gitea
/
Koha-clms
1
0
Fork 0
Code Issues Pull Requests Packages Projects Releases Wiki Activity
57,324 Commits 39 Branches 720 Tags 6 GiB
Perl 44.2%
JavaScript 41.1%
HTML 6%
XSLT 3.1%
Vue 1.9%
Other 3.2%
Go to file
David Cook 7e33daa2c2
Bug 41591: Prevent inline rendering of invoice files 
This patch forces download of invoice files rather than showing
them inline where they can potentially perform XSS

Test plan:
0. Apply the patch
1. koha-plack --restart kohadev
2. Find or create an active vendor
3. Create a basket if one doesn't already exist
4. Receive a shipment for the vendor
5. Create an invoice
6. Go to the invoice
7. In the URL change invoice.pl to invoice-files.pl
(or turn on AcqEnableFiles and go to it that way)
8. Upload an image file (e.g. SVG) or PDF
9. Click on the filename
10. Note that instead of displaying in the browser,
the file will be downloaded

Signed-off-by: Jonathan Druart <jonathan.druart@bugs.koha-community.org>

Signed-off-by: Marcel de Rooy <m.de.rooy@rijksmuseum.nl>
(cherry picked from commit 9ef05dfa7ec321a5bc7c84e0732d3d4ede945702)
Signed-off-by: Baptiste Wojtkowski <baptiste.wojtkowski@biblibre.com>
 		2026-02-23 13:32:22 +00:00
.github/workflows Bug 40027: Use GitHub workflow to automatically close PRs opened on the Koha repo there 2025-11-10 14:42:18 +01:00
C4 Bug 41104: Remove -sameSite from checkauth() response headers 2025-12-02 12:01:56 +01:00
Koha Bug 40219: Moved Extended Attributes Validation Before Enqueuing Welcome Email 2026-02-18 14:54:41 +01:00
acqui Bug 41591: Prevent inline rendering of invoice files 2026-02-23 13:32:22 +00:00
admin Bug 41100: EDI vendor account port numbers no longer editable 2025-12-04 15:38:35 +01:00
api Bug 40543: Remove pickup_library.branchname embed 2025-10-10 14:11:53 +02:00
authorities Bug 36603: (QA follow-up) Resolve two conditional declarations 2024-11-08 16:42:53 +01:00
basket Bug 31224: Update instances of metadata->record 2024-11-07 16:29:23 +01:00
bin
…
bookings Bug 35574: Bookings tab from biblio details should only require manage_bookings permission 2023-12-18 15:21:04 +01:00
catalogue Bug 40559: Fix noisy warning in MARCdetail 2025-12-02 11:24:04 +01:00
cataloguing Bug 25015: (QA follow-up) Slide together 2025-08-08 16:26:27 +02:00
circ Bug 41229: Fix desk and register session persistence on library change 2025-12-04 15:13:21 +01:00
clubs Bug 34478: Manual fix - add op clubs/templates-add-modify 2024-03-01 10:57:55 +01:00
course_reserves Bug 28762: Use Koha::Course in course-details controller 2024-07-23 16:04:05 +01:00
debian Bug 41032: Fix Open Fifth missing in plugin repos config 2025-12-04 14:35:24 +01:00
docs Bug 40022: Add the 25.11 release team (squashed) 2025-07-25 16:39:02 +02:00
erm
…
errors Bug 37741: Do not send cookie back from error pages 2024-08-30 12:45:45 +02:00
etc Bug 41032: Fix Open Fifth missing in plugin repos config 2025-12-04 14:35:24 +01:00
ill Bug 40171: Remove extraneous join() 2025-10-31 15:05:58 +00:00
installer Increment version for 24.11.12 release 2026-01-22 14:43:33 +00:00
koha-tmpl Bug 41591: Prevent inline rendering of invoice files 2026-02-23 13:32:22 +00:00
labels Bug 30745: (QA follow-up) tidy 2024-11-18 17:44:31 +01:00
lib Bug 35681: Use ::Bootstrap version of FromANSI 2024-05-02 16:47:39 +02:00
members Bug 41212: Sort debit_types for manual invoice by description 2025-12-04 11:34:49 +01:00
misc Update release notes for 24.11.12 release 2026-01-26 13:35:04 +00:00
offline_circ Bug 34478: Changes for offline_circ 2024-03-01 10:58:34 +01:00
opac Bug 41662: Prevent CSRF on opac-patron-consent.pl 2026-01-22 14:42:47 +00:00
patron_lists Bug 37266: [24.11.x] patron_lists/delete.pl should have CSRF protection 2025-02-24 19:30:42 +01:00
patroncards Bug 39800: Error 500 when trying to delete patron card template 2025-10-03 15:36:48 +02:00
plugins Bug 25952: Skip invalid repositories when searching for plugins 2026-01-20 14:14:47 +00:00
