gitea
/
Koha-clms
1
0
Fork 0
Code Issues Pull Requests Packages Projects Releases Wiki Activity
54,464 Commits 39 Branches 720 Tags 6 GiB
Perl 44.2%
JavaScript 41.1%
HTML 6%
XSLT 3.1%
Vue 1.9%
Other 3.2%
Go to file
Kyle M Hall 3d03eff4a4 Bug 33339: Prevent Formula Injection (CSV Injection) in CSV files 
The system is vulnerable to Formula Injection attacks as the data
stored within the database and exported as CSV/Excel is not being
sanitized or validated against implanted formula payloads

This patch modifies all uses of Text::CSV and derived classes to pass
the "formula" parameter with value of "empty" which replaces formulas
by empty string.

Test Plan:
1) Apply this patch
2) For guided_reports.pl, attempt to export CSV where you've set a column to a formula somehow
   ( such as "=1+3" )
3) Export that CSV file
4) Note the formula has not been exported
5) Repeat this plan for the remaining scripts that export CSV files
   where users can define the outputted data

Signed-off-by: Magnus Enger <magnus@libriotech.no>
Fixed two conflicts. I have tested that this works as advertised on:
- Reports (Download > Comma separated text (.csv)) [Text::CSV::Encoded]
- Circulation > Overdues > Download file of all overdues [Text::CSV_XS]
- misc/export_borrowers.pl [Text::CSV]
This covers all modules used, and both GUI and command line.

