gitea
/
Koha-clms
1
0
Fork 0
Code Issues Pull Requests Packages Projects Releases Wiki Activity
Koha-clms/admin
History
Kyle M Hall 3d03eff4a4 Bug 33339: Prevent Formula Injection (CSV Injection) in CSV files 
The system is vulnerable to Formula Injection attacks as the data
stored within the database and exported as CSV/Excel is not being
sanitized or validated against implanted formula payloads

This patch modifies all uses of Text::CSV and derived classes to pass
the "formula" parameter with value of "empty" which replaces formulas
by empty string.

Test Plan:
1) Apply this patch
2) For guided_reports.pl, attempt to export CSV where you've set a column to a formula somehow
   ( such as "=1+3" )
3) Export that CSV file
4) Note the formula has not been exported
5) Repeat this plan for the remaining scripts that export CSV files
   where users can define the outputted data

Signed-off-by: Magnus Enger <magnus@libriotech.no>
Fixed two conflicts. I have tested that this works as advertised on:
- Reports (Download > Comma separated text (.csv)) [Text::CSV::Encoded]
- Circulation > Overdues > Download file of all overdues [Text::CSV_XS]
- misc/export_borrowers.pl [Text::CSV]
This covers all modules used, and both GUI and command line.

Signed-off-by: Chris Cormack <chris@bigballofwax.co.nz>

Signed-off-by: Marcel de Rooy <m.de.rooy@rijksmuseum.nl>
[EDIT] Change none to empty in the commit message ! None is the default,
doing nothing. Empty clears the formulas.
Signed-off-by: Lucas Gass <lucas@bywatersolutions.com>
 		2024-11-07 23:02:54 +00:00
..
searchengine/elasticsearch Bug 33099: Add missing MARC21 Match authority mappings so "Search all headings" search works 2024-05-14 15:34:29 +02:00
additional-fields.pl Bug 34478: op =~ ^cud- in pl/pm 2024-03-01 10:56:11 +01:00
admin-home.pl Bug 36206: (QA follow-up) Tidy admin-home.pl 2024-04-26 14:14:56 +02:00
adveditorshortcuts.pl Bug 34478: op =~ ^cud- in pl/pm 2024-03-01 10:56:11 +01:00
aqbudgetperiods.pl Bug 36739: Correct CSRF change to budget deletions 2024-05-17 12:03:53 +02:00
aqbudgets.pl Bug 37089: cud-delete_confirm should not be cud 2024-07-18 19:22:52 +00:00
aqcontract.pl Bug 37152: Can't delete an Acquisitions contract 2024-07-18 19:52:37 +00:00
aqplan.pl Bug 33339: Prevent Formula Injection (CSV Injection) in CSV files 2024-11-07 23:02:54 +00:00
audio_alerts.pl Bug 34478: Manual fix - audio alerts 2024-03-01 10:59:02 +01:00
auth_subfields_structure.pl Bug 34478: Authority frameworks - first subfield delete button has incorrect op value 2024-03-01 10:59:21 +01:00
auth_tag_structure.pl Bug 37163: Fix the redirect after deleting a tag from an authority framework to load the right page 2024-07-18 20:25:04 +00:00
authorised_values.pl Bug 28869: (follow-up) Switch to cud-edit_category for CSRF 2024-05-17 10:36:25 +02:00
authtypes.pl Bug 37080: Cannot delete MARC bibliographic frameworks or authority types 2024-07-18 19:21:37 +00:00
background_jobs.pl Bug 34478: op =~ ^cud- in pl/pm 2024-03-01 10:56:11 +01:00
biblio_framework.pl Bug 37080: Cannot delete MARC bibliographic frameworks or authority types 2024-07-18 19:21:37 +00:00
branch_transfer_limits.pl Bug 34478: Manual fix - add op admin/branch_transfer_limits 2024-03-01 10:57:53 +01:00
branches.pl Bug 6796: Take CalenderFirstDayOfWeek and TimeFormat into account 2024-04-12 11:26:08 +02:00
cash_registers.pl Bug 36193: cud- treatment for cash_registers.pl 2024-03-12 17:47:29 +01:00
categories.pl Bug 37152: Deleting patron categories doesn't warn about categories in use 2024-07-18 19:52:37 +00:00
check_budget_parent.pl Bug 17600: Standardize our EXPORT_OK 2021-07-16 08:58:47 +02:00
check_parent_total.pl Bug 34478: op =~ ^cud- in pl/pm 2024-03-01 10:56:11 +01:00
checkmarc.pl Bug 17600: Standardize our EXPORT_OK 2021-07-16 08:58:47 +02:00
cities.pl Bug 34478: Cities - Incorrect op check for cud-delete_confirm 2024-03-01 10:59:23 +01:00
classsources.pl Bug 34478: Classification config - Convert delete links to form POSTS 2024-03-01 10:59:24 +01:00
clone-rules.pl Bug 34478: Add 'op' to admin/smart-rules 2024-03-01 10:58:24 +01:00
