November 2003 - Koha-bugs - lists.koha-community.org

[Bug 384] copyrightdate: marc - kohadb mapping
by bugzilla-daemon＠wilbur.katipo.co.nz 06 Nov '03

06 Nov '03

http://bugs.koha.org/cgi-bin/bugzilla/show_bug.cgi?id=384 ------- Additional Comments From mjr(a)ttllp.co.uk 2003-11-07 05:40 -------

1 0

[Bug 662] New: Probable insecure use of prepare()
by bugzilla-daemon＠wilbur.katipo.co.nz 06 Nov '03

06 Nov '03

http://bugs.koha.org/cgi-bin/bugzilla/show_bug.cgi?id=662 Summary: Probable insecure use of prepare() Product: Koha Version: CVS Platform: PC Status: NEW Severity: critical Priority: P2 Component: Database AssignedTo: chris(a)katipo.co.nz ReportedBy: mjr(a)ttllp.co.uk QAContact: koha-bugs(a)lists.sourceforge.net We need to get rid of non-placeholder SQL queries as mentioned in http://sourceforge.net/mailarchive/message.php?msg_id=6362003 because they often contribute to security problems (through lack of quoting) and misleading error messages (usually "you have an error in your SQL near..." when a variable is not set). The following files should be examined and noted on this bug report when they are cleaned to use placeholders: $ grep -rl 'prepare(".*\$' . ./C4/Biblio.pm ./C4/SearchMarc.pm ./C4/Maintainance.pm ./C4/Circulation/Borrower.pm ./C4/Circulation/Circ2.pm ./C4/Search.pm ./C4/Accounts2.pm ./C4/Groups.pm ./C4/BookShelves.pm ./C4/Shelf.pm ./C4/Catalogue.pm ./marc/benchmarks/getdata-paul-regex ./marc/benchmarks/getdata-paul ./marc/benchmarks/getdata-steve ./marc/benchmarks/getdata-sergey ./admin/thesaurus.pl ./admin/checkmarc.pl ./admin/systempreferences.pl ./admin/authorised_values.pl ./admin/aqbudget.pl ./admin/marc_subfields_structure.pl ./admin/currency.pl ./admin/koha2marclinks.pl ./admin/printers.pl ./admin/itemtypes.pl ./admin/aqbookfund.pl ./admin/stopwords.pl ./admin/marctagstructure.pl ./admin/z3950servers.pl ./admin/categorie.pl ./admin/categoryitem.pl ./z3950/z3950import.pl ./updateitem.pl ./thesaurus_popup.pl ./updater/thesaurus_create.pl ./updater/updatedatabase ./bookcount.pl ./value_builder/unimarc_field_700_701_702.pl A longer list of possibles can be found by grep -rn 'prepare.*\$' . in the koha sources, but the above are the most likely. Because this may indicate security bugs, I am marking this as "critical" and invite the RM to make it "blocker" if appropriate. ------- You are receiving this mail because: ------- You are the QA contact for the bug, or are watching the QA contact.

1 0

[Bug 196] user input not checked for HTML tags
by bugzilla-daemon＠wilbur.katipo.co.nz 06 Nov '03

06 Nov '03

http://bugs.koha.org/cgi-bin/bugzilla/show_bug.cgi?id=196 mjr(a)ttllp.co.uk changed: What |Removed |Added ---------------------------------------------------------------------------- CC| |mjr(a)ttllp.co.uk Severity|major |critical Status|VERIFIED |REOPENED Component|OPAC |Templates Resolution|LATER | ------- Additional Comments From mjr(a)ttllp.co.uk 2003-11-06 12:41 ------- I think this is a security problem. Reopening. ------- You are receiving this mail because: ------- You are the QA contact for the bug, or are watching the QA contact.

1 0

[Bug 644] koha.upgrade does not create z3950-daemon-options
by bugzilla-daemon＠wilbur.katipo.co.nz 06 Nov '03

06 Nov '03

http://bugs.koha.org/cgi-bin/bugzilla/show_bug.cgi?id=644 mjr(a)ttllp.co.uk changed: What |Removed |Added ---------------------------------------------------------------------------- Status|NEW |RESOLVED Resolution| |FIXED ------- Additional Comments From mjr(a)ttllp.co.uk 2003-11-06 12:37 ------- Fixed RunAsUser and improved deduction of dir holding the options file. Marking this bug as fixed. ------- You are receiving this mail because: ------- You are the QA contact for the bug, or are watching the QA contact.

