gitea
/
Koha-clms
1
0
Fork 0
Code Issues Pull Requests Packages Projects Releases Wiki Activity
52,658 Commits 39 Branches 720 Tags 6 GiB
Perl 44.2%
JavaScript 41.1%
HTML 6%
XSLT 3.1%
Vue 1.9%
Other 3.2%
Go to file
Marcel de Rooy 6c450b98ea Bug 36875: Do not pass unsanitized language to $page->translated_content 
Test plan:
Try to access opac-page.pl with a language not in OPACLanguages.
Verify that this 'language' was not passed to sql. Simplest perhaps
by debugging AdditionalContent.pm. Something like:
 sub translated_content {
     my ( $self, $lang ) = @_;
+warn "L137: $lang";
Now have a public additional_contents page and hit it:
    /cgi-bin/koha/opac-page.pl?page_id=5&language=badsql
Check your log and find:
[2024/05/16 07:25:53] [WARN] L137: en at [etc] line 137.
So badsql was caught.

Signed-off-by: Marcel de Rooy <m.de.rooy@rijksmuseum.nl>
Signed-off-by: Victor Grousset/tuxayo <victor@tuxayo.net>
Signed-off-by: Martin Renvoize <martin.renvoize@ptfs-europe.com>
(cherry picked from commit 1a9e3647095eaf9563db59bd8b3a759a0875cc39)
Signed-off-by: Fridolin Somers <fridolin.somers@biblibre.com>
 		2024-06-06 10:59:48 +02:00
C4 Bug 36520: Prevent SQL injection in GetPreparedLetter 2024-06-06 10:59:48 +02:00
Koha Bug 36818: Escape characters in file names uploaded 2024-06-06 10:59:48 +02:00
acqui Bug 36620: (QA follow-up) Tidy controller 2024-05-29 15:01:30 +02:00
admin Bug 33099: Add missing MARC21 Match authority mappings so "Search all headings" search works 2024-05-29 14:33:28 +02:00
api Bug 26297: (follow-up) Fix specification file 2024-05-24 12:14:59 +02:00
authorities Bug 36792: Limit POSIX imports 2024-05-30 10:02:31 +02:00
basket Bug 34731: Don't call SendQueuedMessages if message_id is bad 2023-09-12 09:44:59 -03:00
bin
…
bookings Bug 35574: Bookings tab from biblio details should only require manage_bookings permission 2024-01-03 15:48:28 +01:00
catalogue Bug 36834: (Bug 29697 follow-up) Koha explodes when trying to open in Labeled MARC view a bibliographic record with an invalid biblionumber 2024-05-29 15:31:59 +02:00
cataloguing Bug 36792: Limit POSIX imports 2024-05-30 10:02:31 +02:00
circ Bug 8461: Tidy 2024-05-23 15:52:48 +02:00
clubs Bug 25079: Show club enrollment question answers in staff client 2023-06-23 11:00:54 -03:00
course_reserves Bug 20256: Use new methods 2023-02-02 11:59:26 -03:00
debian Bug 35954: Add --status to koha-plack 2024-05-24 15:18:31 +02:00
docs Bug 35504: Split list of ERM Topic experts 2024-01-15 15:23:22 +01:00
erm Bug 32922: Remove space in shebang 2023-02-20 09:44:06 -03:00
errors Bug 29420: HTTP status code incorrect when calling error pages directly under Plack/PSGI 2022-04-20 09:03:39 -10:00
etc Bug 34041: (follow-up) escape double dashes to prevent issues 2024-05-29 11:19:54 +02:00
ill Bug 35930: Add guards for plugins_enabled 2024-02-15 10:51:57 +01:00
installer Bug 36986: (follow-up) Ensure idempotency 2024-06-06 10:57:39 +02:00
koha-tmpl Bug 26176: (follow-up) Replace branch with library in syspref description 2024-06-06 10:53:50 +02:00
labels Bug 36511: Some scripts missing a dependency following Bug 24879 2024-04-11 15:57:36 +02:00
lib/CGI/Session/Serialize Bug 17600: Standardize our EXPORT_OK 2021-07-16 08:58:47 +02:00
members Bug 33849: Do not reset new patrons home library when error occurs 2024-05-29 13:57:54 +02:00
misc Bug 36845: Do not loop over the content attribute 2024-05-29 15:56:06 +02:00
offline_circ Bug 34529: Offline circulation should be able to accept userid as well as cardnumber 2023-11-06 11:34:44 -03:00
opac Bug 36875: Do not pass unsanitized language to $page->translated_content 2024-06-06 10:59:48 +02:00
patron_lists Bug 34977: (QA follow-up) Tidy code 2023-11-08 11:41:33 -03:00
patroncards Bug 24001: Fix patron card template edition 2022-04-28 10:49:20 -10:00
plugins Bug 25672: Fix double output_html_with_http_headers 2023-10-31 11:02:45 -03:00
pos Bug 34731: Don't call SendQueuedMessages if message_id is bad 2023-09-12 09:44:59 -03:00
preservation Bug 34030: Add a "print slips" action links to print in batch 2023-10-23 11:33:55 -03:00
