gitea
/
Koha-clms
1
0
Fork 0
Code Issues Pull Requests Packages Projects Releases Wiki Activity
61,825 Commits 39 Branches 720 Tags 6 GiB
Perl 44.2%
JavaScript 41.1%
HTML 6%
XSLT 3.1%
Vue 1.9%
Other 3.2%
Go to file
Martin Renvoize 3f91a7a0b0
Bug 42747: (QA follow-up) Parameterize query, dedupe, and log rejections 
The original fix only whitelisted image_name at the point it's saved
in edit-layout.pl, leaving the actual injection sink in create-pdf.pl
unparameterized. This adds defense-in-depth by fixing the query itself,
avoids a redundant duplicate call to get_all_image_names() (already
fetched earlier in the script as $image_names), and logs rejected
image_name values instead of silently discarding them so tampering
attempts leave an audit trail.

Signed-off-by: Martin Renvoize <martin.renvoize@openfifth.co.uk>
Signed-off-by: Lucas Gass <lucas@bywatersolutions.com>
(cherry picked from commit 5b9e06dafc78c7097ce4090b52fc63390df490fc)
Signed-off-by: Lucas Gass <lucas@bywatersolutions.com>
 		2026-08-10 08:18:10 -06:00
.github/workflows Bug 40027: Use GitHub workflow to automatically close PRs opened on the Koha repo there 2025-10-06 09:15:26 -06:00
C4 Bug 42749: Prevent SQL injection from GetInvoices (order_by) 2026-08-10 08:18:08 -06:00
Koha Bug 42866: Prevent SQL injection in Koha::AddtionalContents->search_for_display 2026-08-10 08:18:08 -06:00
acqui Bug 42764: Fix spelling errors across the codebase 2026-06-11 09:53:34 -06:00
admin Bug 29587: Test mail option in SMTP servers 2026-06-15 18:12:16 -06:00
api Bug 41889: Update API to allow for null patron_id to be returned when listing checkouts 2026-07-13 16:10:36 -06:00
authorities Bug 21453: Copy data to the correct subfields when linking authorities with authorities 2026-04-23 09:24:58 -06:00
basket Bug 40163: Fix several http addresses in the code docs 2025-09-23 16:21:29 -06:00
bin Bug 40163: (follow-up) Fix wrong GNU links and update test 2025-09-24 09:25:04 -06:00
bookings Bug 40163: Fix several http addresses in the code docs 2025-09-23 16:21:29 -06:00
catalogue Bug 42637: Check if biblio exists before checking if it is fast add 2026-05-18 16:05:41 -06:00
cataloguing Bug 42764: Fix spelling errors across the codebase 2026-06-11 09:53:34 -06:00
circ Bug 41940: Remove uninitialized value warnings in circulation.pl 2026-05-20 09:04:58 -06:00
clubs Bug 40163: Fix several http addresses in the code docs 2025-09-23 16:21:29 -06:00
course_reserves Bug 40163: Fix several http addresses in the code docs 2025-09-23 16:21:29 -06:00
debian Bug 37762: VueJS ILL Module 2026-05-08 12:25:38 -06:00
docs Bug 42726: Add 26.11 release team 2026-06-08 13:53:09 -06:00
erm Bug 40163: Fix several http addresses in the code docs 2025-09-23 16:21:29 -06:00
errors Bug 28146: Respect ReplytoDefault in error pages 2025-10-09 14:58:41 -06:00
etc Bug 37762: VueJS ILL Module 2026-05-08 12:25:38 -06:00
ill Bug 37762: Circulation: Hook to checkouts/checkins 2026-05-08 12:25:43 -06:00
installer Bug 42397: DBRev 26.05.01.001 2026-07-07 16:07:50 -06:00
koha-tmpl Bug 40610: Update OPAC templates to improve ease of translation 2026-07-13 16:10:35 -06:00
labels Bug 42764: Fix spelling errors across the codebase 2026-06-11 09:53:34 -06:00
lib Bug 41521: Silent perlcritic warnings 2026-03-24 09:55:54 +01:00
members Bug 42764: Fix spelling errors across the codebase 2026-06-11 09:53:34 -06:00
misc Bug 42640: Script search_for_data_inconsistencies.pl use binmode UTF-8 2026-07-09 13:06:51 -06:00
offline_circ Bug 40163: Fix several http addresses in the code docs 2025-09-23 16:21:29 -06:00
opac Bug 43019: Fix branch comparison 2026-08-10 08:18:04 -06:00
patron_lists Bug 32176: Remove duplicated code to select patron from autocomplete 2025-10-31 15:26:25 -06:00
patroncards Bug 42747: (QA follow-up) Parameterize query, dedupe, and log rejections 2026-08-10 08:18:10 -06:00
plugins Bug 25952: Skip invalid repositories when searching for plugins 2025-11-21 08:41:52 -07:00
pos Bug 41705: Use PRG pattern for POS receipt printing to avoid popup blockers 2026-06-04 15:09:06 -06:00
preservation Bug 35267: Apply preferences to preview and mailing 2026-04-17 09:18:06 -06:00
