gitea
/
Koha-clms
1
0
Fork 0
Code Issues Pull Requests Packages Projects Releases Wiki Activity
35,714 Commits 39 Branches 720 Tags 6 GiB
Perl 44.2%
JavaScript 41.1%
HTML 6%
XSLT 3.1%
Vue 1.9%
Other 3.2%
Go to file
Jonathan Druart 96f6c110ed Bug 24878: Add authentication checks to the calendar tool 
There is a security hole in 2 scripts that are used by the UI to edit
holidays.

To test:
1) Go to Tools -> Calendar, for Centerville
   Check no holiday for 30/4/2020
2) To add a new holiday without login execute
   a curl command with necessary parameters
3) Reload page from 1), verify the new holiday
   edit and delete the holiday
4) Apply the patch
5) Do 2) again, this time you get a lengthy output,
   with the magic words:

   <title>Koha &rsaquo;
       Log in to Koha
   </title>

Signed-off-by: Bernardo Gonzalez Kriegel <bgkriegel@gmail.com>
Only tested newHoliday but the fix is the same.
No errors

Signed-off-by: Nick Clemens <nick@bywatersolutions.com>

Signed-off-by: Joy Nelson <joy@bywatersolutions.com>
(cherry picked from commit 656e7814b3)

Signed-off-by: Lucas Gass <lucas@bywatersolutions.com>
 		2020-03-24 20:45:08 +00:00
C4 Bug 24094: Strip trailing spaces and punctuation from authority headings 2020-03-18 21:54:03 +00:00
Koha Bug 21663: DBRev 19.05.003 2020-03-18 22:18:58 +00:00
OpenILS Bug 9239 QA follow-up: remove stray debug code 2013-03-16 21:32:34 -04:00
acqui Bug 24389: Better error handle when claiming late orders 2020-03-10 22:19:10 +00:00
admin Bug 11281: Printing holds awaiting pickup prints both tabs 2020-03-09 19:57:24 +00:00
api/v1 Revert "Bug 24232: Fix required permissions in DELETE /biblios/:biblio_id" 2020-01-14 20:53:03 +00:00
authorities Bug 19994: Used Modern::Perl in Authorities perl scripts 2019-01-28 14:58:23 +00:00
basket Bug 21993: Display a user-friendly message when the CSRF token is wrong 2019-01-25 20:38:32 +00:00
catalogue Bug 24506: Multibranch limit does not work with ElasticSearch 2020-03-09 20:34:54 +00:00
cataloguing Bug 18499: Use items cn_source in cn_browser.pl 2020-03-10 22:12:05 +00:00
circ Bug 24106: In returns.pl, don't search for item if no barcode is provided 2019-12-20 18:13:22 +00:00
clubs Bug 18632: Remove 'CGI::param called in list context' warnings 2017-05-28 22:25:22 -04:00
course_reserves Bug 21003: Removed warning and changed wording on add_items-step2.tt 2019-03-23 09:51:36 +00:00
debian Bug 22220: Fix bib Apache rewrite rule for intranet 2020-02-13 16:08:00 +00:00
docs Update teams for 20.05 cycle 2019-11-28 18:56:59 +00:00
errors Bug 23329: Move error page to its own subroutine 2019-11-22 10:35:05 +00:00
etc Bug 22220: Fix bib Apache rewrite rule for intranet 2020-02-13 16:08:00 +00:00
ill Bug 21460: (follow-up) Fix bugs found in QA 2019-04-25 10:46:56 +00:00
installer Bug 24846: DBRev 19.05.08.004 2020-03-24 15:38:34 +00:00
koha-tmpl Bug 24846: Add new tool to batch extend due dates 2020-03-24 15:32:20 +00:00
labels Bug 21206: Replace C4::Items::GetItem 2019-02-26 13:24:07 +00:00
members Bug 24637: Add brancode in all pay circumstances 2020-02-20 15:44:31 +00:00
misc Bug 21633: Remove finesMode 'test' 2020-03-18 22:00:19 +00:00
offline_circ Bug 22600: Add 'interface' to accountlines 2019-04-10 19:43:11 +00:00
opac Bug 18933: Allow OPAC messaging SMS number to be set to empty 2020-03-18 16:51:54 +00:00
patron_lists Bug 19524: Use existing logged_in_user variable 2018-07-18 16:49:30 +00:00
patroncards Bug 21719: Fix typos 2018-11-08 02:18:46 +00:00
plugins Bug 22053: ability to enable/disable some plugins 2019-05-09 18:54:44 +00:00
reports Bug 23389: Add 'All' option to report dropdowns 2019-12-16 21:24:13 +00:00
reserve Bug 24485: Allow hold when some can be overridden 2020-02-07 20:29:12 +00:00
