b0c86b0fcf
The original fix only whitelisted agefield, condition_field, and substitution_field at the point they're saved in tools/automatic_item_modification_by_age.pl, leaving the actual consumer of the stored syspref, C4::Items::ToggleNewStatus, trusting agefield and substitution field unchecked. agefield is spliced directly into raw SQL (TO_DAYS($agefield)) and so can't be parameterized like an ordinary value; substitution field reaches a dynamic method call ($item->$field($value)). Any future or alternate writer of the automatic_item_modification_by_age_configuration syspref would have reopened both holes without touching the form at all. This adds the same allow-list validation directly in ToggleNewStatus (falling back to the safe default agefield, or skipping the substitution/condition, exactly as before for missing values), shares the age-field allow-list between the two files via a new GetAutomaticItemModificationAgeFields() in C4::Items so it can't drift between them, and logs rejected values via Koha::Logger instead of silently discarding them so tampering leaves an audit trail. Signed-off-by: Martin Renvoize <martin.renvoize@openfifth.co.uk> Signed-off-by: Pedro Amorim <pedro.amorim@openfifth.co.uk> |
||
|---|---|---|
| .github/workflows | ||
| C4 | ||
| Koha | ||
| acqui | ||
| admin | ||
| api | ||
| authorities | ||
| basket | ||
| bin | ||
| bookings | ||
| catalogue | ||
| cataloguing | ||
| circ | ||
| clubs | ||
| course_reserves | ||
| debian | ||
| docs | ||
| erm | ||
| errors | ||
| etc | ||
| ill | ||
| installer | ||
| koha-tmpl | ||
| labels | ||
| lib | ||
| members | ||
| misc | ||
| offline_circ | ||
| opac | ||
| patron_lists | ||
| patroncards | ||
| plugins | ||
| pos | ||
| preservation | ||
| recalls | ||
| reports | ||
| reserve | ||
| reviews | ||
| rotating_collections | ||
| serials | ||
| services | ||
| sip2 | ||
| skel | ||
| suggestion | ||
| svc | ||
| t | ||
| tags | ||
| tools | ||
| virtualshelves | ||
| xt | ||
| .codespell-ignore | ||
| .editorconfig | ||
| .git-blame-ignore-revs | ||
| .gitignore | ||
| .htaccess | ||
| .mailmap | ||
| .nvmrc | ||
| .perlcriticrc | ||
| .perltidyrc | ||
| .prettierrc.js | ||
| .proverc.dist | ||
| .stylelintrc.json | ||
| INSTALL | ||
| Koha.pm | ||
| LICENSE | ||
| MANIFEST.SKIP | ||
| Makefile.PL | ||
| README | ||
| README.md | ||
| README.robots | ||
| SECURITY.md | ||
| about.pl | ||
| app.psgi | ||
| build-resources.PL | ||
| changelanguage.pl | ||
| cpanfile | ||
| cypress.config.ts | ||
| eslint.config.mjs | ||
| fix-perl-path.PL | ||
| gulpfile.js | ||
| help.pl | ||
| kohaversion.pl | ||
| mainpage.pl | ||
| package.json | ||
| rewrite-config.PL | ||
| rspack.config.js | ||
| tsconfig.json | ||
| yarn.lock | ||
README.md
Koha is a free software integrated library system (ILS).
Koha is distributed under the GNU GPL version 3 or later.
Note: Koha does not accept pull requests from git hosting sites.
Note: This project has its own bug tracker, to report a bug or submit a patch visit https://bugs.koha-community.org.
For guidelines on submitting patches for Koha please visit https://wiki.koha-community.org/wiki/SubmitingAPatch
The developers handbook can be found at https://wiki.koha-community.org/wiki/Developer_handbook