Signed-off-by: Chris Cormack <chris@bigballofwax.co.nz>

Signed-off-by: Marcel de Rooy <m.de.rooy@rijksmuseum.nl>
[EDIT] Change none to empty in the commit message ! None is the default,
doing nothing. Empty clears the formulas.
Signed-off-by: Lucas Gass <lucas@bywatersolutions.com>
 		2024-11-07 23:02:54 +00:00
C4 Bug 33339: Prevent Formula Injection (CSV Injection) in CSV files 2024-11-07 23:02:54 +00:00
Koha Bug 33339: Prevent Formula Injection (CSV Injection) in CSV files 2024-11-07 23:02:54 +00:00
acqui Bug 37551: (24.05.x) Only delete price when there is already an itemprice 2024-09-17 14:41:05 +00:00
admin Bug 33339: Prevent Formula Injection (CSV Injection) in CSV files 2024-11-07 23:02:54 +00:00
api Bug 29509: Update swagger specification and add permissions to users 2024-08-28 19:58:39 +00:00
authorities Bug 25387: (QA follow-up) Tidy 2024-07-18 20:03:17 +00:00
basket Bug 34478: Add 'op' to sendbasketform 2024-03-01 10:58:53 +01:00
bin
…
bookings Bug 35574: Bookings tab from biblio details should only require manage_bookings permission 2023-12-18 15:21:04 +01:00
catalogue Bug 37425: Check for existence of biblio object before fetching cover images 2024-08-28 20:35:18 +00:00
cataloguing Bug 38211: frameworkcode must be set before read 2024-10-23 22:49:20 +00:00
circ Bug 33339: Prevent Formula Injection (CSV Injection) in CSV files 2024-11-07 23:02:54 +00:00
clubs Bug 34478: Manual fix - add op clubs/templates-add-modify 2024-03-01 10:57:55 +01:00
course_reserves Bug 28762: Use Koha::Course in course-details controller 2024-08-28 20:20:33 +00:00
debian Bug 33563: Add comments for Elasticsearch security config 2024-07-18 19:57:49 +00:00
docs Bug 37003: (follow-up) Amend 22.11 RMaint 2024-07-18 19:44:01 +00:00
erm Bug 32922: Remove space in shebang 2023-02-20 09:44:06 -03:00
errors Bug 36148: Improve error handling and restore programming errors 2024-03-01 11:01:06 +01:00
etc Bug 33563: Add comments for Elasticsearch security config 2024-07-18 19:57:49 +00:00
ill Bug 35106: CSRF fix 2024-04-29 18:53:09 +02:00
installer Bug 37953: (bug 35138 follow-up) Fix DisplayLibraryFacets - facet order 2024-10-25 21:38:54 +00:00
koha-tmpl Bug 37724: Remove Koha version number from OPAC 2024-11-07 23:02:54 +00:00
labels Bug 33339: Prevent Formula Injection (CSV Injection) in CSV files 2024-11-07 23:02:54 +00:00
lib Bug 35681: Use ::Bootstrap version of FromANSI 2024-05-02 16:47:39 +02:00
members Bug 33849: Do not reset new patrons home library when error occurs 2024-05-13 10:36:09 +02:00
misc Bug 33339: Prevent Formula Injection (CSV Injection) in CSV files 2024-11-07 23:02:54 +00:00
offline_circ Bug 34478: Changes for offline_circ 2024-03-01 10:58:34 +01:00
opac Bug 37339: Set messaging preferences from default on self registration 2024-10-09 22:00:53 +00:00
patron_lists Bug 34478: Changes for patron_lists/add-modify 2024-03-01 10:57:41 +01:00
patroncards Bug 37614: Printing patron cards from patron lists should be a GET 2024-09-11 16:37:03 +00:00
plugins Bug 30897: Add option to disable automated restart 2024-04-11 16:53:42 +02:00
pos Bug 33478: Apply formatting to RECEIPT 2024-04-26 20:15:44 +02:00
preservation Bug 34030: Add a "print slips" action links to print in batch 2023-10-23 11:33:55 -03:00
recalls Bug 33478: Apply formatting to RECALL_REQUESTER_DET 2024-04-26 20:15:45 +02:00
reports Bug 33339: Prevent Formula Injection (CSV Injection) in CSV files 2024-11-07 23:02:54 +00:00
reserve Bug 37587: (QA follow-up) Tidy reserve/placerequest.pl 2024-10-09 19:34:22 +00:00
reviews Bug 37074: Comment approval and un-approval should be CSRF-protected 2024-07-25 14:08:54 +00:00
rotating_collections Bug 34478: Manual fix - add op - rotating_collections/addItems 2024-03-01 10:57:33 +01:00
serials Bug 33339: Prevent Formula Injection (CSV Injection) in CSV files 2024-11-07 23:02:54 +00:00
services
…
skel
…
suggestion Bug 37337: Pass the save $op when biblio_exists 2024-09-06 16:29:00 +00:00
svc Bug 37508: Throw error if password column is detected in SQL report 2024-08-12 15:35:12 -03:00
t Bug 33339: Prevent Formula Injection (CSV Injection) in CSV files 2024-11-07 23:02:54 +00:00
tags Bug 34478: Add 'op' to tags/review 2024-03-01 10:58:25 +01:00
tools Bug 33339: Prevent Formula Injection (CSV Injection) in CSV files 2024-11-07 23:02:54 +00:00
virtualshelves Bug 37285: (QA follow-up) Perl Tidy 2024-08-29 15:06:09 +00:00
xt Bug 37302: Set test to failed if swagger-cli missing 2024-08-28 20:06:11 +00:00
.editorconfig
…
.eslintrc.json Bug 36400: Centralize {js,ts,vue} formatting config in .prettierrc.js 2024-04-22 08:57:39 +02:00
.gitignore Bug 36546: (QA follow-up) Add bundle spec to .gitignore 2024-04-30 15:55:37 -03:00
.htaccess
…
.mailmap Bug 36943: (follow-up) 24.05.00 - Update .mailmap 2024-05-24 15:36:40 +02:00
.perlcriticrc
…
.perltidyrc Bug 30002: Adjust perltidy 2023-06-08 08:32:42 -03:00
.prettierrc.js Bug 36400: (follow-up) remove option editorconfig from .prettierrc.js 2024-04-22 08:57:40 +02:00
.proverc.dist
…
.stylelintrc.json
…
INSTALL
…
Koha.pm Increment version for 24.05.04 release 2024-10-02 14:03:16 +00:00
LICENSE
…
MANIFEST.SKIP
…
Makefile.PL Bug 36546: Deploy swagger_bundle.json via make 2024-04-30 14:32:10 +02:00
README
…
README.md
…
README.robots
…
about.pl Bug 37509: Check Elasticsearch info for both 'about' and 'sysinfo' tabs 2024-09-06 16:52:55 +00:00
app.psgi Bug 36149: Add userenv middleware to app.psgi 2024-05-14 15:04:37 -03:00
build-resources.PL Bug 32609: Use the current yarn.lock to generate node_modules 2023-02-10 11:07:57 -03:00
changelanguage.pl
…
cpanfile Bug 25159: Add ability to specify a pre-modified version of action log data and store as diff 2024-05-02 16:47:42 +02:00
cypress.config.ts Bug 36012: Extend cypress's requestTimeout value 2024-03-22 15:07:36 +01:00
fix-perl-path.PL
…
gulpfile.js Bug 36730: (Bug 35428 follow-up) po files (sometimes) fail to update 2024-05-07 15:53:44 +02:00
help.pl
…
kohaversion.pl
…
mainpage.pl Bug 30493: (QA follow-up) Fix for the only_my_library case as well 2024-07-18 19:31:50 +00:00
package.json Bug 38164: Revert "Bug 37303: Replace po2json with a JS version" 2024-10-23 22:51:09 +00:00
rewrite-config.PL
…
tsconfig.json Bug 32030: Move cypress to t - fix build_js/watch_js 2022-11-08 09:44:52 -03:00
webpack.config.js Bug 35919: Add record sources admin page 2024-04-26 17:06:04 +02:00
yarn.lock Bug 37303: Update yarn.lock after adding new dependency to packages.json 2024-08-29 16:49:30 +00:00

README.md

Koha is a free software integrated library system (ILS).

Koha is distributed under the GNU GPL version 3 or later.

Note: Koha does not accept pull requests from git hosting sites.

Note: This project has its own bug tracker, to report a bug or submit a patch visit http://bugs.koha-community.org.

For guidelines on submitting patches for Koha please visit https://wiki.koha-community.org/wiki/SubmitingAPatch

The developers handbook can be found at https://wiki.koha-community.org/wiki/Developer_handbook

http://koha-community.org/

Koha Logo