December 2011 - Koha-bugs - lists.koha-community.org

[Bug 1993] Task Scheduler Needs Re-write
by bugzilla-daemon＠bugs.koha-community.org 04 Dec '11

04 Dec '11

http://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=1993 Ian Walls <ian.walls(a)bywatersolutions.com> changed: What |Removed |Added ---------------------------------------------------------------------------- CC| |chris(a)bigballofwax.co.nz --- Comment #3 from Ian Walls <ian.walls(a)bywatersolutions.com> 2011-12-04 16:58:22 UTC --- *** Bug 1554 has been marked as a duplicate of this bug. *** -- Configure bugmail: http://bugs.koha-community.org/bugzilla3/userprefs.cgi?tab=email ------- You are receiving this mail because: ------- You are the QA Contact for the bug. You are watching all bug changes.

1 0

[Bug 1554] Couple of issues with task scheduler
by bugzilla-daemon＠bugs.koha-community.org 04 Dec '11

04 Dec '11

http://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=1554 Ian Walls <ian.walls(a)bywatersolutions.com> changed: What |Removed |Added ---------------------------------------------------------------------------- Status|NEW |RESOLVED CC| |ian.walls@bywatersolutions. | |com Resolution| |DUPLICATE --- Comment #1 from Ian Walls <ian.walls(a)bywatersolutions.com> 2011-12-04 16:58:22 UTC --- Marking as duplicate of bug 1993, which represents the larger issue with the Task Scheduler. *** This bug has been marked as a duplicate of bug 1993 *** -- Configure bugmail: http://bugs.koha-community.org/bugzilla3/userprefs.cgi?tab=email ------- You are receiving this mail because: ------- You are watching all bug changes.

1 0

[Bug 1088] expand independant branches functionallity
by bugzilla-daemon＠bugs.koha-community.org 04 Dec '11

04 Dec '11

http://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=1088 Ian Walls <ian.walls(a)bywatersolutions.com> changed: What |Removed |Added ---------------------------------------------------------------------------- CC| |ian.walls@bywatersolutions. | |com --- Comment #2 from Ian Walls <ian.walls(a)bywatersolutions.com> 2011-12-04 16:55:21 UTC --- My suggestion here would be to clarify exactly "Independant Branches" should mean. There are several different functions that library networks may or may not want to enable: * Hiding other branches' materials in Search (either at first, or completely) * Hiding other branches' patrons in Patron Search (either at first, or completely) * Hiding other branches' reports, lists, etc * Prevent other branches from editing your items * Prevent other branches from editing your settings * Prevent other branches from editing your patrons * Prevent other branches from editing your reports, lists, etc. We're close on the first section, through various mechanisms. The second session looks more like individual permissions, rather than global sysprefs. For example, we'd want certain privileged individuals to be able to edit EVERYTHING (even if that's only one admin account). -- Configure bugmail: http://bugs.koha-community.org/bugzilla3/userprefs.cgi?tab=email ------- You are receiving this mail because: ------- You are watching all bug changes.

1 0

[Bug 1088] expand independant branches functionallity
by bugzilla-daemon＠bugs.koha-community.org 04 Dec '11

04 Dec '11

http://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=1088 Ian Walls <ian.walls(a)bywatersolutions.com> changed: What |Removed |Added ---------------------------------------------------------------------------- Attachment #64 is|0 |1 obsolete| | --- Comment #1 from Ian Walls <ian.walls(a)bywatersolutions.com> 2011-12-04 16:49:34 UTC --- Comment on attachment 64 --> http://bugs.koha-community.org/bugzilla3/attachment.cgi?id=64 proposed patches. Marking this patch obsolete, as it's not a Git patch, and seems based on Koha 2.2.5 -- Configure bugmail: http://bugs.koha-community.org/bugzilla3/userprefs.cgi?tab=email ------- You are receiving this mail because: ------- You are watching all bug changes.

1 0

[Bug 6629] New: [security] insecure use of Cookie for language selection
by bugzilla-daemon＠bugs.koha-community.org 04 Dec '11

