gitea
/
Koha-clms
1
0
Fork 0
Code Issues Pull Requests Packages Projects Releases Wiki Activity
57,467 Commits 39 Branches 720 Tags 6 GiB
Perl 44.2%
JavaScript 41.1%
HTML 6%
XSLT 3.1%
Vue 1.9%
Other 3.2%
Go to file
Amit Gupta 665b90f115
Bug 42904: Prevent XSS in patron restriction comments 
Test plan

1. Search for a patron and open the patron details page.
2. Under "Patron restrictions", add a manual restriction with the following comment:
   <img src=x onerror="alert(document.domain)">
3. Save the restriction.
4. Navigate to the patron checkouts page:
   /cgi-bin/koha/circ/circulation.pl?borrowernumber=xxx
   Verify that the JavaScript payload executes.
5. Edit the patron record:
   /cgi-bin/koha/members/memberentry.pl?op=edit_form&destination=circ&borrowernumber=xxx
   Verify that the JavaScript payload executes.
6. For OPAC - Go to OPAC Verify that the JavaScript payload executes - /cgi-bin/koha/opac-user.pl
7. Apply the patch.
8. Repeat steps 4, 5 and 6.
9. Verify that:
   1. No JavaScript is executed.
   2. The page loads normally without any alert dialog. Applicable for both the staff and opac.

