gitea
/
Koha-clms
1
0
Fork 0
Code Issues Pull Requests Packages Projects Releases Wiki Activity
56,109 Commits 39 Branches 720 Tags 6 GiB
Perl 44.2%
JavaScript 41.1%
HTML 6%
XSLT 3.1%
Vue 1.9%
Other 3.2%
Go to file
Magnus Enger 8e2c03cc20
Bug 37816: Stop SIP2 from logging passwords 
Koha's SIP2 server does a lot of logging, including all incoming
requests, in full. This means that passwords are logged, both for
the user the SIP2 client uses for logging into Koha, as well as
for the end users who provide a password to e.g. check something
out. This patch replaces passwords with three asterisks in
log strings, before they are written to the log.

To test, in ktd:
- Run the new tests:
  $ prove t/db_dependent/SIP/Sip.t
- Tail the SIP2 logs:
  $ sudo tail -f /var/log/koha/kohadev/sip*.log
- Telnet into the SIP2 server:
  $ telnet localhost 6001
- Try logging in by pasting this into the telnet session:
  "9300CNterm1|COmypassword|CPCPL|"
- Verify that "mypassword" is replaced by "***" in the logs
- Try different values for the password, including the correct password
  which is "term1" in ktd
- Try other SIP2 messages that include password fields (AC, AD, CO)

Update 2024-12-03: Fix issues pointed out by QA.

