gitea
/
Koha-clms
1
0
Fork 0
Code Issues Pull Requests Packages Projects Releases Wiki Activity
Koha-clms/C4
History
Martin Renvoize d059db421b
Bug 42746: (QA follow-up) Sanitize agefield and substitution field at the sink too 
The original fix only whitelisted agefield, condition_field, and
substitution_field at the point they're saved in
tools/automatic_item_modification_by_age.pl, leaving the actual
consumer of the stored syspref, C4::Items::ToggleNewStatus, trusting
agefield and substitution field unchecked. agefield is spliced
directly into raw SQL (TO_DAYS($agefield)) and so can't be
parameterized like an ordinary value; substitution field reaches a
dynamic method call ($item->$field($value)). Any future or
alternate writer of the automatic_item_modification_by_age_configuration
syspref would have reopened both holes without touching the form at
all.

This adds the same allow-list validation directly in ToggleNewStatus
(falling back to the safe default agefield, or skipping the
substitution/condition, exactly as before for missing values), shares
the age-field allow-list between the two files via a new
GetAutomaticItemModificationAgeFields() in C4::Items so it can't drift
between them, and logs rejected values via Koha::Logger instead of
silently discarding them so tampering leaves an audit trail.

Signed-off-by: Martin Renvoize <martin.renvoize@openfifth.co.uk>
Signed-off-by: Lucas Gass <lucas@bywatersolutions.com>
(cherry picked from commit 9d6f6571f6c43baff87cfde43304dbe98f642535)
Signed-off-by: Lucas Gass <lucas@bywatersolutions.com>
 		2026-08-10 08:18:12 -06:00
..
AuthoritiesMarc Bug 40163: Fix several http addresses in the code docs 2025-09-23 16:21:29 -06:00
Barcodes Bug 42221: Fix EAN-13 autoBarcode not incrementing 2026-04-16 15:54:09 -06:00
ClassSortRoutine Bug 40163: Fix several http addresses in the code docs 2025-09-23 16:21:29 -06:00
ClassSplitRoutine Bug 30233: (follow-up) Fix POD formatting codes in _apply_substitution 2026-08-10 08:18:03 -06:00
Creators Bug 42764: Fix spelling errors across the codebase 2026-06-11 09:53:34 -06:00
External Bug 41479: Remove Baker & Taylor integration 2026-03-24 07:50:10 +01:00
Form Bug 28308: Remove 0 from "days in advance" for "Advance notice" 2026-01-30 10:54:02 -07:00
Heading Bug 40163: Fix several http addresses in the code docs 2025-09-23 16:21:29 -06:00
ILSDI Bug 40622: Add missing interface parameter 2025-10-06 09:15:27 -06:00
Installer Bug 40163: Fix several http addresses in the code docs 2025-09-23 16:21:29 -06:00
Labels Bug 40473: Use better algorithm for calculating Code39 barcode length 2025-09-26 10:36:41 -06:00
Linker Bug 40163: Fix several http addresses in the code docs 2025-09-23 16:21:29 -06:00
Members Bug 28308: Remove 0 from "days in advance" for "Advance notice" 2026-01-30 10:54:02 -07:00
OAI Bug 40163: Fix several http addresses in the code docs 2025-09-23 16:21:29 -06:00
Output Bug 40163: Fix several http addresses in the code docs 2025-09-23 16:21:29 -06:00
Patroncards Bug 40680: Fix C4/Patroncards/Patroncard.pm 2025-12-01 08:33:57 -07:00
Reports Bug 39164: Add max_statement_time to SQL report queries 2026-04-15 14:10:33 -06:00
SIP Bug 42847: (QA follow-up) Clear session state on all login_core exit paths 2026-08-10 08:18:07 -06:00
Search Bug 40163: Fix several http addresses in the code docs 2025-09-23 16:21:29 -06:00
