October 2012 - Koha-bugs - lists.koha-community.org

[Bug 3652] XSS vulnerabilities
by bugzilla-daemon＠bugs.koha-community.org 09 Oct '12

09 Oct '12

http://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=3652 Katrin Fischer <katrin.fischer(a)bsz-bw.de> changed: What |Removed |Added ---------------------------------------------------------------------------- Attachment #12737|0 |1 is obsolete| | Attachment #12738|0 |1 is obsolete| | --- Comment #23 from Katrin Fischer <katrin.fischer(a)bsz-bw.de> --- Created attachment 12740 --> http://bugs.koha-community.org/bugzilla3/attachment.cgi?id=12740&action=edit [SIGNED-OFF] Bug 3652: XSS vulnerability in page numbering Signed-off-by: Katrin Fischer <Katrin.Fischer.83(a)web.de> Confirmed the problem with test plan on the bug and checked that paging works correctly after the patch. -- You are receiving this mail because: You are watching all bug changes.

1 0

[Bug 3652] XSS vulnerabilities
by bugzilla-daemon＠bugs.koha-community.org 09 Oct '12

09 Oct '12

http://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=3652 --- Comment #22 from Chris Cormack <chris(a)bigballofwax.co.nz> --- Created attachment 12738 --> http://bugs.koha-community.org/bugzilla3/attachment.cgi?id=12738&action=edit Bug 3652 XSS vulnerability in facets -- You are receiving this mail because: You are watching all bug changes.

1 0

[Bug 3652] XSS vulnerabilities
by bugzilla-daemon＠bugs.koha-community.org 09 Oct '12

09 Oct '12

http://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=3652 --- Comment #21 from Chris Cormack <chris(a)bigballofwax.co.nz> --- Created attachment 12737 --> http://bugs.koha-community.org/bugzilla3/attachment.cgi?id=12737&action=edit Bug 3652: XSS vulnerability in page numbering -- You are receiving this mail because: You are watching all bug changes.

1 0

[Bug 3652] XSS vulnerabilities
by bugzilla-daemon＠bugs.koha-community.org 09 Oct '12

09 Oct '12

http://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=3652 Chris Cormack <chris(a)bigballofwax.co.nz> changed: What |Removed |Added ---------------------------------------------------------------------------- Status|Signed Off |Needs Signoff --- Comment #20 from Chris Cormack <chris(a)bigballofwax.co.nz> --- If you have a search that returns more than one page of results it is possible to craft an xss exploit. With page numbers turned on try /cgi-bin/koha/opac-search.pl?q=1&do=Search&limit-yr=1&limit=1&idx=kw&sort_by=relevance"></a><b>This%20shouldn't%20happen</b> Then try it again with the patch applied. Another patch to follow to fix facets -- You are receiving this mail because: You are watching all bug changes.

1 0

[Bug 7230] New: clicking plus when adding qty on acq buggy
by bugzilla-daemon＠bugs.koha-community.org 08 Oct '12

08 Oct '12

http://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=7230 Bug #: 7230 Summary: clicking plus when adding qty on acq buggy Classification: Unclassified Change sponsored?: --- Product: Koha Version: master Platform: All OS/Version: All Status: NEW Severity: critical Priority: P5 - low Component: Acquisitions AssignedTo: henridamien(a)koha-fr.org ReportedBy: nengard(a)gmail.com QAContact: ian.walls(a)bywatersolutions.com When ordering, if you click the plus to add an item and then scroll down and click the new plus (right above accounting details) the qty is not updated. if you click the original plus the one under the first time then the qty is updated. This is not consistently happening. It happened 4 times for me today and then I tried to do a video and it worked. I'm in a room of librarians and it worked for 1/2 the room and not for the other half. -- Configure bugmail: http://bugs.koha-community.org/bugzilla3/userprefs.cgi?tab=email ------- You are receiving this mail because: ------- You are watching all bug changes.

1 4

[Bug 8239] New: Z39.50 Search/Import doesn't work with unicode characters from a specific server
by bugzilla-daemon＠bugs.koha-community.org 08 Oct '12