recalls Bug 40163: Fix several http addresses in the code docs 2025-09-23 16:21:29 -06:00
reports Bug 42803: Only perform the lookups when !$filter is true 2026-07-09 13:06:41 -06:00
reserve Bug 37762: Circulation: Hook to holds 2026-05-08 12:25:43 -06:00
reviews Bug 40163: Fix several http addresses in the code docs 2025-09-23 16:21:29 -06:00
rotating_collections Bug 40163: Fix several http addresses in the code docs 2025-09-23 16:21:29 -06:00
serials Bug 42078: Allow vendor ID searches on serial subscription vendor search page 2026-07-07 16:07:52 -06:00
services Bug 40163: Fix several http addresses in the code docs 2025-09-23 16:21:29 -06:00
sip2 Bug 37893: Fix http links 2025-11-18 11:21:20 -07:00
skel
…
suggestion Bug 42757: Use default suggestor or fallback to librarian 2026-06-08 13:53:26 -06:00
svc Bug 42084: (QA follow-up) Simplify 2026-06-08 13:53:12 -06:00
t Bug 42866: Prevent SQL injection in Koha::AddtionalContents->search_for_display 2026-08-10 08:18:08 -06:00
tags Bug 42254: (QA follow-up) Remove unused var, fixing a FIXME 2026-04-28 15:48:24 -06:00
tools Bug 43019: Prevent access to pages belonging to another library (staff side) 2026-08-10 08:18:05 -06:00
virtualshelves Bug 40916: Fix another occurance 2025-10-06 09:15:22 -06:00
xt Bug 42764: Include filename in codespell test output 2026-06-11 09:53:36 -06:00
.codespell-ignore Bug 42764: Fix false positives caused by POD letter-code formatting 2026-06-11 09:53:35 -06:00
.editorconfig
…
.git-blame-ignore-revs
…
.gitignore Bug 26355: Add a Vue island for the self-renewal modal 2026-05-01 09:30:00 -06:00
.htaccess
…
.mailmap Bug 40041: (follow-up) Fix periods and add Robert Fox 2025-12-05 09:29:04 -07:00
.nvmrc Bug 42353: Store the node version in .nvmrc 2026-04-15 09:14:53 -06:00
.perlcriticrc
…
.perltidyrc
…
.prettierrc.js
…
.proverc.dist
…
.stylelintrc.json
…
INSTALL
…
Koha.pm Bug 42397: DBRev 26.05.01.001 2026-07-07 16:07:50 -06:00
LICENSE Bug 40163: Fix several http addresses in the code docs 2025-09-23 16:21:29 -06:00
MANIFEST.SKIP
…
Makefile.PL Bug 41076: Adjust our perl tidiness for v20250105 2026-02-05 09:03:51 -07:00
README
…
README.md Bug 40163: Fix several http addresses in the code docs 2025-09-23 16:21:29 -06:00
README.robots
…
SECURITY.md Bug 40527: Initial draft of SECURITY.md 2025-10-09 14:58:41 -06:00
about.pl Bug 42453: Remove warning 2026-07-13 16:10:30 -06:00
app.psgi Bug 38365: Integrate CSP middleware into Plack apps 2026-03-16 11:57:12 +01:00
build-resources.PL Bug 40163: (follow-up) Fix wrong GNU links and update test 2025-09-24 09:25:04 -06:00
changelanguage.pl Bug 40163: Fix several http addresses in the code docs 2025-09-23 16:21:29 -06:00
cpanfile Bug 42317: Update minimum version for MARC::File::XML 2026-05-20 09:04:55 -06:00
cypress.config.ts Bug 41362: Allow Cypress tests to use KOHA_USER and KOHA_PASS as override 2026-01-06 07:45:35 -07:00
eslint.config.mjs
…
fix-perl-path.PL Bug 40163: (follow-up) Fix wrong GNU links and update test 2025-09-24 09:25:04 -06:00
gulpfile.js Bug 42356: Silence Sass if-function deprecation warning 2026-04-17 09:18:15 -06:00
help.pl Bug 40163: Fix several http addresses in the code docs 2025-09-23 16:21:29 -06:00
kohaversion.pl
…
mainpage.pl Bug 40163: Fix several http addresses in the code docs 2025-09-23 16:21:29 -06:00
package.json Bug 34973: Upgrade Font Awesome in the OPAC to 7.2 2026-06-04 15:09:08 -06:00
rewrite-config.PL Bug 40163: (follow-up) Fix wrong GNU links and update test 2025-09-24 09:25:04 -06:00
rspack.config.js Bug 37762: VueJS ILL Module 2026-05-08 12:25:38 -06:00
tsconfig.json
…
yarn.lock Bug 34973: Update yarn.lock 2026-06-09 15:42:19 -06:00

README.md

Koha is a free software integrated library system (ILS).

Koha is distributed under the GNU GPL version 3 or later.

Note: Koha does not accept pull requests from git hosting sites.

Note: This project has its own bug tracker, to report a bug or submit a patch visit https://bugs.koha-community.org.

For guidelines on submitting patches for Koha please visit https://wiki.koha-community.org/wiki/SubmitingAPatch

The developers handbook can be found at https://wiki.koha-community.org/wiki/Developer_handbook

https://koha-community.org/

Koha Logo