columns_settings.pl Bug 34478: Fix op check in table settings admin 2024-03-01 10:59:27 +01:00
columns_settings.yml Bug 35191: Make entries per page configurable for items table on staff detail page 2024-10-09 19:51:44 +00:00
credit_types.pl Bug 36193: cud- treatment for credit_types.pl 2024-03-12 17:47:29 +01:00
curbside_pickup.pl Bug 34478: op =~ ^cud- in pl/pm 2024-03-01 10:56:11 +01:00
currency.pl Bug 37089: cud-delete_confirm should not be cud 2024-07-18 19:22:52 +00:00
debit_types.pl Bug 36193: cud- treatment for debit_types.pl 2024-03-12 17:47:30 +01:00
desks.pl Bug 36597: Fix deletion of circulation desks broken by CSRF 2024-04-18 16:51:11 +02:00
didyoumean.pl Bug 17600: Standardize our EXPORT_OK 2021-07-16 08:58:47 +02:00
edi_accounts.pl Bug 37090: Correct op parameter in edi_accounts.pl 2024-07-18 18:07:16 +00:00
edi_ean_accounts.pl Bug 36995: Correct parameter name for library EAN deletion 2024-06-27 14:00:16 +00:00
identity_providers.pl Bug 36276: Fix editing of identity provider and domains 2024-09-18 14:21:29 +00:00
ill_batch_statuses.pl Bug 35581: Illbatchstatus* -> ILL::Batch::Status* 2024-04-22 08:57:42 +02:00
import_export_authtype.pl Bug 34478: import_export_authtype - cud-import, export 2024-03-01 11:00:01 +01:00
import_export_framework.pl Bug 34478: Rename action with op - import_export_framework 2024-03-01 10:56:49 +01:00
item_circulation_alerts.pl Bug 34478: Fix op variable in item circulation alerts 2024-03-01 10:59:31 +01:00
items_search_field.pl Bug 34478: op =~ ^cud- in pl/pm 2024-03-01 10:56:11 +01:00
items_search_fields.pl Bug 34478: op =~ ^cud- in pl/pm 2024-03-01 10:56:11 +01:00
itemtypes.pl Bug 34478: Item type deletion - correct delete_confirm and delete_confirmed 2024-03-01 10:59:33 +01:00
koha2marclinks.pl Bug 34478: Changes for admin/koha2marclinks 2024-03-01 10:57:44 +01:00
library_groups.pl Bug 34478: Rename action with op - admin/library_groups 2024-03-01 10:56:37 +01:00
localization.pl Bug 17600: Standardize our EXPORT_OK 2021-07-16 08:58:47 +02:00
marc-overlay-rules.pl Bug 36880: Record overlay rules are not validated 2024-07-19 14:35:16 +00:00
marc_subfields_structure.pl Bug 36395: Remove useless fetch in admin/marc_subfields_structure.pl 2024-04-05 11:51:16 +02:00
marctagstructure.pl Bug 37161: After deleting a tag in a MARC framework, redirect back to the tag list rather than showing a 'Tag deleted' page first 2024-07-18 20:18:43 +00:00
matching-rules.pl Bug 34478: Manual fix - admin/matching-rules 2024-03-01 10:59:53 +01:00
oai_set_mappings.pl Bug 34478: op =~ ^cud- in pl/pm 2024-03-01 10:56:11 +01:00
oai_sets.pl Bug 34478: Corrections to add and delete of OAI sets 2024-03-01 10:59:34 +01:00
overdrive.pl Bug 34478: op =~ ^cud- in pl/pm 2024-03-01 10:56:11 +01:00
patron-attr-types.pl Bug 32610: Add date option to extended patron attributes administration page 2024-04-30 17:09:48 +02:00
preferences.pl Bug 29948: Fix display of selected values 2024-05-13 14:00:11 +02:00
record_sources.pl Bug 35919: Add record sources admin page 2024-04-26 17:06:04 +02:00
restrictions.pl Bug 36193: cud- treatment for restrictions.pl 2024-03-12 17:47:31 +01:00
search_filters.pl Bug 34478: op =~ ^cud- in pl/pm 2024-03-01 10:56:11 +01:00
share_content.pl Bug 34478: op =~ ^cud- in pl/pm - Manual cud-email => email 2024-03-01 10:57:14 +01:00
smart-rules.pl Bug 37263: Fix URL param retrieval 2024-09-06 16:23:33 +00:00
sms_providers.pl Bug 34478: op =~ ^cud- in pl/pm 2024-03-01 10:56:11 +01:00
smtp_servers.pl Bug 34478: Correct value of "op" when loading the edit form. 2024-03-01 10:59:36 +01:00
sru_modmapping.pl Bug 17600: Standardize our EXPORT_OK 2021-07-16 08:58:47 +02:00
systempreferences.pl Bug 37091: Correct op parameter in systempreferences.pl 2024-07-18 19:42:10 +00:00
transfer_limits.pl Bug 17600: Standardize our EXPORT_OK 2021-07-16 08:58:47 +02:00
transport-cost-matrix.pl Bug 34478: op =~ ^cud- in pl/pm 2024-03-01 10:56:11 +01:00
usage_statistics.pl Bug 34478: op =~ ^cud- in pl/pm 2024-03-01 10:56:11 +01:00
z3950servers.pl Bug 34478: Manual fix - Remove cud-search from z3950-admin-search.inc 2024-03-01 10:59:10 +01:00