gitea
/
Koha-clms
1
0
Fork 0
Code Issues Pull Requests Packages Projects Releases Wiki Activity
Koha-clms/admin
History
David Cook 9513b93c82 Bug 14521: SQL injection in local use system preferences 
This patch fixes a SQL injection vulnerability in the local use
system preferences.

_TEST PLAN_

Before applying:

1) Go to Global System Preferences
2) Click on the "Local use" tab
3) Add a new preference with the value "') or '1' = '1' -- "
(be sure to include the space at the end after the comment --).
4) When the page refreshes, you should now see about 99 other system
preferences which shouldn't be showing up.

5) Apply the patch

6) Refresh the page
7) Note that you now only see a system preference for "') or '1' = '1' -- "
and the other actual local use system preferences.

Signed-off-by: Chris Cormack <chrisc@catalyst.net.nz>

Signed-off-by: Jonathan Druart <jonathan.druart@bugs.koha-community.org>
Signed-off-by: Tomas Cohen Arazi <tomascohen@unc.edu.ar>
(cherry picked from commit a72262a950)
Signed-off-by: Chris Cormack <chrisc@catalyst.net.nz>
Signed-off-by: Liz Rea <wizzyrea@gmail.com>
 		2015-07-21 16:06:37 +12:00
..
admin-home.pl Bug 9978: (followup) Replace license header with the correct license (GPLv3+) 2015-04-22 11:28:58 +12:00
aqbudget_user_search.pl Bug 7304: More permissions for budgets 2012-06-27 16:25:44 +02:00
aqbudgetperiods.pl Bug 9978: Replace license header with the correct license (GPLv3+) 2015-04-22 11:28:36 +12:00
aqbudgets.pl Bug 9978: Replace license header with the correct license (GPLv3+) 2015-04-22 11:28:36 +12:00
aqcontract.pl Bug 9978: Replace license header with the correct license (GPLv3+) 2015-04-22 11:28:36 +12:00
aqplan.pl Bug 9978: Replace license header with the correct license (GPLv3+) 2015-04-22 11:28:36 +12:00
auth_subfields_structure.pl Bug 9978: Replace license header with the correct license (GPLv3+) 2015-04-22 11:28:36 +12:00
auth_tag_structure.pl Bug 9978: Replace license header with the correct license (GPLv3+) 2015-04-22 11:28:36 +12:00
authorised_values.pl Bug 9978: Replace license header with the correct license (GPLv3+) 2015-04-22 11:28:36 +12:00
authtypes.pl Bug 14042: Get rid of the home made pagination in the auth type admin 2015-05-18 09:46:31 +12:00
biblio_framework.pl Bug 9978: Replace license header with the correct license (GPLv3+) 2015-04-22 11:28:36 +12:00
branch_transfer_limits.pl Bug 9978: Replace license header with the correct license (GPLv3+) 2015-04-22 11:28:36 +12:00
branches.pl Bug 8802: On editing a library group category type is not set 2015-07-16 10:02:12 +00:00
categorie.pl Bug 9978: Replace license header with the correct license (GPLv3+) 2015-04-22 11:28:36 +12:00
check_budget_parent.pl Bug 9978: Replace license header with the correct license (GPLv3+) 2015-04-22 11:28:36 +12:00
check_parent_total.pl Bug 9978: Replace license header with the correct license (GPLv3+) 2015-04-22 11:28:36 +12:00
checkmarc.pl Bug 9978: Replace license header with the correct license (GPLv3+) 2015-04-22 11:28:36 +12:00
cities.pl Bug 9978: Replace license header with the correct license (GPLv3+) 2015-04-22 11:28:36 +12:00
classsources.pl Bug 9978: Replace license header with the correct license (GPLv3+) 2015-04-22 11:28:36 +12:00
clone-rules.pl Bug 9978: (followup) Replace license header with the correct license (GPLv3+) 2015-04-22 11:28:58 +12:00
columns_settings.pl Bug 10212: Columns configuration for tables 2014-08-26 09:28:03 -03:00
columns_settings.yml Bug 10212: Columns configuration for tables - Unit tests 2014-08-26 09:28:18 -03:00
currency.pl Bug 9978: Replace license header with the correct license (GPLv3+) 2015-04-22 11:28:36 +12:00
didyoumean.pl Bug 8726: ExplodedTerms suggestion plugin (functionality) 2012-09-28 17:08:21 +02:00
env_tz_test.pl Bug 11349: Change .tmpl -> .tt in scripts using templates 2014-07-17 11:05:49 -03:00
fieldmapping.pl Bug 9978: Replace license header with the correct license (GPLv3+) 2015-04-22 11:28:36 +12:00
import_export_framework.pl Bug 9978: Replace license header with the correct license (GPLv3+) 2015-04-22 11:28:36 +12:00
item_circulation_alerts.pl Bug 9978: (followup) Replace license header with the correct license (GPLv3+) 2015-04-22 11:28:58 +12:00
items_search_field.pl Bug 11425: Add item search form in staff interface 2014-11-04 19:08:12 -03:00
items_search_fields.pl Bug 11425: Add item search form in staff interface 2014-11-04 19:08:12 -03:00
itemtypes.pl Bug 9978: Replace license header with the correct license (GPLv3+) 2015-04-22 11:28:36 +12:00
koha2marclinks.pl Bug 9978: Replace license header with the correct license (GPLv3+) 2015-04-22 11:28:36 +12:00
marc_subfields_structure.pl Bug 9978: Replace license header with the correct license (GPLv3+) 2015-04-22 11:28:36 +12:00
marctagstructure.pl Bug 9978: Replace license header with the correct license (GPLv3+) 2015-04-22 11:28:36 +12:00
matching-rules.pl Bug 9978: Replace license header with the correct license (GPLv3+) 2015-04-22 11:28:36 +12:00
oai_set_mappings.pl Bug 9978: Replace license header with the correct license (GPLv3+) 2015-04-22 11:28:36 +12:00
oai_sets.pl Bug 9978: Replace license header with the correct license (GPLv3+) 2015-04-22 11:28:36 +12:00
patron-attr-types.pl Bug 9978: Replace license header with the correct license (GPLv3+) 2015-04-22 11:28:36 +12:00
preferences.pl Bug 10131: Add a fallback if the pref search is not a valid regex 2015-04-22 17:52:00 +12:00
printers.pl Bug 9978: Replace license header with the correct license (GPLv3+) 2015-04-22 11:28:36 +12:00
smart-rules.pl Bug 9978: Replace license header with the correct license (GPLv3+) 2015-04-22 11:28:36 +12:00
sru_modmapping.pl Bug 6536: Add a form for SRU Field mapping 2014-09-01 10:08:50 -03:00
stopwords.pl Bug 9978: Replace license header with the correct license (GPLv3+) 2015-04-22 11:28:36 +12:00
systempreferences.pl Bug 14521: SQL injection in local use system preferences 2015-07-21 16:06:37 +12:00
transport-cost-matrix.pl Bug 9978: Replace license header with the correct license (GPLv3+) 2015-04-22 11:28:36 +12:00
z3950servers.pl Bug 6536: SRU servers administration 2014-09-01 10:09:03 -03:00