gitea
/
Koha-clms
1
0
Fork 0
Code Issues Pull Requests Packages Projects Releases Wiki Activity
Koha-clms/acqui
History
David Cook 7e33daa2c2
Bug 41591: Prevent inline rendering of invoice files 
This patch forces download of invoice files rather than showing
them inline where they can potentially perform XSS

Test plan:
0. Apply the patch
1. koha-plack --restart kohadev
2. Find or create an active vendor
3. Create a basket if one doesn't already exist
4. Receive a shipment for the vendor
5. Create an invoice
6. Go to the invoice
7. In the URL change invoice.pl to invoice-files.pl
(or turn on AcqEnableFiles and go to it that way)
8. Upload an image file (e.g. SVG) or PDF
9. Click on the filename
10. Note that instead of displaying in the browser,
the file will be downloaded

Signed-off-by: Jonathan Druart <jonathan.druart@bugs.koha-community.org>

Signed-off-by: Marcel de Rooy <m.de.rooy@rijksmuseum.nl>
(cherry picked from commit 9ef05dfa7ec321a5bc7c84e0732d3d4ede945702)
Signed-off-by: Baptiste Wojtkowski <baptiste.wojtkowski@biblibre.com>
 		2026-02-23 13:32:22 +00:00
..
acqui-home.pl Bug 39044: Pass budgets to template 2025-03-19 23:58:09 +01:00
addorder.pl Bug 35044: (QA follow-up): DRY code before set_additional_fields 2024-08-23 18:21:26 +02:00
addorderiso2709.pl Bug 35026: (QA follow-up): Restore order grouping 2024-08-19 18:59:48 +02:00
ajax-getauthvaluedropbox.pl Bug 17600: Standardize our EXPORT_OK 2021-07-16 08:58:47 +02:00
basket.pl Bug 39572: Improve EDIFACT order confirmation message 2025-07-31 15:48:37 +02:00
basketgroup.pl Bug 34478: Basket group export CSV option should not check cud-op 2024-03-01 10:59:17 +01:00
basketheader.pl Bug 35044: (QA follow-up): DRY code before set_additional_fields 2024-08-23 18:21:26 +02:00
booksellers.pl Bug 33103: Prevent vendors to be displayed several times in the search result 2023-04-20 15:48:42 -03:00
cancelorder.pl Bug 36173: (follow-up) Tidy 2024-04-05 11:51:18 +02:00
check_budget_total.pl Bug 17600: Standardize our EXPORT_OK 2021-07-16 08:58:47 +02:00
check_uniqueness.pl Bug 36511: Some scripts missing a dependency following Bug 24879 2024-04-10 09:09:50 +02:00
duplicate_orders.pl Bug 34478: Manual fix - duplicate_orders (cud-select) 2024-03-01 10:56:15 +01:00
edifactmsgs.pl Bug 34478: op =~ ^cud- in pl/pm 2024-03-01 10:56:11 +01:00
edimsg.pl Bug 17600: Fix tests 2021-07-16 09:47:01 +02:00
finishreceive.pl Bug 36193: Fix acq receiving 2024-03-12 17:47:28 +01:00
histsearch.pl Bug 37377: Fix orders search do_search param 2024-07-22 07:26:42 +01:00
invoice-files.pl Bug 41591: Prevent inline rendering of invoice files 2026-02-23 13:32:22 +00:00
invoice.pl Bug 38155: (QA follow-up) Fix TT filters and scalar context 2025-02-04 21:44:06 +01:00
invoices.pl Bug 36233: Use select2 to load vendors on invoice search 2024-03-15 09:38:37 +01:00
lateorders-export.pl Bug 15348: trivial code simplification 2022-09-16 10:36:53 -03:00
lateorders.pl Bug 34478: op =~ ^cud- in pl/pm 2024-03-01 10:56:11 +01:00
moddeliverydate.pl Bug 34478: op =~ ^cud- in pl/pm 2024-03-01 10:56:11 +01:00
modordernotes.pl Bug 34478: op =~ ^cud- in pl/pm 2024-03-01 10:56:11 +01:00
neworderempty.pl Bug 35044: Update: Acquisition orders 2024-08-23 18:21:22 +02:00
newordersubscription.pl Bug 17600: Standardize our EXPORT_OK 2021-07-16 08:58:47 +02:00
newordersuggestion.pl Bug 23991: Move SearchSuggestion to Koha::Suggestions 2022-06-27 12:30:28 -03:00
ordered.pl Bug 31631: Optionally use tax-exclusive values for calculating fund values 2023-10-18 15:41:35 -03:00
orderreceive.pl Bug 37265: Consideration of UniqueItemFields setting when receiving items in an order 2024-10-02 10:50:41 +01:00
parcel.pl Bug 36193: cud- treatment for Acq order receipt cancelling 2024-03-12 17:47:28 +01:00
parcels.pl Bug 38343: Add info if there are closed invoices not displayed 2024-11-22 10:22:40 +01:00
showorder.pl Bug 17600: Standardize our EXPORT_OK 2021-07-16 08:58:47 +02:00
spent.pl Bug 31631: (QA follow-up) Tidy code 2023-10-18 15:41:37 -03:00
supplier.pl Bug 34478: op =~ ^cud- in pl/pm 2024-03-01 10:56:11 +01:00
transferorder.pl Bug 37343: Fixed search for vendors when transferring an item in acquistions 2024-07-22 07:37:24 +01:00
uncertainprice.pl Bug 34478: op =~ ^cud- in pl/pm 2024-03-01 10:56:11 +01:00
updatesupplier.pl Bug 34478: Changes for acqui/supplier 2024-03-01 10:57:47 +01:00
vendor_issues.pl Bug 36635: Fix vendor's issue show view 2024-04-19 18:06:33 +02:00
z3950_search.pl Bug 34478: op =~ ^cud- in pl/pm 2024-03-01 10:56:11 +01:00