04 Dec '11

http://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=6629 Bug #: 6629 Summary: [security] insecure use of Cookie for language selection Classification: Unclassified Change sponsored?: --- Product: Koha Version: unspecified Platform: All OS/Version: All Status: NEW Severity: critical Priority: P5 Component: Architecture, internals, and plumbing AssignedTo: gmcharlt(a)gmail.com ReportedBy: semarie-koha(a)latrappe.fr QAContact: koha-bugs(a)lists.koha-community.org CWE-73: External Control of File Name or Path (see http://cwe.mitre.org/data/definitions/73.html) In C4/Templates.pm, in the function themelanguage, the user language is obtain from a cookie 'KohaOpacLanguage', and use 'as-it' in the path's construction for the template filename. In the next piece of code, $la is 'KohaOpacLanguage' cookie value: > # searches through the themes and languages. First template it find it returns. > # Priority is for getting the theme right. > THEME: > foreach my $th (@themes) { > foreach my $la (@languages) { > if ( -e "$htdocs/$th/$la/modules/$tmpl" ) { > $theme = $th; > $lang = $la; > last THEME; > } > last unless $la =~ /[-_]/; > } > } In opac/opac-main.pl, same: if cookie 'KohaOpacLanguage' exists, it used. Here, the page also used HTTP_ACCEPT_LANGUAGE sanitized with regex. In koha/installer/install.pl and koha/installer/InstallAuth.pm the cookie is also used (but need verification if it used in manner that permit exploit). As the cookie could be forged (user input), and contains any characters, it could embed '../' for path-traversable. The exploitation of this problem is mitigated by the fact that the perl function '-e' seems to be resultant to '\0' inclusion (in order to strip all strings after the variable). Suggestions: - A regex sanitization should be used, or, should used C4::Output::getlanguagecookie function, which take only the first two characters (I will prefer a regex like /^[a-zA-Z]*$/ ) - An unified method should be used: a function somewhere (C4:Templates ?) that return a list of possible languages: - first element: cookie value sanitized (if exist) - next sanitized list of ENV{HTTP_ACCEPT_LANGUAGE} - next 'en' -- Configure bugmail: http://bugs.koha-community.org/bugzilla3/userprefs.cgi?tab=email ------- You are receiving this mail because: ------- You are the QA Contact for the bug.

1 40

[Bug 4051] add columns to overdues export
by bugzilla-daemon＠bugs.koha-community.org 04 Dec '11

04 Dec '11

http://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=4051 Chris Cormack <chris(a)bigballofwax.co.nz> changed: What |Removed |Added ---------------------------------------------------------------------------- Version|rel_3_0 |master Patch Status|Needs Signoff |Signed Off QAContact|koha-bugs(a)lists.koha-commun |ian.walls@bywatersolutions. |ity.org |com -- Configure bugmail: http://bugs.koha-community.org/bugzilla3/userprefs.cgi?tab=email ------- You are receiving this mail because: ------- You are the QA Contact for the bug. You are watching all bug changes.

1 0

[Bug 4051] add columns to overdues export
by bugzilla-daemon＠bugs.koha-community.org 04 Dec '11

04 Dec '11

http://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=4051 Chris Cormack <chris(a)bigballofwax.co.nz> changed: What |Removed |Added ---------------------------------------------------------------------------- Attachment #6520|0 |1 is obsolete| | --- Comment #9 from Chris Cormack <chris(a)bigballofwax.co.nz> 2011-12-04 02:23:05 UTC --- Created attachment 6556 --> http://bugs.koha-community.org/bugzilla3/attachment.cgi?id=6556 Bug 4051: adds issuedate column to overdues export Signed-off-by: Chris Cormack <chrisc(a)catalyst.net.nz> -- Configure bugmail: http://bugs.koha-community.org/bugzilla3/userprefs.cgi?tab=email ------- You are receiving this mail because: ------- You are the QA Contact for the bug. You are watching all bug changes.

1 0

[Bug 1623] Retain history of approved comments
by bugzilla-daemon＠bugs.koha-community.org 04 Dec '11

04 Dec '11

http://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=1623 Chris Cormack <chris(a)bigballofwax.co.nz> changed: What |Removed |Added ---------------------------------------------------------------------------- Patch Status|Needs Signoff |Signed Off -- Configure bugmail: http://bugs.koha-community.org/bugzilla3/userprefs.cgi?tab=email ------- You are receiving this mail because: ------- You are watching all bug changes.

1 0

[Bug 1623] Retain history of approved comments
by bugzilla-daemon＠bugs.koha-community.org 04 Dec '11

04 Dec '11

http://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=1623 Chris Cormack <chris(a)bigballofwax.co.nz> changed: What |Removed |Added ---------------------------------------------------------------------------- Attachment #6447|0 |1 is obsolete| | --- Comment #2 from Chris Cormack <chris(a)bigballofwax.co.nz> 2011-12-04 02:01:46 UTC --- Created attachment 6555 --> http://bugs.koha-community.org/bugzilla3/attachment.cgi?id=6555 Bug 1623 - Provide view of approved comments This patch creates two tabs on the comments administration page: one for approved comments and one for unapproved comments. Each display is paginated according to the numSearchResults preference. The list of approved comments has, instead of a link to approve, a link to unapprove. The JavaScript table sorter has been removed since it doesn't make sense to sort individual pages of a multi-page result set. Signed-off-by: Chris Cormack <chrisc(a)catalyst.net.nz> -- Configure bugmail: http://bugs.koha-community.org/bugzilla3/userprefs.cgi?tab=email ------- You are receiving this mail because: ------- You are watching all bug changes.

1 0

[Bug 1623] Retain history of approved comments
by bugzilla-daemon＠bugs.koha-community.org 04 Dec '11

04 Dec '11

http://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=1623 Chris Cormack <chris(a)bigballofwax.co.nz> changed: What |Removed |Added ---------------------------------------------------------------------------- CC| |chris(a)bigballofwax.co.nz QAContact|koha-bugs(a)lists.koha-commun |ian.walls@bywatersolutions. |ity.org |com -- Configure bugmail: http://bugs.koha-community.org/bugzilla3/userprefs.cgi?tab=email ------- You are receiving this mail because: ------- You are the QA Contact for the bug. You are watching all bug changes.

1 0