Serials Bug 40163: Fix several http addresses in the code docs 2025-09-23 16:21:29 -06:00
Utils/DataTables Bug 42764: Fix spelling errors across the codebase 2026-06-11 09:53:34 -06:00
Accounts.pm Bug 35612: (QA follow-up) Use interface parameter and remove self-referential use 2026-02-27 11:38:53 -07:00
Acquisition.pm Bug 42749: Prevent SQL injection from GetInvoices (order_by) 2026-08-10 08:18:08 -06:00
Auth.pm Bug 17387: (follow-up) move records_restore under editcatalogue permission 2026-04-15 14:10:27 -06:00
Auth_cas_servers.yaml.sample Bug 17065 - Rename C4/Auth_cas_servers.yaml.orig 2016-08-08 13:16:36 +00:00
Auth_with_cas.pm Bug 40680: Move EXPORT_OK right after Modern::Perl 2025-12-01 08:33:56 -07:00
Auth_with_ldap.pm Bug 40680: Move EXPORT_OK right after Modern::Perl 2025-12-01 08:33:56 -07:00
Auth_with_shibboleth.pm Bug 42764: Fix false positives caused by POD letter-code formatting 2026-06-11 09:53:35 -06:00
AuthoritiesMarc.pm Bug 42032: (follow-up) Eliminate phantom indicator diffs on authority MODIFY 2026-05-05 13:42:06 -06:00
Barcodes.pm Bug 18584: Remove trailing spaces in Barcodes.pm 2025-11-18 06:56:42 -07:00
Biblio.pm Bug 42188: Use MARC-in-JSON for biblio action log diffs 2026-05-05 13:42:00 -06:00
Breeding.pm Bug 42321: Improve handling of empty Z3950/SRU search results 2026-07-13 16:10:30 -06:00
Budgets.pm Bug 40680: Move EXPORT_OK right after Modern::Perl 2025-12-01 08:33:56 -07:00
Calendar.pm Bug 40163: Fix several http addresses in the code docs 2025-09-23 16:21:29 -06:00
Charset.pm Bug 40680: Move EXPORT_OK right after Modern::Perl 2025-12-01 08:33:56 -07:00
Circulation.pm Bug 37762: (QA follow-up): Fix checkout for bib-level holds 2026-05-08 12:25:47 -06:00
ClassSortRoutine.pm Bug 40680: Move EXPORT_OK right after Modern::Perl 2025-12-01 08:33:56 -07:00
ClassSource.pm Bug 40680: Move EXPORT_OK right after Modern::Perl 2025-12-01 08:33:56 -07:00
ClassSplitRoutine.pm Bug 40680: Move EXPORT_OK right after Modern::Perl 2025-12-01 08:33:56 -07:00
Context.pm Bug 42360: Move separator validation to C4::Context::csv_delimiter 2026-07-07 07:47:46 -06:00
Contract.pm Bug 40163: Fix several http addresses in the code docs 2025-09-23 16:21:29 -06:00
CourseReserves.pm Bug 40680: Move EXPORT_OK right after Modern::Perl 2025-12-01 08:33:56 -07:00
Creators.pm Bug 40163: Fix several http addresses in the code docs 2025-09-23 16:21:29 -06:00
HTML5Media.pm Bug 40163: Fix several http addresses in the code docs 2025-09-23 16:21:29 -06:00
Heading.pm Bug 40680: Move EXPORT_OK right after Modern::Perl 2025-12-01 08:33:56 -07:00
HoldsQueue.pm Bug 41983: Insert hold_group_id when creating tmp_holdsqueue 2026-05-06 15:20:56 -06:00
ImportBatch.pm Bug 39516: (follow-up) Add missing POD for private subroutines 2026-04-29 09:09:23 -06:00
ImportExportFramework.pm Bug 40680: Move EXPORT_OK right after Modern::Perl 2025-12-01 08:33:56 -07:00
InstallAuth.pm Bug 41454: Remove unused dbh calls 2026-04-15 09:14:51 -06:00
Installer.pm Bug 42318: Populate record_sources with system defined values on install 2026-04-15 09:14:45 -06:00
ItemCirculationAlertPreference.pm Bug 40163: Fix several http addresses in the code docs 2025-09-23 16:21:29 -06:00
Items.pm Bug 42746: (QA follow-up) Sanitize agefield and substitution field at the sink too 2026-08-10 08:18:12 -06:00
