gitea
/
Koha-clms
1
0
Fork 0
Code Issues Pull Requests Packages Projects Releases Wiki Activity
Koha-clms/tools
History
Jonathan Druart 54dfd0a0cd Bug 24878: Add authentication checks to the calendar tool 
There is a security hole in 2 scripts that are used by the UI to edit
holidays.

To test:
1) Go to Tools -> Calendar, for Centerville
   Check no holiday for 30/4/2020
2) To add a new holiday without login execute
   a curl command with necessary parameters
3) Reload page from 1), verify the new holiday
   edit and delete the holiday
4) Apply the patch
5) Do 2) again, this time you get a lengthy output,
   with the magic words:

   <title>Koha &rsaquo;
       Log in to Koha
   </title>

Signed-off-by: Bernardo Gonzalez Kriegel <bgkriegel@gmail.com>
Only tested newHoliday but the fix is the same.
No errors

Signed-off-by: Nick Clemens <nick@bywatersolutions.com>

Signed-off-by: Joy Nelson <joy@bywatersolutions.com>
(cherry picked from commit 656e7814b3)

Signed-off-by: Hayley Mapley <hayleymapley@catalyst.net.nz>
 		2020-03-24 14:14:17 +13:00
..
csv-profiles MT2116: Addons to the CSV export 2010-02-17 07:51:33 -05:00
quotes Bug 20017: use Modern::Perl in Tools perl scripts 2018-02-05 09:46:45 -03:00
access_files.pl Bug 11317: (follow-up) Add two-level entry to koha-conf and remove unwanted characters 2018-05-03 13:26:50 -03:00
ajax-inventory.pl Bug 11944: use CGI( -utf8 ) everywhere 2015-01-13 13:07:21 -03:00
automatic_item_modification_by_age.pl Bug 16889: Remove C4::Items::biblioitems_columns and use Koha::Biblioitems->columns instead 2016-07-15 18:12:13 +00:00
background-job-progress.pl Bug 20017: use Modern::Perl in Tools perl scripts 2018-02-05 09:46:45 -03:00
batchMod.pl Bug 24423: Add biblionumber to modify items link 2020-02-10 17:21:58 +13:00
batch_delete_records.pl Bug 21201: Replace C4::Items::GetItemnumbersForBiblio calls 2018-08-31 10:44:04 +00:00
batch_record_modification.pl Bug 21142: Open uploaded files in utf-8 - batch mod/del 2018-08-21 11:45:19 +00:00
batch_records_ajax.pl Bug 21579: Make showdiffmarc.pl work for authorities and biblios 2018-10-17 12:29:41 +00:00
cleanborrowers.pl Bug 16966: move parameters to hashref 2017-03-03 17:20:05 +00:00
copy-holidays.pl Bug 20017: use Modern::Perl in Tools perl scripts 2018-02-05 09:46:45 -03:00
csv-profiles.pl Bug 8612: [Follow-up] Make usage and type different columns in table 2017-06-05 12:02:08 -03:00
exceptionHolidays.pl Bug 24878: Add authentication checks to the calendar tool 2020-03-24 14:14:17 +13:00
export.pl Bug 18201: Export data -Fix "Remove non-local items" option and add "Removes non-local records" option for existing functionality 2017-12-21 13:10:03 -03:00
holidays.pl Bug 20017: use Modern::Perl in Tools perl scripts 2018-02-05 09:46:45 -03:00
import_borrowers.pl Bug 21993: Display a user-friendly message when the CSRF token is wrong 2019-01-31 17:07:03 +00:00
inventory.pl Bug 23006: Cannot use inventory with barcodes containing special chars 2019-06-11 14:46:18 +00:00
koha-news.pl Bug 20017: use Modern::Perl in Tools perl scripts 2018-02-05 09:46:45 -03:00
letter.pl Bug 23278: Reopen last panel upon "Save and continue" in notices 2019-08-13 21:12:14 +00:00
manage-marc-import.pl Bug 20180: [sql_modes] Remove GROUP BY clause in manage-marc-import.pl 2018-04-09 16:15:17 -03:00
marc_modification_templates.pl Bug 13560: Add an 'Add' option for marc modification templates 2018-07-19 17:22:18 +00:00
modborrowers.pl Bug 21854: Use template plugin to display category description 2018-11-21 11:24:16 +00:00
newHolidays.pl Bug 24878: Add authentication checks to the calendar tool 2020-03-24 14:14:17 +13:00
overduerules.pl Bug 20017: use Modern::Perl in Tools perl scripts 2018-02-05 09:46:45 -03:00
picture-upload.pl Bug 21993: Display a user-friendly message when the CSRF token is wrong 2019-01-31 17:07:03 +00:00
quotes-upload.pl Bug 20017: use Modern::Perl in Tools perl scripts 2018-02-05 09:46:45 -03:00
quotes.pl Bug 20017: use Modern::Perl in Tools perl scripts 2018-02-05 09:46:45 -03:00
scheduler.pl Bug 20017: use Modern::Perl in Tools perl scripts 2018-02-05 09:46:45 -03:00
showdiffmarc.pl Bug 21579: Make showdiffmarc.pl work for authorities and biblios 2018-10-17 12:29:41 +00:00
stage-marc-import.pl Bug 21333: Add ability to add to basket from a new file 2018-09-26 19:05:53 +00:00
stockrotation.pl Bug 11897: Stockrotation 2018-10-09 15:46:05 +00:00
tools-home.pl Bug 18403: Patron reviews 2018-02-12 15:41:41 -03:00
upload-cover-image.pl Bug 20564: Don't use system to unzip files 2018-09-19 13:54:26 +00:00
upload-file.pl Bug 17501: Rename Upload to Uploader 2017-01-20 14:20:06 +00:00
upload.pl Bug 19633: Use alphanumeric error codes in upload 2018-08-10 10:10:46 +00:00
viewlog.pl Bug 22365: Removing warn when accessing Log Viewer 2019-04-26 15:16:12 +01:00