1 0

[Bug 661] circulation.pl no longer shows flags
by bugzilla-daemon＠wilbur.katipo.co.nz 05 Nov '03

05 Nov '03

http://bugs.koha.org/cgi-bin/bugzilla/show_bug.cgi?id=661 oleonard(a)athenscounty.lib.oh.us changed: What |Removed |Added ---------------------------------------------------------------------------- Summary|circulation.pl no longer |circulation.pl no longer |shows |shows flags ------- You are receiving this mail because: ------- You are the QA contact for the bug, or are watching the QA contact.

1 0

[Bug 661] New: circulation.pl no longer shows
by bugzilla-daemon＠wilbur.katipo.co.nz 05 Nov '03

05 Nov '03

http://bugs.koha.org/cgi-bin/bugzilla/show_bug.cgi?id=661 Summary: circulation.pl no longer shows Product: Koha Version: CVS Platform: All OS/Version: All Status: NEW Severity: major Priority: P2 Component: Circulation AssignedTo: chris(a)katipo.co.nz ReportedBy: oleonard(a)athenscounty.lib.oh.us QAContact: koha-bugs(a)lists.sourceforge.net I assume this changed with recent efforts to fully template circulation.pl. When opening a debarred patron's record, there is no indication on the screen of any user flags (default template, current CVS) ------- You are receiving this mail because: ------- You are the QA contact for the bug, or are watching the QA contact.

1 0

[Bug 394] Reserve process doesn't require pickup branch
by bugzilla-daemon＠wilbur.katipo.co.nz 05 Nov '03

05 Nov '03

http://bugs.koha.org/cgi-bin/bugzilla/show_bug.cgi?id=394 oleonard(a)athenscounty.lib.oh.us changed: What |Removed |Added ---------------------------------------------------------------------------- Status|VERIFIED |CLOSED ------- You are receiving this mail because: ------- You are the QA contact for the bug, or are watching the QA contact.

1 0

[Bug 438] Returning item with reserve results in error
by bugzilla-daemon＠wilbur.katipo.co.nz 05 Nov '03

05 Nov '03

http://bugs.koha.org/cgi-bin/bugzilla/show_bug.cgi?id=438 oleonard(a)athenscounty.lib.oh.us changed: What |Removed |Added ---------------------------------------------------------------------------- Status|VERIFIED |CLOSED ------- You are receiving this mail because: ------- You are the QA contact for the bug, or are watching the QA contact.

1 0

[Bug 205] 1.9.0 Red Hat installation instructions
by bugzilla-daemon＠wilbur.katipo.co.nz 05 Nov '03

05 Nov '03

http://bugs.koha.org/cgi-bin/bugzilla/show_bug.cgi?id=205 mjr(a)ttllp.co.uk changed: What |Removed |Added ---------------------------------------------------------------------------- Status|RESOLVED |VERIFIED ------- Additional Comments From mjr(a)ttllp.co.uk 2003-11-06 09:52 ------- Hello bug reporter or bugfixer, Some bugs in koha that were fixed more than six months ago have been marked as verified. If you are the reporter of this bug, please visit the URL above and change it to "CLOSED" if the bug has been fixed to your satisfaction, or "Reopen" if you want us to look at it again. (Bug fixers, I'm sorry for the message. Please do not close these bugs. Eventually, I will do them.) Thanks, MJR. ------- You are receiving this mail because: ------- You are the QA contact for the bug, or are watching the QA contact.

1 0

[Bug 202] Branch dropbox always empty even if 2 branches defined
by bugzilla-daemon＠wilbur.katipo.co.nz 05 Nov '03

05 Nov '03

http://bugs.koha.org/cgi-bin/bugzilla/show_bug.cgi?id=202 mjr(a)ttllp.co.uk changed: What |Removed |Added ---------------------------------------------------------------------------- Status|RESOLVED |VERIFIED ------- Additional Comments From mjr(a)ttllp.co.uk 2003-11-06 09:52 ------- Hello bug reporter or bugfixer, Some bugs in koha that were fixed more than six months ago have been marked as verified. If you are the reporter of this bug, please visit the URL above and change it to "CLOSED" if the bug has been fixed to your satisfaction, or "Reopen" if you want us to look at it again. (Bug fixers, I'm sorry for the message. Please do not close these bugs. Eventually, I will do them.) Thanks, MJR. ------- You are receiving this mail because: ------- You are the QA contact for the bug, or are watching the QA contact.

1 0