gitea
/
Koha-clms
1
0
Fork 0
Code Issues Pull Requests Packages Projects Releases Wiki Activity
59,027 Commits 39 Branches 720 Tags 6 GiB
Perl 44.2%
JavaScript 41.1%
HTML 6%
XSLT 3.1%
Vue 1.9%
Other 3.2%
Go to file
David Cook 5bd9c71042
Bug 41593: Validate displayby parameter in suggestion.pl 
This change validates the displayby parameter in suggestion.pl
in order to prevent SQL injection.

Test plan:
0. Do not apply the patch
1. Log into the staff interface
2. Visit the path /cgi-bin/koha/suggestion/suggestion.pl?
op=else&displayby=status+AND+EXTRACTVALUE(1,CONCAT(0x7e,@@version))
3. Notice a 500 error is generated
4. In the error logs, the MySQL version number will appear

5. Apply the patch
6. koha-plack --restart kohadev

7. Visit the path /cgi-bin/koha/suggestion/suggestion.pl?
op=else&displayby=status+AND+EXTRACTVALUE(1,CONCAT(0x7e,@@version))
8. Notice that no error is generated
9. Try each of the "Organize by" options on the left nav bar
10. Note that none of them generate an error and that the option is
retained after clicking "Go"

Signed-off-by: Jonathan Druart <jonathan.druart@bugs.koha-community.org>
Signed-off-by: Lisette Scheer <lisette@bywatersolutions.com>
Signed-off-by: Lucas Gass <lucas@bywatersolutions.com>
 		2026-01-29 07:47:26 -07:00
.github/workflows Bug 40027: Use GitHub workflow to automatically close PRs opened on the Koha repo there 2025-10-23 23:06:52 +02:00
C4 Bug 40163: Fix several http addresses in the code docs 2026-01-07 14:32:30 +00:00
Koha Bug 40163: (follow-up) Fix wrong GNU links and update test 2026-01-07 14:32:37 +00:00
acqui Bug 40163: Fix several http addresses in the code docs 2026-01-07 14:32:30 +00:00
admin Bug 40163: Fix several http addresses in the code docs 2026-01-07 14:32:30 +00:00
api Bug 40163: (follow-up) Fix wrong GNU links and update test 2026-01-07 14:32:37 +00:00
authorities Bug 40163: Fix several http addresses in the code docs 2026-01-07 14:32:30 +00:00
basket Bug 40163: Fix several http addresses in the code docs 2026-01-07 14:32:30 +00:00
bin Bug 40163: (follow-up) Fix wrong GNU links and update test 2026-01-07 14:32:37 +00:00
bookings Bug 40163: Fix several http addresses in the code docs 2026-01-07 14:32:30 +00:00
catalogue Bug 40163: Fix several http addresses in the code docs 2026-01-07 14:32:30 +00:00
cataloguing Bug 40163: Fix several http addresses in the code docs 2026-01-07 14:32:30 +00:00
circ Bug 40163: Fix several http addresses in the code docs 2026-01-07 14:32:30 +00:00
clubs Bug 40163: Fix several http addresses in the code docs 2026-01-07 14:32:30 +00:00
course_reserves Bug 40163: Fix several http addresses in the code docs 2026-01-07 14:32:30 +00:00
debian Bug 40163: (follow-up) Fix wrong GNU links and update test 2026-01-07 14:32:37 +00:00
docs Bug 40163: Fix several http addresses in the code docs 2026-01-07 14:32:30 +00:00
erm Bug 40163: Fix several http addresses in the code docs 2026-01-07 14:32:30 +00:00
errors Bug 40163: Fix several http addresses in the code docs 2026-01-07 14:32:30 +00:00
etc Bug 40163: Fix several http addresses in the code docs 2026-01-07 14:32:30 +00:00
ill Bug 40163: Fix several http addresses in the code docs 2026-01-07 14:32:30 +00:00
installer Bug 40163: (follow-up) Fix wrong GNU links and update test 2026-01-07 14:32:37 +00:00
koha-tmpl Bug 40163: Fix several http addresses in the code docs 2026-01-07 14:32:30 +00:00
labels Bug 40163: Fix several http addresses in the code docs 2026-01-07 14:32:30 +00:00
lib Bug 38664: Tidy the whole codebase 2025-02-11 14:58:24 +01:00
members Bug 40163: Fix several http addresses in the code docs 2026-01-07 14:32:30 +00:00
misc Bug 40163: (follow-up) Fix wrong GNU links and update test 2026-01-07 14:32:37 +00:00
offline_circ Bug 40163: Fix several http addresses in the code docs 2026-01-07 14:32:30 +00:00
opac Bug 40163: (follow-up) Fix wrong GNU links and update test 2026-01-07 14:32:37 +00:00
patron_lists Bug 40163: Fix several http addresses in the code docs 2026-01-07 14:32:30 +00:00
patroncards Bug 40163: Fix several http addresses in the code docs 2026-01-07 14:32:30 +00:00
plugins Bug 40163: Fix several http addresses in the code docs 2026-01-07 14:32:30 +00:00
pos Bug 40163: Fix several http addresses in the code docs 2026-01-07 14:32:30 +00:00
preservation Bug 40163: Fix several http addresses in the code docs 2026-01-07 14:32:30 +00:00
recalls Bug 40163: Fix several http addresses in the code docs 2026-01-07 14:32:30 +00:00