Signed-off-by: Victor Grousset/tuxayo <victor@tuxayo.net>

Signed-off-by: Marcel de Rooy <m.de.rooy@rijksmuseum.nl>
Signed-off-by: Paul Derscheid <paul.derscheid@lmscloud.de>
 		2025-02-18 19:17:19 +01:00
C4 Bug 37816: Stop SIP2 from logging passwords 2025-02-18 19:17:19 +01:00
Koha Bug 38454: Flush memory cache before every API request 2025-02-18 19:17:19 +01:00
acqui Bug 38343: Add info if there are closed invoices not displayed 2024-11-22 10:22:40 +01:00
admin Bug 38482: Remove save state for the holdings tables 2024-11-20 14:02:01 +01:00
api Bug 28907: REST - Remove allow-owner from public article requests cancel route 2025-02-18 19:17:18 +01:00
authorities Bug 36603: (QA follow-up) Resolve two conditional declarations 2024-11-08 16:42:53 +01:00
basket Bug 31224: Update instances of metadata->record 2024-11-07 16:29:23 +01:00
bin Bug 20582: Turn Koha into a Mojolicious application 2020-10-06 12:00:04 +02:00
bookings Bug 35574: Bookings tab from biblio details should only require manage_bookings permission 2023-12-18 15:21:04 +01:00
catalogue Bug 31224: Update instances of metadata->record 2024-11-07 16:29:23 +01:00
cataloguing Bug 38030: (QA follow-up) Move csrf_token to POST body from URL 2024-11-21 13:49:08 +01:00
circ Bug 28294: (follow-up) Adjust call to request transfer 2024-11-20 14:01:51 +01:00
clubs Bug 34478: Manual fix - add op clubs/templates-add-modify 2024-03-01 10:57:55 +01:00
course_reserves Bug 28762: Use Koha::Course in course-details controller 2024-07-23 16:04:05 +01:00
debian Bug 34088: (follow-up) fix env vars in koha-upgrade-schema 2024-11-13 17:00:49 +01:00
docs 24.11.00: Update history.txt 2024-11-25 20:38:55 +01:00
erm Bug 32922: Remove space in shebang 2023-02-20 09:44:06 -03:00
errors Bug 37741: Do not send cookie back from error pages 2024-08-30 12:45:45 +02:00
etc Bug 36991: Add ability to scan call numbers index/search field 2024-11-08 16:42:51 +01:00
ill Bug 35570: Prevent use of ILL module if deprecated FreeForm backend is installed 2024-10-31 08:05:21 +01:00
installer Increment version for 24.11.01 release 2025-01-06 13:42:01 +01:00
koha-tmpl Merge remote-tracking branch 'upstream/24.11.x' into 24.11.x-security 2025-01-06 13:38:40 +01:00
labels Bug 30745: (QA follow-up) tidy 2024-11-18 17:44:31 +01:00
lib Bug 35681: Use ::Bootstrap version of FromANSI 2024-05-02 16:47:39 +02:00
members Bug 28633: Add preferred name field to patrons 2024-11-11 14:12:09 +01:00
misc Correct layout for updated release notes for 24.11.01 release 2025-01-10 11:36:23 +01:00
offline_circ Bug 34478: Changes for offline_circ 2024-03-01 10:58:34 +01:00
opac Bug 38362: Fix printing lists on opac/opac-shelves.pl 2024-12-12 12:51:58 +01:00
patron_lists Bug 34478: Changes for patron_lists/add-modify 2024-03-01 10:57:41 +01:00
patroncards Bug 37614: Printing patron cards from patron lists should be a GET 2024-08-16 17:33:45 +02:00
plugins Bug 30897: Add option to disable automated restart 2024-04-11 16:53:42 +02:00
pos Bug 33478: Apply formatting to RECEIPT 2024-04-26 20:15:44 +02:00
preservation Bug 38089: (follow-up) More fixes for errors in original submission 2024-10-11 11:13:47 +02:00
recalls Bug 38089: (follow-up) More fixes for errors in original submission 2024-10-11 11:13:47 +02:00
reports Bug 33339: Prevent Formula Injection (CSV Injection) in CSV files 2024-11-14 10:46:31 +01:00
reserve Bug 37868: Remove C4::Reserves::ToggleSuspend 2024-10-21 15:10:35 +02:00
reviews Bug 2486: Show user comments in staff interface 2024-08-26 17:39:42 +02:00
rotating_collections Bug 34478: Manual fix - add op - rotating_collections/addItems 2024-03-01 10:57:33 +01:00
serials Bug 29818: Cannot save subscription frequency without display order 2024-11-18 17:44:35 +01:00
services Bug 17600: Standardize our EXPORT_OK 2021-07-16 08:58:47 +02:00
skel Bug 11078: Add locking to rebuild_zebra 2014-02-28 22:21:41 +00:00
suggestion Bug 33484: Fix for suggestions 2024-10-28 17:10:26 +01:00
svc Bug 31224: Update instances of metadata->record 2024-11-07 16:29:23 +01:00
t Bug 37816: Stop SIP2 from logging passwords 2025-02-18 19:17:19 +01:00
tags Bug 34478: Add 'op' to tags/review 2024-03-01 10:58:25 +01:00
tools Bug 37326: decode barcode file in inventory tool 2024-11-18 17:44:35 +01:00
virtualshelves Bug 31224: Update instances of metadata->record 2024-11-07 16:29:23 +01:00
xt Bug 37728: Adjust test to catch more missing 'op' in POSTed forms 2024-10-18 14:25:56 +02:00
.editorconfig Bug 27375: Set YAML file settings in .editorconfig 2021-11-03 15:40:52 +01:00
.eslintrc.json Bug 36400: Centralize {js,ts,vue} formatting config in .prettierrc.js 2024-04-22 08:57:39 +02:00
.gitignore Bug 35402: Update the OPAC and staff interface to Bootstrap 5 2024-08-23 15:58:41 +02:00
.htaccess
…
.mailmap 24.11.00: Update .mailmap 2024-11-25 13:16:42 +01:00
.perlcriticrc Bug 25898: Prohibit indirect object notation 2020-10-15 12:56:30 +02:00
.perltidyrc Bug 30002: Adjust perltidy 2023-06-08 08:32:42 -03:00
.prettierrc.js Bug 36400: (follow-up) remove option editorconfig from .prettierrc.js 2024-04-22 08:57:40 +02:00
.proverc.dist Bug 19821: Install sample data, ES mappings and Version syspref 2021-10-25 11:27:40 +02:00
.stylelintrc.json Bug 31528: (follow-up) A few additional rules 2022-10-03 08:23:15 -03:00
INSTALL Bug 26617: Update INSTALL file to include koha-testing-docker and Gitlab links 2020-10-15 12:56:30 +02:00
Koha.pm Increment version for 24.11.01 release 2025-01-06 13:42:01 +01:00
LICENSE Bug 9440 - update Koha's LICENSE file from GPL2 to GPL3 2013-02-12 08:52:10 -05:00
MANIFEST.SKIP Bug 9546 : Updating make manifest tardist 2013-02-06 23:54:46 -05:00
Makefile.PL Bug 37824: remove references to non-existent files in Makefile.PL 2024-09-27 15:58:35 +02:00
README Bug 9440 - update Koha's LICENSE file from GPL2 to GPL3 2013-02-12 08:52:10 -05:00
README.md Bug 27092: Remove note about "synced repo" from README.md 2020-11-25 16:31:58 +01:00
README.robots
…
about.pl Bug 35570: Prevent use of ILL module if deprecated FreeForm backend is installed 2024-10-31 08:05:21 +01:00
app.psgi Bug 36149: Add userenv middleware to app.psgi 2024-05-14 15:04:37 -03:00
build-resources.PL Bug 32609: Use the current yarn.lock to generate node_modules 2023-02-10 11:07:57 -03:00
changelanguage.pl Bug 25898: Prohibit indirect object notation 2020-10-15 12:56:30 +02:00
cpanfile Bug 38467: (follow-up) Update cpanfile 2025-02-18 19:17:19 +01:00
cypress.config.ts Bug 36012: Extend cypress's requestTimeout value 2024-03-22 15:07:36 +01:00
fix-perl-path.PL Bug 28606: Remove $DEBUG and $ENV{DEBUG} 2021-06-24 11:53:44 +02:00
gulpfile.js Bug 36640: (follow-up) CSS fixes for DataTables controls 2024-11-14 14:19:34 +01:00
help.pl Bug 17600: Standardize our EXPORT_OK 2021-07-16 08:58:47 +02:00
kohaversion.pl Bug 26384: Fix executable flags 2020-09-11 09:56:56 +02:00
mainpage.pl Bug 36064: (QA follow-up) Simplify and tidy 2024-10-25 11:09:51 +02:00
package.json Bug 38424: Upgrade redoclyly/cli version to latest stable 2024-11-20 11:36:26 +01:00
rewrite-config.PL Bug 28519: Put CGI::Session::Serialize::yamlxs in lib directory 2021-06-17 10:07:36 +02:00
rspack.config.js Bug 37824: (QA follow-up) Fix improper handling of jQuery and DataTables libraries by marking them as externals 2024-09-16 18:41:17 +02:00
tsconfig.json Bug 32030: Move cypress to t - fix build_js/watch_js 2022-11-08 09:44:52 -03:00
webpack.config.js Bug 35919: Add record sources admin page 2024-04-26 17:06:04 +02:00
yarn.lock 38424: Update yarn.lock 2024-11-20 11:36:27 +01:00

README.md

Koha is a free software integrated library system (ILS).

Koha is distributed under the GNU GPL version 3 or later.

Note: Koha does not accept pull requests from git hosting sites.

Note: This project has its own bug tracker, to report a bug or submit a patch visit http://bugs.koha-community.org.

For guidelines on submitting patches for Koha please visit https://wiki.koha-community.org/wiki/SubmitingAPatch

The developers handbook can be found at https://wiki.koha-community.org/wiki/Developer_handbook

http://koha-community.org/

Koha Logo