pos Bug 40625: Fix duplicate cashup records via POST/REDIRECT/GET pattern 2025-12-02 09:52:51 +01:00
preservation Bug 38089: (follow-up) More fixes for errors in original submission 2024-10-11 11:13:47 +02:00
recalls Bug 38089: (follow-up) More fixes for errors in original submission 2024-10-11 11:13:47 +02:00
reports Bug 39298: (QA follow-up) Add missing html filter 2025-08-08 12:19:37 +02:00
reserve Bug 38412: Display warning on biblio level 2025-09-19 14:40:19 +02:00
reviews Bug 2486: Show user comments in staff interface 2024-08-26 17:39:42 +02:00
rotating_collections Bug 31930: Ignore whitespace before and after barcodes 2025-09-17 17:20:55 +02:00
serials Bug 40861: Remove warning from serials/acqui-search-result.pl 2025-10-16 12:16:45 +02:00
services
…
skel
…
suggestion Bug 41593: Validate displayby parameter in suggestion.pl 2026-01-22 14:42:46 +00:00
svc Bug 31224: Update instances of metadata->record 2024-11-07 16:29:23 +01:00
t Bug 41001: (QA follow-up): Add 'Confirmation messages with inputs' specific tests 2026-02-20 14:04:50 +00:00
tags Bug 38969: (QA follow-up) fix tidy 2025-04-24 18:42:32 +02:00
tools Bug 40843: Sort patron attributes by description 2025-12-04 11:31:14 +01:00
virtualshelves Bug 40585: (follow-up) Display error if no records were found 2025-10-16 11:22:02 +02:00
xt RMaint 24.11 fix xt/find-license-problems.t 2026-01-20 14:54:44 +01:00
.editorconfig
…
.gitignore Bug 35402: Update the OPAC and staff interface to Bootstrap 5 2024-08-23 15:58:41 +02:00
.htaccess
…
.mailmap Bug 40041: Remove duplicated or unecessary entries 2025-11-10 15:47:59 +01:00
.perlcriticrc
…
.perltidyrc Bug 30002: Adjust perltidy 2023-06-08 08:32:42 -03:00
.prettierrc.js Bug 38546: Set tabWidth and useTabs in prettierrc 2025-08-06 09:56:52 +00:00
.proverc.dist
…
.stylelintrc.json
…
INSTALL
…
Koha.pm Increment version for 24.11.12 release 2026-01-22 14:43:33 +00:00
LICENSE
…
MANIFEST.SKIP
…
Makefile.PL Bug 40027: (follow-up) Add .github/ to Makefile.PL 2025-11-10 14:44:11 +01:00
README
…
README.md
…
README.robots
…
SECURITY.md Bug 40527: Initial draft of SECURITY.md 2026-01-09 09:41:05 +01:00
about.pl Bug 40608: (follow-up) Add warning in about page 2025-09-26 16:24:09 +02:00
app.psgi Bug 36149: Add userenv middleware to app.psgi 2024-05-14 15:04:37 -03:00
build-resources.PL
…
changelanguage.pl
…
cpanfile Bug 39857: Add new dependency Test::NoWarnings for 24.11.x 2025-05-26 11:03:03 +02:00
cypress.config.ts Bug 38770: Remove @vue/cli-service and babel 2026-01-20 14:57:40 +01:00
eslint.config.mjs Bug 38167: Migrate ESLint config to new flat format 2025-08-06 09:57:04 +00:00
fix-perl-path.PL
…
gulpfile.js Bug 36640: (follow-up) CSS fixes for DataTables controls 2024-11-14 14:19:34 +01:00
help.pl
…
kohaversion.pl
…
mainpage.pl Bug 36064: (QA follow-up) Simplify and tidy 2024-10-25 11:09:51 +02:00
package.json Bug 38770: Remove @vue/cli-service and babel 2026-01-20 14:57:40 +01:00
rewrite-config.PL
…
rspack.config.js Bug 37824: (QA follow-up) Fix improper handling of jQuery and DataTables libraries by marking them as externals 2024-09-16 18:41:17 +02:00
tsconfig.json
…
webpack.config.js Bug 35919: Add record sources admin page 2024-04-26 17:06:04 +02:00
yarn.lock Bug 38770: [24.11.x] Update yarn.lock 2026-01-20 15:08:12 +01:00

README.md

Koha is a free software integrated library system (ILS).

Koha is distributed under the GNU GPL version 3 or later.

Note: Koha does not accept pull requests from git hosting sites.

Note: This project has its own bug tracker, to report a bug or submit a patch visit http://bugs.koha-community.org.

For guidelines on submitting patches for Koha please visit https://wiki.koha-community.org/wiki/SubmitingAPatch

The developers handbook can be found at https://wiki.koha-community.org/wiki/Developer_handbook

http://koha-community.org/

Koha Logo