reports Bug 40163: (follow-up) Fix wrong GNU links and update test 2026-01-07 14:32:37 +00:00
reserve Bug 40163: Fix several http addresses in the code docs 2026-01-07 14:32:30 +00:00
reviews Bug 40163: Fix several http addresses in the code docs 2026-01-07 14:32:30 +00:00
rotating_collections Bug 40163: Fix several http addresses in the code docs 2026-01-07 14:32:30 +00:00
serials Bug 40163: Fix several http addresses in the code docs 2026-01-07 14:32:30 +00:00
services Bug 40163: Fix several http addresses in the code docs 2026-01-07 14:32:30 +00:00
skel
…
suggestion Bug 41593: Validate displayby parameter in suggestion.pl 2026-01-29 07:47:26 -07:00
svc Bug 40163: (follow-up) Fix wrong GNU links and update test 2026-01-07 14:32:37 +00:00
t Bug 40163: [25.05.x] Fixed GNU links 2026-01-07 14:32:38 +00:00
tags Bug 40163: Fix several http addresses in the code docs 2026-01-07 14:32:30 +00:00
tools Bug 40163: Fix several http addresses in the code docs 2026-01-07 14:32:30 +00:00
virtualshelves Bug 40163: Fix several http addresses in the code docs 2026-01-07 14:32:30 +00:00
xt Bug 40163: [25.05.x] Fixed GNU links 2026-01-07 14:32:38 +00:00
.codespell-ignore Bug 39325: (QA follow-up) Adjust some issues 2025-04-28 18:51:30 +02:00
.editorconfig
…
.git-blame-ignore-revs Bug 39096: Add 'tidy all' commits to a git blame ignore file 2025-02-17 13:10:25 +01:00
.gitignore Bug 40838: Add generated bookings CSS assets to gitignore 2025-09-25 16:22:51 +02:00
.htaccess
…
.mailmap Bug 40041: Remove duplicated or unecessary entries 2025-10-29 10:02:28 +01:00
.perlcriticrc
…
.perltidyrc Bug 30002: Adjust perltidy 2023-06-08 08:32:42 -03:00
.prettierrc.js Bug 38664: Treat .vue files like other JS files 2025-02-11 14:58:25 +01:00
.proverc.dist
…
.stylelintrc.json
…
INSTALL
…
Koha.pm Bug 40163: Fix several http addresses in the code docs 2026-01-07 14:32:30 +00:00
LICENSE Bug 40163: Fix several http addresses in the code docs 2026-01-07 14:32:30 +00:00
MANIFEST.SKIP
…
Makefile.PL Bug 40163: (follow-up) Fix wrong GNU links and update test 2026-01-07 14:32:37 +00:00
README
…
README.md Bug 40163: Fix several http addresses in the code docs 2026-01-07 14:32:30 +00:00
README.robots
…
SECURITY.md Bug 40527: Initial draft of SECURITY.md 2026-01-05 17:42:04 +00:00
about.pl Bug 40163: Fix several http addresses in the code docs 2026-01-07 14:32:30 +00:00
app.psgi Bug 40163: (follow-up) Fix wrong GNU links and update test 2026-01-07 14:32:37 +00:00
build-resources.PL Bug 40163: (follow-up) Fix wrong GNU links and update test 2026-01-07 14:32:37 +00:00
changelanguage.pl Bug 40163: Fix several http addresses in the code docs 2026-01-07 14:32:30 +00:00
cpanfile Bug 40164: Add Template::Plugin::JSON dependency 2025-07-10 22:47:33 +02:00
cypress.config.ts Bug 40346: Use KOHA_INTRANET_URL for the baseUrl 2025-08-22 09:47:41 +02:00
eslint.config.mjs Bug 38524: Enable ESLint for .ts and .vue files 2025-01-16 15:56:17 +01:00
fix-perl-path.PL Bug 40163: (follow-up) Fix wrong GNU links and update test 2026-01-07 14:32:37 +00:00
gulpfile.js Bug 38664: Tidy the whole codebase 2025-02-11 14:58:24 +01:00
help.pl Bug 40163: Fix several http addresses in the code docs 2026-01-07 14:32:30 +00:00
kohaversion.pl Bug 38664: Tidy the whole codebase 2025-02-11 14:58:24 +01:00
mainpage.pl Bug 40163: Fix several http addresses in the code docs 2026-01-07 14:32:30 +00:00
package.json Bug 40170: Replace cypress-mysql with mysql2 - Cypress tests 2025-07-10 22:47:37 +02:00
rewrite-config.PL Bug 40163: (follow-up) Fix wrong GNU links and update test 2026-01-07 14:32:37 +00:00
rspack.config.js Bug 40173: Make http-client reusable from Cypress tests 2025-08-22 09:47:30 +02:00
tsconfig.json Bug 32030: Move cypress to t - fix build_js/watch_js 2022-11-08 09:44:52 -03:00
yarn.lock Bug 40170: Update yarn.lock 2025-07-10 22:47:42 +02:00

README.md

Koha is a free software integrated library system (ILS).

Koha is distributed under the GNU GPL version 3 or later.

Note: Koha does not accept pull requests from git hosting sites.

Note: This project has its own bug tracker, to report a bug or submit a patch visit https://bugs.koha-community.org.

For guidelines on submitting patches for Koha please visit https://wiki.koha-community.org/wiki/SubmitingAPatch

The developers handbook can be found at https://wiki.koha-community.org/wiki/Developer_handbook

https://koha-community.org/

Koha Logo