08 Oct '12

http://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=8239 Priority: P5 - low Change sponsored?: --- Bug ID: 8239 Assignee: gmcharlt(a)gmail.com Summary: Z39.50 Search/Import doesn't work with unicode characters from a specific server Severity: normal Classification: Unclassified OS: All Reporter: derrynj(a)gmail.com Hardware: All Status: NEW Version: rel_3_8 Component: Cataloging Product: Koha Created attachment 10242 --> http://bugs.koha-community.org/bugzilla3/attachment.cgi?id=10242&action=edit Screenshots depicting both functioning and non-functioning unicode searches I have in my list of Z39.50 servers, a couple of servers which return the unprintable code {FFFD} when it is supposed to put a ÿ character. Other servers with the same search work fine. Trying the same search in MarcEdit's Z39.50 client, it comes out with the correct character. The servers in question are (and these are exactly the settings I have in my Koha installation): Australian National University host: library.anu.edu.au port: 210 databse: innopac syntax: USMARC encoding: MARC-8 and University of Melbourne host: cat.lib.unimelb.edu.au port: 210 databse: innopac syntax: USMARC encoding: MARC-8 Steps to reproduceː With the above servers added to Z39.50 Client Targets list: 1) Search for 'Francis Alys' in Title 2) Look down the list for title 'Francis Alÿs' by Author 'Medina, Cuauhtm̌oc' 3) See that there is a � character where there should be a ÿ Actual resultː Result from Australia National Uni - Koha: Francis Al�s / Medina, Cuauht�moc Expected Resultː Francis Alÿs / Medina, Cuauhtm̌oc Result from Aust National Uni - MarcEdit: Francis Alÿs / Medina, Cuauhtm̌oc Additional information: Attached are screenshots of 2 cases where the characters don't show properly (University of Melbourne and Australian National University), a shot of the same search with La Trobe University, which appears correctly, and a shot of the Australian National University search done (successfully) on MarcEdit's Z39.50 Client. Here is a link to the catalogued item on Australian National Uni's own library system: http://library.anu.edu.au/record=b2298563 -- You are receiving this mail because: You are watching all bug changes.

1 4

[Bug 8889] New: Optionally compose Unicode characters when saving MARC record
by bugzilla-daemon＠bugs.koha-community.org 08 Oct '12

08 Oct '12

http://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=8889 Priority: P5 - low Change sponsored?: --- Bug ID: 8889 CC: frederic(a)tamil.fr Assignee: m.de.rooy(a)rijksmuseum.nl Summary: Optionally compose Unicode characters when saving MARC record Severity: enhancement Classification: Unclassified OS: All Reporter: m.de.rooy(a)rijksmuseum.nl Hardware: All Status: ASSIGNED Version: master Component: I18N/L10N Product: Koha Conversion from MARC8 to UTF8 (in e.g. Z3950 search) converts a lot of accented characters to the Unicode decomposed form of [letter without accent][accent only] in Unicode. Most characters originating from the Latin1 character set are not displayed properly in various browsers (in that decomposed form). When we convert to the composed form, these characters are mapped to one unicode character with accent. Presentation improves in various browsers. This patch adds a syspref making this optional behavior. It makes the needed changes in ModBiblioMarc. -- You are receiving this mail because: You are watching all bug changes.

1 6

[Bug 3652] XSS vulnerabilities
by bugzilla-daemon＠bugs.koha-community.org 08 Oct '12

08 Oct '12

http://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=3652 Magnus Enger <magnus(a)enger.priv.no> changed: What |Removed |Added ---------------------------------------------------------------------------- Status|Needs Signoff |Signed Off CC| |magnus(a)enger.priv.no -- You are receiving this mail because: You are watching all bug changes.

1 0

[Bug 3652] XSS vulnerabilities
by bugzilla-daemon＠bugs.koha-community.org 08 Oct '12

08 Oct '12

http://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=3652 Magnus Enger <magnus(a)enger.priv.no> changed: What |Removed |Added ---------------------------------------------------------------------------- Attachment #12729|0 |1 is obsolete| | --- Comment #19 from Magnus Enger <magnus(a)enger.priv.no> --- Created attachment 12730 --> http://bugs.koha-community.org/bugzilla3/attachment.cgi?id=12730&action=edit Bug 3652 : [SIGNED-OFF] [SECURITY] XSS vulnerability Signed-off-by: Magnus Enger <magnus(a)enger.priv.no> Works as advertised. After applying the patch, <blink>fish</blink> is displayed on the page, but no blinking occurs. -- You are receiving this mail because: You are watching all bug changes.

1 0

[Bug 3652] XSS vulnerabilities
by bugzilla-daemon＠bugs.koha-community.org 08 Oct '12

08 Oct '12

http://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=3652 Magnus Enger <magnus(a)enger.priv.no> changed: What |Removed |Added ---------------------------------------------------------------------------- Attachment #12728|0 |1 is obsolete| | --- Comment #18 from Magnus Enger <magnus(a)enger.priv.no> --- Created attachment 12729 --> http://bugs.koha-community.org/bugzilla3/attachment.cgi?id=12729&action=edit Bug 3652 : [SECURITY] XSS vulnerability Signed-off-by: Magnus Enger <magnus(a)enger.priv.no> Works as advertised. After applying the patch, <blink>fish</blink> is displayed on the page, but no blinking occurs. -- You are receiving this mail because: You are watching all bug changes.

1 0