Koha.pm Bug 40680: Move EXPORT_OK right after Modern::Perl 2025-12-01 08:33:56 -07:00
Labels.pm Bug 21395: Make perlcritic happy 2020-06-29 12:37:02 +02:00
Languages.pm Bug 41440: Fix bug revealed by unit test 2026-04-15 14:10:32 -06:00
Letters.pm Bug 42136: prevent cgi, directory, and file plugins from use in user-entered templates 2026-04-28 15:48:20 -06:00
Linker.pm Bug 40163: Fix several http addresses in the code docs 2025-09-23 16:21:29 -06:00
Log.pm Bug 42032: (follow-up) Write state JSON to AUTHORITIES info column 2026-05-05 13:42:05 -06:00
MarcModificationTemplates.pm Bug 16994: (QA follow-up) Align overwrite result key across module, template and tests 2026-04-17 09:18:17 -06:00
Matcher.pm Bug 39516: (follow-up) Add missing POD for private subroutines 2026-04-29 09:09:23 -06:00
Members.pm Bug 40680: Move EXPORT_OK right after Modern::Perl 2025-12-01 08:33:56 -07:00
Message.pm Bug 40163: Fix several http addresses in the code docs 2025-09-23 16:21:29 -06:00
Output.pm Bug 30261: Render opac 404 for opac/tracklinks.pl 2026-03-20 11:54:32 +00:00
Overdues.pm Bug 23415: (follow-up) Fallback to 'days' in 'get_chargeable_units' 2026-03-25 13:48:06 +01:00
Patroncards.pm Bug 38664: Tidy the whole codebase 2025-02-11 14:58:24 +01:00
Record.pm Bug 41690: Add MARC21 245 (subtitle) to Cite option 2026-05-01 11:04:35 -06:00
Reports.pm Bug 42360: Move separator validation to C4::Context::csv_delimiter 2026-07-07 07:47:46 -06:00
Reserves.pm Bug 42764: Fix false positives caused by POD letter-code formatting 2026-06-11 09:53:35 -06:00
Ris.pm Bug 40163: Fix several http addresses in the code docs 2025-09-23 16:21:29 -06:00
RotatingCollections.pm Bug 40163: Fix several http addresses in the code docs 2025-09-23 16:21:29 -06:00
SMS.pm Bug 40163: Fix several http addresses in the code docs 2025-09-23 16:21:29 -06:00
Scheduler.pm Bug 40680: Move EXPORT_OK right after Modern::Perl 2025-12-01 08:33:56 -07:00
Scrubber.pm Bug 40659: Change Scrubber profile name to opac_virtual_card 2026-04-23 16:04:11 -06:00
Search.pm Bug 41454: Remove unused dbh calls 2026-04-15 09:14:51 -06:00
Serials.pm Bug 41330: Escape braces in serials number management 2026-03-09 17:06:50 -06:00
Service.pm Bug 40163: Fix several http addresses in the code docs 2025-09-23 16:21:29 -06:00
ShelfBrowser.pm Bug 40680: Move EXPORT_OK right after Modern::Perl 2025-12-01 08:33:56 -07:00
SocialData.pm Bug 42764: Fix spelling errors across the codebase 2026-06-11 09:53:34 -06:00
Stats.pm Bug 40680: Move EXPORT_OK right after Modern::Perl 2025-12-01 08:33:56 -07:00
Suggestions.pm Bug 42645: Use notice_email_address in ModSuggestion SMS fallback check 2026-07-13 16:10:31 -06:00
TTParser.pm Bug 40163: Fix several http addresses in the code docs 2025-09-23 16:21:29 -06:00
Tags.pm Bug 40680: Move EXPORT_OK right after Modern::Perl 2025-12-01 08:33:56 -07:00
Templates.pm Bug 41837: Remove $path from C4::Templates 2026-03-09 17:06:50 -06:00
TmplToken.pm Bug 40163: Fix several http addresses in the code docs 2025-09-23 16:21:29 -06:00
TmplTokenType.pm Bug 40680: Move EXPORT_OK right after Modern::Perl 2025-12-01 08:33:56 -07:00
UsageStats.pm Bug 34353: Remove 'SpineLabelShowPrintOnBibDetails' syspref 2026-04-29 09:09:27 -06:00
XISBN.pm Bug 41454: Remove unused dbh calls 2026-04-15 09:14:51 -06:00
XSLT.pm Bug 40972: (QA follow-up) POD 2026-04-15 14:10:16 -06:00