gitea
/
Koha-clms
1
0
Fork 0
Code Issues Pull Requests Packages Projects Releases Wiki Activity
52,891 Commits 39 Branches 720 Tags 6 GiB
Perl 44.2%
JavaScript 41.1%
HTML 6%
XSLT 3.1%
Vue 1.9%
Other 3.2%
Go to file
Kyle M Hall c9ffc538de Bug 33339: Prevent Formula Injection (CSV Injection) in CSV files 
The system is vulnerable to Formula Injection attacks as the data
stored within the database and exported as CSV/Excel is not being
sanitized or validated against implanted formula payloads

This patch modifies all uses of Text::CSV and derived classes to pass
the "formula" parameter with value of "empty" which replaces formulas
by empty string.

Test Plan:
1) Apply this patch
2) For guided_reports.pl, attempt to export CSV where you've set a column to a formula somehow
   ( such as "=1+3" )
3) Export that CSV file
4) Note the formula has not been exported
5) Repeat this plan for the remaining scripts that export CSV files
   where users can define the outputted data

Signed-off-by: Magnus Enger <magnus@libriotech.no>
Fixed two conflicts. I have tested that this works as advertised on:
- Reports (Download > Comma separated text (.csv)) [Text::CSV::Encoded]
- Circulation > Overdues > Download file of all overdues [Text::CSV_XS]
- misc/export_borrowers.pl [Text::CSV]
This covers all modules used, and both GUI and command line.