recalls Bug 34013: Recalls awaiting pickup doesn't show count on each tab 2023-06-23 10:01:04 -03:00
reports Bug 36380: Add filter value on patron statistics report summary 2024-05-29 10:49:32 +02:00
reserve Bug 35559: Revert changes from bug 34634 2024-05-24 14:43:23 +02:00
reviews Bug 17600: Standardize our EXPORT_OK 2021-07-16 08:58:47 +02:00
rotating_collections Bug 17600: Standardize our EXPORT_OK 2021-07-16 08:58:47 +02:00
serials Bug 36511: Some scripts missing a dependency following Bug 24879 2024-04-11 15:57:36 +02:00
services Bug 17600: Standardize our EXPORT_OK 2021-07-16 08:58:47 +02:00
skel
…
suggestion Bug 34963: Restore the ability to blank fields when editing a suggestion 2024-05-23 15:50:54 +02:00
svc Bug 35942: OPAC user can enroll several times to the same club 2024-02-19 14:41:11 +01:00
t Bug 36520: Add tests 2024-06-06 10:59:48 +02:00
tags Bug 30718: Use flatpickr's altInput 2022-08-19 08:26:31 -03:00
tools Bug 36526: Remove circular dependency from Koha::Objects 2024-05-24 14:59:19 +02:00
virtualshelves Bug 36858: Remove warnings 2024-05-29 16:12:13 +02:00
xt Bug 24879: Exclude koha_perl_deps.pl 2024-03-27 07:54:16 +01:00
.editorconfig Bug 27375: Set YAML file settings in .editorconfig 2021-11-03 15:40:52 +01:00
.eslintrc.json
…
.gitignore Bug 35174: Add misc/translator/po to .gitignore 2023-11-16 08:56:36 +01:00
.htaccess
…
.mailmap Bug 36943: (follow-up) 24.05.00 - Update .mailmap 2024-05-30 10:03:25 +02:00
.perlcriticrc Bug 25898: Prohibit indirect object notation 2020-10-15 12:56:30 +02:00
.perltidyrc Bug 30002: Adjust perltidy 2023-06-08 08:32:42 -03:00
.proverc.dist Bug 19821: Install sample data, ES mappings and Version syspref 2021-10-25 11:27:40 +02:00
.stylelintrc.json Bug 31528: (follow-up) A few additional rules 2022-10-03 08:23:15 -03:00
INSTALL
…
Koha.pm Bug 36986: DBRev 23.11.05.010 2024-06-06 10:57:29 +02:00
LICENSE
…
MANIFEST.SKIP
…
Makefile.PL Bug 35759: (bug 30708 follow-up) Generated dist file not installed for preservation module 2024-01-17 10:06:28 +01:00
README
…
README.md Bug 27092: Remove note about "synced repo" from README.md 2020-11-25 16:31:58 +01:00
README.robots
…
about.pl Bug 36134: Read complete Elasticsearch configuration in about.pl 2024-03-11 11:20:07 +01:00
app.psgi Bug 36149: Add userenv middleware to app.psgi 2024-04-24 07:36:20 +02:00
build-resources.PL Bug 32609: Use the current yarn.lock to generate node_modules 2023-02-10 11:07:57 -03:00
changelanguage.pl Bug 25898: Prohibit indirect object notation 2020-10-15 12:56:30 +02:00
cpanfile Bug 34064: Add SQL::Translator dependency to cpanfile 2023-10-10 10:54:04 -03:00
cypress.config.ts Bug 34319: Upgrade cypress 9.7.0 to 12.17.2 2023-09-05 11:52:25 -03:00
fix-perl-path.PL Bug 28606: Remove $DEBUG and $ENV{DEBUG} 2021-06-24 11:53:44 +02:00
gulpfile.js Bug 36730: (Bug 35428 follow-up) po files (sometimes) fail to update 2024-05-24 16:12:44 +02:00
help.pl Bug 17600: Standardize our EXPORT_OK 2021-07-16 08:58:47 +02:00
kohaversion.pl
…
mainpage.pl Bug 35019: Add a CSRF token when deleting news 2023-10-20 17:22:02 -03:00
package.json Bug 34319: Upgrade cypress 9.7.0 to 12.17.2 2023-09-05 11:52:25 -03:00
rewrite-config.PL Bug 28519: Put CGI::Session::Serialize::yamlxs in lib directory 2021-06-17 10:07:36 +02:00
tsconfig.json Bug 32030: Move cypress to t - fix build_js/watch_js 2022-11-08 09:44:52 -03:00
webpack.config.js Bug 30708: Vue app 2023-10-18 15:41:40 -03:00
yarn.lock Bug 34319: Update yarn.lock 2023-09-05 11:52:25 -03:00

README.md

Koha is a free software integrated library system (ILS).

Koha is distributed under the GNU GPL version 3 or later.

Note: Koha does not accept pull requests from git hosting sites.

Note: This project has its own bug tracker, to report a bug or submit a patch visit http://bugs.koha-community.org.

For guidelines on submitting patches for Koha please visit https://wiki.koha-community.org/wiki/SubmitingAPatch

The developers handbook can be found at https://wiki.koha-community.org/wiki/Developer_handbook

http://koha-community.org/

Koha Logo