[Koha-bugs] [Bug 17045] Write API to Allow instant use of reports library
bugzilla-daemon at bugs.koha-community.org
bugzilla-daemon at bugs.koha-community.org
Thu Aug 4 01:57:32 CEST 2016
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=17045
Chris Cormack <chris at bigballofwax.co.nz> changed:
What |Removed |Added
----------------------------------------------------------------------------
CC| |chris at bigballofwax.co.nz
--- Comment #1 from Chris Cormack <chris at bigballofwax.co.nz> ---
I think doing something with mana that biblibre is working on is a much better
idea.
Running stuff directly from a wiki that anyone can edit, is a hugely insecure
idea.
SELECT
biblionumber,
CONCAT('<script>alert\(\"',title,'\"\)</script>') AS Title
FROM biblio
ORDER BY biblionumber
Is a safe but annoying one, it could easily be changed to run some much more
dangerous js, or dump the persons sessionid etc.
I would hope people are reading the sql they are cutting and pasting.
--
You are receiving this mail because:
You are watching all bug changes.
More information about the Koha-bugs
mailing list