Signed-off-by: Chris Cormack <chris@bigballofwax.co.nz>

Signed-off-by: Marcel de Rooy <m.de.rooy@rijksmuseum.nl>
[EDIT] Change none to empty in the commit message ! None is the default,
doing nothing. Empty clears the formulas.
Signed-off-by: Lucas Gass <lucas@bywatersolutions.com>
(cherry picked from commit e588f810a521065bf46dc037edeac5c83d537714)
Signed-off-by: Fridolin Somers <fridolin.somers@biblibre.com>
 		2024-11-05 15:43:13 +01:00
C4 Bug 33339: Prevent Formula Injection (CSV Injection) in CSV files 2024-11-05 15:43:13 +01:00
Koha Bug 33339: Prevent Formula Injection (CSV Injection) in CSV files 2024-11-05 15:43:13 +01:00
acqui Bug 10758: Show title of deleted biblio on basket page 2024-08-02 14:37:14 +02:00
admin Bug 33339: Prevent Formula Injection (CSV Injection) in CSV files 2024-11-05 15:43:13 +01:00
api Bug 29509: Update swagger specification and add permissions to users 2024-09-10 15:17:57 +02:00
authorities Bug 25387: (QA follow-up) Tidy 2024-07-19 11:30:08 +02:00
basket Bug 34731: Don't call SendQueuedMessages if message_id is bad 2023-09-12 09:44:59 -03:00
bin
…
bookings Bug 35574: Bookings tab from biblio details should only require manage_bookings permission 2024-01-03 15:48:28 +01:00
catalogue Bug 37425: Check for existence of biblio object before fetching cover images 2024-09-10 16:12:29 +02:00
cataloguing Bug 36792: Limit POSIX imports 2024-05-30 10:02:31 +02:00
circ Bug 33339: Prevent Formula Injection (CSV Injection) in CSV files 2024-11-05 15:43:13 +01:00
clubs Bug 25079: Show club enrollment question answers in staff client 2023-06-23 11:00:54 -03:00
course_reserves Bug 20256: Use new methods 2023-02-02 11:59:26 -03:00
debian Bug 33563: Add comments for Elasticsearch security config 2024-07-19 11:27:56 +02:00
docs Bug 37003: (follow-up) Amend 22.11 RMaint 2024-07-19 11:10:06 +02:00
erm Bug 32922: Remove space in shebang 2023-02-20 09:44:06 -03:00
errors Bug 29420: HTTP status code incorrect when calling error pages directly under Plack/PSGI 2022-04-20 09:03:39 -10:00
etc Bug 33563: Add comments for Elasticsearch security config 2024-07-19 11:27:56 +02:00
ill Bug 35930: Add guards for plugins_enabled 2024-02-15 10:51:57 +01:00
installer Bug 37593: Removed all instances of 'this this' in the codebase 2024-10-21 13:49:28 +02:00
koha-tmpl Bug 37724: Remove Koha version number from OPAC 2024-11-05 15:39:54 +01:00
labels Bug 33339: Prevent Formula Injection (CSV Injection) in CSV files 2024-11-05 15:43:13 +01:00
lib/CGI/Session/Serialize Bug 17600: Standardize our EXPORT_OK 2021-07-16 08:58:47 +02:00
members Bug 33849: Do not reset new patrons home library when error occurs 2024-05-29 13:57:54 +02:00
misc Bug 33339: Prevent Formula Injection (CSV Injection) in CSV files 2024-11-05 15:43:13 +01:00
offline_circ Bug 34529: Offline circulation should be able to accept userid as well as cardnumber 2023-11-06 11:34:44 -03:00
opac Bug 37339: Set messaging preferences from default on self registration 2024-10-21 15:35:16 +02:00
patron_lists Bug 34977: (QA follow-up) Tidy code 2023-11-08 11:41:33 -03:00
patroncards Bug 24001: Fix patron card template edition 2022-04-28 10:49:20 -10:00
plugins Bug 35536: Refine verbose handling in some Koha::Plugins calls 2024-07-22 14:00:11 +02:00
pos Bug 34731: Don't call SendQueuedMessages if message_id is bad 2023-09-12 09:44:59 -03:00
preservation Bug 34030: Add a "print slips" action links to print in batch 2023-10-23 11:33:55 -03:00
recalls Bug 34013: Recalls awaiting pickup doesn't show count on each tab 2023-06-23 10:01:04 -03:00
reports Bug 33339: Prevent Formula Injection (CSV Injection) in CSV files 2024-11-05 15:43:13 +01:00
reserve Bug 35559: Revert changes from bug 34634 2024-05-24 14:43:23 +02:00
reviews Bug 17600: Standardize our EXPORT_OK 2021-07-16 08:58:47 +02:00
rotating_collections Bug 17600: Standardize our EXPORT_OK 2021-07-16 08:58:47 +02:00
serials Bug 33339: Prevent Formula Injection (CSV Injection) in CSV files 2024-11-05 15:43:13 +01:00
services Bug 17600: Standardize our EXPORT_OK 2021-07-16 08:58:47 +02:00
skel
…
suggestion Bug 37337: Pass the save $op when biblio_exists 2024-09-17 15:55:11 +02:00
svc Bug 37508: Throw error if password column is detected in SQL report 2024-08-13 02:03:22 -03:00
t Bug 33339: Prevent Formula Injection (CSV Injection) in CSV files 2024-11-05 15:43:13 +01:00
tags Bug 30718: Use flatpickr's altInput 2022-08-19 08:26:31 -03:00
tools Bug 33339: Prevent Formula Injection (CSV Injection) in CSV files 2024-11-05 15:43:13 +01:00
virtualshelves Bug 37285: (QA follow-up) Perl Tidy 2024-09-10 16:49:41 +02:00
xt Bug 37018: Add 400 response definition to all routes 2024-07-25 09:58:11 +02:00
.editorconfig Bug 27375: Set YAML file settings in .editorconfig 2021-11-03 15:40:52 +01:00
.eslintrc.json
…
.gitignore Bug 35174: Add misc/translator/po to .gitignore 2023-11-16 08:56:36 +01:00
.htaccess
…
.mailmap Bug 36943: (follow-up) 24.05.00 - Update .mailmap 2024-05-30 10:03:25 +02:00
.perlcriticrc
…
.perltidyrc Bug 30002: Adjust perltidy 2023-06-08 08:32:42 -03:00
.proverc.dist Bug 19821: Install sample data, ES mappings and Version syspref 2021-10-25 11:27:40 +02:00
.stylelintrc.json Bug 31528: (follow-up) A few additional rules 2022-10-03 08:23:15 -03:00
INSTALL
…
Koha.pm Increment version for 23.11.09 release 2024-10-03 12:05:02 +02:00
LICENSE
…
MANIFEST.SKIP
…
Makefile.PL Bug 35759: (bug 30708 follow-up) Generated dist file not installed for preservation module 2024-01-17 10:06:28 +01:00
README
…
README.md
…
README.robots
…
about.pl Bug 36134: Read complete Elasticsearch configuration in about.pl 2024-03-11 11:20:07 +01:00
app.psgi Bug 36149: Add userenv middleware to app.psgi 2024-04-24 07:36:20 +02:00
build-resources.PL Bug 32609: Use the current yarn.lock to generate node_modules 2023-02-10 11:07:57 -03:00
changelanguage.pl
…
cpanfile Bug 34064: Add SQL::Translator dependency to cpanfile 2023-10-10 10:54:04 -03:00
cypress.config.ts Bug 34319: Upgrade cypress 9.7.0 to 12.17.2 2023-09-05 11:52:25 -03:00
fix-perl-path.PL
…
gulpfile.js Bug 36730: (Bug 35428 follow-up) po files (sometimes) fail to update 2024-05-24 16:12:44 +02:00
help.pl Bug 17600: Standardize our EXPORT_OK 2021-07-16 08:58:47 +02:00
kohaversion.pl
…
mainpage.pl Bug 30493: (QA follow-up) Fix for the only_my_library case as well 2024-07-19 11:05:22 +02:00
package.json Bug 34319: Upgrade cypress 9.7.0 to 12.17.2 2023-09-05 11:52:25 -03:00
rewrite-config.PL
…
tsconfig.json Bug 32030: Move cypress to t - fix build_js/watch_js 2022-11-08 09:44:52 -03:00
webpack.config.js Bug 30708: Vue app 2023-10-18 15:41:40 -03:00
yarn.lock Bug 34319: Update yarn.lock 2023-09-05 11:52:25 -03:00

README.md

Koha is a free software integrated library system (ILS).

Koha is distributed under the GNU GPL version 3 or later.

Note: Koha does not accept pull requests from git hosting sites.

Note: This project has its own bug tracker, to report a bug or submit a patch visit http://bugs.koha-community.org.

For guidelines on submitting patches for Koha please visit https://wiki.koha-community.org/wiki/SubmitingAPatch

The developers handbook can be found at https://wiki.koha-community.org/wiki/Developer_handbook

http://koha-community.org/

Koha Logo