 +01:00
package.json Bug 40170: Replace cypress-mysql with mysql2 - Cypress tests 2025-07-10 22:47:37 +02:00
rewrite-config.PL Bug 39834: Replace some tabs with spaces 2025-06-17 21:42:59 +02:00
rspack.config.js Bug 40173: Make http-client reusable from Cypress tests 2025-08-22 09:47:30 +02:00
tsconfig.json Bug 32030: Move cypress to t - fix build_js/watch_js 2022-11-08 09:44:52 -03:00
yarn.lock Bug 40170: Update yarn.lock 2025-07-10 22:47:42 +02:00

README.md

Koha is a free software integrated library system (ILS).

Koha is distributed under the GNU GPL version 3 or later.

Note: Koha does not accept pull requests from git hosting sites.

Note: This project has its own bug tracker, to report a bug or submit a patch visit http://bugs.koha-community.org.

For guidelines on submitting patches for Koha please visit https://wiki.koha-community.org/wiki/SubmitingAPatch

The developers handbook can be found at https://wiki.koha-community.org/wiki/Developer_handbook

http://koha-community.org/

Koha Logo