reviews Bug 18789: Send Koha::Patron object to the templates 2018-02-16 13:03:58 -03:00
rotating_collections Bug 21500: Remove warnings in rotating collections 2018-10-09 15:02:45 +00:00
serials Bug 23126: Remove more unnecessary linebreak processing from serial collection 2019-07-25 13:37:16 +02:00
services Bug 20019: use Modern::Perl in misc perl scripts 2018-02-05 09:47:08 -03:00
skel Bug 11078: Add locking to rebuild_zebra 2014-02-28 22:21:41 +00:00
suggestion Bug 22868: Move suggestions_manage subperm out of acquisition perm 2020-02-14 20:19:59 +00:00
svc Bug 23427: Simplify sort logic 2019-12-16 22:06:19 +00:00
t Bug 24094: Unit tests 2020-03-18 21:54:26 +00:00
tags Bug 22036: Indented code where '^I' was written rather than an indent. 2019-01-17 02:23:28 +00:00
tmp/modified_authorities
…
tools Bug 24878: Add authentication checks to the calendar tool 2020-03-24 20:45:08 +00:00
virtualshelves Bug 22941: Do not return 500 if sortfield contain parenthesis 2019-06-20 14:24:59 +02:00
xt Bug 21576: Keep compatibility with QA script 2018-10-26 17:09:52 +00:00
.editorconfig Bug 12545: Add EditorConfig.org file to the source tree 2014-08-22 11:07:45 -03:00
.gitignore Bug 20427: Convert OPAC LESS to SCSS 2018-08-09 15:17:07 +00:00
.htaccess
…
.mailmap Update mailmap - Jonathan Druart 2017-06-21 12:42:19 -03:00
.scss-lint.yml Bug 21237: Clean up staff client SCSS 2018-08-24 16:23:25 +00:00
INSTALL Bug 17626: Remove existing install instructions and link to the wiki pages instead 2016-11-22 11:29:07 +00:00
Koha.pm Bug 24846: DBRev 19.05.08.004 2020-03-24 15:38:34 +00:00
LICENSE Bug 9440 - update Koha's LICENSE file from GPL2 to GPL3 2013-02-12 08:52:10 -05:00
MANIFEST.SKIP Bug 9546 : Updating make manifest tardist 2013-02-06 23:54:46 -05:00
Makefile.PL Bug 21626: (QA follow-up) Embed teams.yaml for debian packages 2019-05-17 14:46:10 +00:00
README Bug 9440 - update Koha's LICENSE file from GPL2 to GPL3 2013-02-12 08:52:10 -05:00
README.md Bug 15465: Fix typo in bugs.k-c.org 2017-05-26 11:45:31 -03:00
README.robots
…
about.pl Bug 23445: (RM follow-up) Add warning for unexpected lengthunit 2019-09-05 16:49:01 +02:00
changelanguage.pl Bug 21299: (QA follow-up) Rename module and subroutine 2018-11-07 21:52:17 +00:00
fix-perl-path.PL Bug 9978: (followup) Replace license header with the correct license (GPLv3+) 2015-04-20 09:59:43 -03:00
gulpfile.js Bug 21751: Replace fixFloat with HC-sticky to fix Chrome display 2019-02-04 14:13:35 +00:00
help.pl Bug 19817: Use the language from the interface if valid 2018-09-06 17:32:28 +00:00
koha_perl_deps.pl Bug 20019: use Modern::Perl in misc perl scripts 2018-02-05 09:47:08 -03:00
kohaversion.pl Bug 13758: Move the Koha version from kohaversion.pl 2015-05-07 11:39:04 -03:00
mainpage.pl Bug 21907: Fix article requests count for non-superlibrarians 2019-02-04 14:50:40 +00:00
package.json Bug 19474: Convert staff client CSS to SCSS 2018-08-09 15:12:20 +00:00
rewrite-config.PL Bug 14302: Remove GRS1 specific code 2018-08-31 11:24:20 +00:00
yarn.lock Bug 19474: Convert staff client CSS to SCSS 2018-08-09 15:12:20 +00:00

README.md

Koha is a free software integrated library system (ILS).

Koha is distributed under the GNU GPL version 3 or later.

Note: This is a synced mirror of the official Koha repo.

Note: Koha does not accept pull requests from git hosting sites.

Note: This project has its own bug tracker, to report a bug or submit a patch visit http://bugs.koha-community.org.

For guidelines on submitting patches for Koha please visit https://wiki.koha-community.org/wiki/SubmitingAPatch

The developers handbook can be found at https://wiki.koha-community.org/wiki/Developer_handbook

http://koha-community.org/

Koha Logo