Signed-off-by: David Cook <dcook@prosentient.com.au>
Signed-off-by: Martin Renvoize <martin.renvoize@openfifth.co.uk>
(cherry picked from commit 2993acb641d2d9fcfeee47918ab70cf29951c720)
Signed-off-by: Fridolin Somers <fridolin.somers@biblibre.com>
 		2026-08-14 14:59:28 +02:00
.github/workflows Bug 40027: Use GitHub workflow to automatically close PRs opened on the Koha repo there 2025-11-10 14:42:18 +01:00
C4 Bug 42847: [24.11] Prevent previously authenticated user (squashed) 2026-07-30 12:39:27 +00:00
Koha Bug 30233: (follow-up) fix some errors reported by QA tools 2026-07-30 12:17:58 +00:00
acqui Bug 41594: Disable access to invoice-files.pl if AcqEnableFiles disabled 2026-03-27 13:40:22 +00:00
admin Bug 41100: EDI vendor account port numbers no longer editable 2025-12-04 15:38:35 +01:00
api Bug 40543: Remove pickup_library.branchname embed 2025-10-10 14:11:53 +02:00
authorities Bug 36603: (QA follow-up) Resolve two conditional declarations 2024-11-08 16:42:53 +01:00
basket Bug 31224: Update instances of metadata->record 2024-11-07 16:29:23 +01:00
bin
…
bookings Bug 35574: Bookings tab from biblio details should only require manage_bookings permission 2023-12-18 15:21:04 +01:00
catalogue Bug 40559: Fix noisy warning in MARCdetail 2025-12-02 11:24:04 +01:00
cataloguing Bug 42262: encodeURIComponent for the 006 value 2026-07-17 14:09:03 +02:00
circ Bug 41904: "Use of uninitialized value..." warning in del_message.pl 2026-05-27 12:31:37 +00:00
clubs Bug 34478: Manual fix - add op clubs/templates-add-modify 2024-03-01 10:57:55 +01:00
course_reserves Bug 28762: Use Koha::Course in course-details controller 2024-07-23 16:04:05 +01:00
debian Bug 41337: Add missing Bash variable to `koha-create` 2026-07-17 14:24:52 +02:00
docs Bug 42726: Add 26.11 release team 2026-08-06 14:50:01 +00:00
erm Bug 32922: Remove space in shebang 2023-02-20 09:44:06 -03:00
errors Bug 37741: Do not send cookie back from error pages 2024-08-30 12:45:45 +02:00
etc Bug 41032: Fix Open Fifth missing in plugin repos config 2025-12-04 14:35:24 +01:00
ill Bug 40171: Remove extraneous join() 2025-10-31 15:05:58 +00:00
installer Increment version for 24.11.18 release 2026-08-06 14:50:02 +00:00
koha-tmpl Bug 42904: Prevent XSS in patron restriction comments 2026-08-14 14:59:28 +02:00
labels Bug 30745: (QA follow-up) tidy 2024-11-18 17:44:31 +01:00
lib Bug 35681: Use ::Bootstrap version of FromANSI 2024-05-02 16:47:39 +02:00
members Bug 41212: Sort debit_types for manual invoice by description 2025-12-04 11:34:49 +01:00
misc Rmaint: Fix missing sec bugs in release notes of 24.11.18 2026-08-13 10:08:39 +02:00
offline_circ Bug 34478: Changes for offline_circ 2024-03-01 10:58:34 +01:00
opac Bug 43019: Fix branch comparison 2026-07-30 09:30:27 +00:00
patron_lists Bug 37266: [24.11.x] patron_lists/delete.pl should have CSRF protection 2025-02-24 19:30:42 +01:00
patroncards Bug 42747: (QA follow-up) Parameterize query, dedupe, and log rejections 2026-07-30 10:27:39 +00:00
plugins Bug 25952: Skip invalid repositories when searching for plugins 2026-01-20 14:14:47 +00:00
pos Bug 40625: Fix duplicate cashup records via POST/REDIRECT/GET pattern 2025-12-02 09:52:51 +01:00
preservation Bug 38089: (follow-up) More fixes for errors in original submission 2024-10-11 11:13:47 +02:00
recalls Bug 38089: (follow-up) More fixes for errors in original submission 2024-10-11 11:13:47 +02:00
reports Bug 42736: Prevent SQL injection in reports/cat_issues_top.pl 2026-08-14 14:44:08 +02:00
reserve Bug 38412: Display warning on biblio level 2025-09-19 14:40:19 +02:00
reviews Bug 2486: Show user comments in staff interface 2024-08-26 17:39:42 +02:00
rotating_collections Bug 31930: Ignore whitespace before and after barcodes 2025-09-17 17:20:55 +02:00
serials Bug 40861: Remove warning from serials/acqui-search-result.pl 2025-10-16 12:16:45 +02:00
services Bug 17600: Standardize our EXPORT_OK 2021-07-16 08:58:47 +02:00
skel
…
suggestion Bug 42071: Add 'show' to options that load a single suggestion 2026-05-27 12:11:01 +00:00
svc Bug 41518: Only show autorenewal text if autorenewal allowed 2026-05-27 14:43:37 +00:00
t Bug 42847: [24.11] Fix unit test 2026-08-06 14:49:59 +00:00
tags Bug 42254: (QA follow-up) Remove unused var, fixing a FIXME 2026-04-22 20:18:26 +01:00
tools Bug 42746: (QA follow-up) Sanitize agefield and substitution field at the sink too 2026-07-30 10:29:28 +00:00
virtualshelves Bug 40585: (follow-up) Display error if no records were found 2025-10-16 11:22:02 +02:00
xt RMaint 24.11 fix xt/find-license-problems.t 2026-01-20 14:54:44 +01:00
.editorconfig Bug 27375: Set YAML file settings in .editorconfig 2021-11-03 15:40:52 +01:00
.gitignore Bug 35402: Update the OPAC and staff interface to Bootstrap 5 2024-08-23 15:58:41 +02:00
.htaccess
…
.mailmap Bug 40041: Remove duplicated or unecessary entries 2025-11-10 15:47:59 +01:00
.perlcriticrc Bug 25898: Prohibit indirect object notation 2020-10-15 12:56:30 +02:00
.perltidyrc Bug 30002: Adjust perltidy 2023-06-08 08:32:42 -03:00
.prettierrc.js Bug 38546: Set tabWidth and useTabs in prettierrc 2025-08-06 09:56:52 +00:00
.proverc.dist Bug 19821: Install sample data, ES mappings and Version syspref 2021-10-25 11:27:40 +02:00
.stylelintrc.json Bug 31528: (follow-up) A few additional rules 2022-10-03 08:23:15 -03:00
INSTALL Bug 26617: Update INSTALL file to include koha-testing-docker and Gitlab links 2020-10-15 12:56:30 +02:00
Koha.pm Increment version for 24.11.18 release 2026-08-06 14:50:02 +00:00
LICENSE
…
MANIFEST.SKIP
…
Makefile.PL Bug 40027: (follow-up) Add .github/ to Makefile.PL 2025-11-10 14:44:11 +01:00
README
…
README.md Bug 27092: Remove note about "synced repo" from README.md 2020-11-25 16:31:58 +01:00
README.robots
…
SECURITY.md Bug 40527: Initial draft of SECURITY.md 2026-01-09 09:41:05 +01:00
about.pl Bug 40608: (follow-up) Add warning in about page 2025-09-26 16:24:09 +02:00
app.psgi Bug 36149: Add userenv middleware to app.psgi 2024-05-14 15:04:37 -03:00
build-resources.PL Bug 32609: Use the current yarn.lock to generate node_modules 2023-02-10 11:07:57 -03:00
changelanguage.pl Bug 25898: Prohibit indirect object notation 2020-10-15 12:56:30 +02:00
cpanfile Bug 42317: Update minimum version for MARC::File::XML 2026-07-17 14:14:34 +02:00
cypress.config.ts Bug 38770: Remove @vue/cli-service and babel 2026-01-20 14:57:40 +01:00
eslint.config.mjs Bug 38167: Migrate ESLint config to new flat format 2025-08-06 09:57:04 +00:00
fix-perl-path.PL Bug 28606: Remove $DEBUG and $ENV{DEBUG} 2021-06-24 11:53:44 +02:00
gulpfile.js Bug 36640: (follow-up) CSS fixes for DataTables controls 2024-11-14 14:19:34 +01:00
help.pl Bug 17600: Standardize our EXPORT_OK 2021-07-16 08:58:47 +02:00
kohaversion.pl
…
mainpage.pl Bug 36064: (QA follow-up) Simplify and tidy 2024-10-25 11:09:51 +02:00
package.json Bug 38770: Remove @vue/cli-service and babel 2026-01-20 14:57:40 +01:00
rewrite-config.PL Bug 28519: Put CGI::Session::Serialize::yamlxs in lib directory 2021-06-17 10:07:36 +02:00
rspack.config.js Bug 37824: (QA follow-up) Fix improper handling of jQuery and DataTables libraries by marking them as externals 2024-09-16 18:41:17 +02:00
tsconfig.json Bug 32030: Move cypress to t - fix build_js/watch_js 2022-11-08 09:44:52 -03:00
webpack.config.js Bug 35919: Add record sources admin page 2024-04-26 17:06:04 +02:00
yarn.lock Bug 38770: [24.11.x] Update yarn.lock 2026-01-20 15:08:12 +01:00

README.md

Koha is a free software integrated library system (ILS).

Koha is distributed under the GNU GPL version 3 or later.

Note: Koha does not accept pull requests from git hosting sites.

Note: This project has its own bug tracker, to report a bug or submit a patch visit http://bugs.koha-community.org.

For guidelines on submitting patches for Koha please visit https://wiki.koha-community.org/wiki/SubmitingAPatch

The developers handbook can be found at https://wiki.koha-community.org/wiki/Developer_handbook

http://koha-community.org/

Koha Logo