September 2014 - Koha-bugs - lists.koha-community.org

[Bug 13009] New: ImportExportFramework.pm should call system() with an array of params
by bugzilla-daemon＠bugs.koha-community.org 29 Sep '14

29 Sep '14

http://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=13009 Bug ID: 13009 Summary: ImportExportFramework.pm should call system() with an array of params Change sponsored?: --- Product: Koha Version: master Hardware: All OS: All Status: NEW Severity: major Priority: P5 - low Component: Architecture, internals, and plumbing Assignee: gmcharlt(a)gmail.com Reporter: tomascohen(a)gmail.com QA Contact: testopia(a)bugs.koha-community.org It seems we have an attack vector for the shellshock bash vulnerability. I wrote this sample script: #!/usr/bin/perl # file hack.pl use Modern::Perl; use CGI; my $query = new CGI; print $query->header(); system("echo -e 'hola tomas'"); 1; and called it like this: $ curl -H 'User-Agent: () { :;}; /usr/bin/touch /tmp/hacked' http://koha-dev.biblioadmin/cgi-bin/koha/hack.pl It successfuly created the /tmp/hacked file. This means that any call on system() passing the command and parameters on the same string is parsed by the default /bin/sh and then vulnerable to the bug. The bug isn't exploitable if the system() call looks like this (i.e. no /bin/sh use). system("echo","-e","hola tomas"); The only place we have that usage pattern, is on C4::ImportExportFramework: C4/ImportExportFramework.pm:562: system("cd $tempdir && $cmd -r new.ods ./"); C4/ImportExportFramework.pm:585: system("rm -rf $tempdir"); C4/ImportExportFramework.pm:695: system("rm -rf $tempdir"); C4/ImportExportFramework.pm:734: system("$cmd $filename -d $tempdir"); The vulnerability would difficult to exploit: - It needs unpatched bash - It needs bash as the default /bin/sh - It needs an authenticated user with permissions to edit MARC frameworks. I haven't written a PoC of the exploit that includes authorization requirement, because the bug is pretty straightforward. To put it clear, system("rm -rf $tempdir"); makes the Perl interpreter to call /bin/sh, and it then inherits the CGI params, and then bash is exploited. -- You are receiving this mail because: You are watching all bug changes.

1 0

[Bug 10135] New: Adding the ability to define customised basketgroups pdf layouts
by bugzilla-daemon＠bugs.koha-community.org 29 Sep '14

29 Sep '14

http://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=10135 Bug ID: 10135 Summary: Adding the ability to define customised basketgroups pdf layouts Classification: Unclassified Change sponsored?: --- Product: Koha Version: master Hardware: All OS: All Status: NEW Severity: enhancement Priority: P3 Component: Acquisitions Assignee: koha-bugs(a)lists.koha-community.org Reporter: mathieu.saby(a)univ-rennes2.fr We have 2 available layouts for basketgroups : layout2pages and layout3pages. Both are untranslatable, and not very pretty. We defined our own layout in Rennes 2, in french, with the logo of the universiy, etc... To use it, we were forced to make a local development, because there is a safty condition in basketgroup.pl. M. Saby -- You are receiving this mail because: You are the assignee for the bug. You are watching all bug changes.

1 13

[Bug 12673] New: Remove CGI::scrolling_list from C4::Items.pm
by bugzilla-daemon＠bugs.koha-community.org 29 Sep '14

29 Sep '14

http://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=12673 Bug ID: 12673 Summary: Remove CGI::scrolling_list from C4::Items.pm Change sponsored?: --- Product: Koha Version: master Hardware: All OS: All Status: NEW Severity: normal Priority: P5 - low Component: Templates Assignee: oleonard(a)myacpl.org Reporter: bgkriegel(a)gmail.com QA Contact: testopia(a)bugs.koha-community.org One instance in this file -- You are receiving this mail because: You are watching all bug changes.

1 21

[Bug 12937] New: Deleting suggestions should ask for a confirmation
by bugzilla-daemon＠bugs.koha-community.org 29 Sep '14

29 Sep '14

http://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=12937 Bug ID: 12937 Summary: Deleting suggestions should ask for a confirmation Change sponsored?: --- Product: Koha Version: master Hardware: All OS: All Status: NEW Severity: normal Priority: P5 - low Component: Acquisitions Assignee: koha-bugs(a)lists.koha-community.org Reporter: jonathan.druart(a)biblibre.com QA Contact: testopia(a)bugs.koha-community.org On the suggestion management page, the librarian can choose to delete suggestions but no confirmation is needed. This could produce unexpected lost of data. -- You are receiving this mail because: You are the assignee for the bug. You are watching all bug changes.

1 12

[Bug 12754] New: Add XSLT action to MARC modification templates
by bugzilla-daemon＠bugs.koha-community.org 29 Sep '14

29 Sep '14

http://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=12754 Bug ID: 12754 Summary: Add XSLT action to MARC modification templates Change sponsored?: --- Product: Koha Version: master Hardware: All OS: All Status: NEW Severity: enhancement Priority: P5 - low Component: MARC Bibliographic data support Assignee: gmcharlt(a)gmail.com Reporter: m.de.rooy(a)rijksmuseum.nl QA Contact: testopia(a)bugs.koha-community.org -- You are receiving this mail because: You are watching all bug changes.

1 21

[Bug 13004] New: Incorrect display of MARC21 title with subfields n and p in XSLT
by bugzilla-daemon＠bugs.koha-community.org 29 Sep '14

29 Sep '14

http://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=13004 Bug ID: 13004 Summary: Incorrect display of MARC21 title with subfields n and p in XSLT Change sponsored?: --- Product: Koha Version: master Hardware: All OS: All Status: NEW Severity: minor Priority: P5 - low Component: MARC Bibliographic data support Assignee: gmcharlt(a)gmail.com Reporter: m.de.rooy(a)rijksmuseum.nl QA Contact: testopia(a)bugs.koha-community.org I have this title in MARC 245: a Title Gugong bowuyuan cangpin daxi. p Name of part/section of a work Taoci bian. n Number of part/section of a work 1, p Name of part/section of a work Xinshiqi shidai zhi handai = b Remainder of title Compendium of collections in the Palace Museum. p Name of part/section of a work Ceramics. n Number of part/section of a work 1, p Name of part/section of a work From the Neolithic Age to the Han Dynasty / c Statement of responsibility, etc Gugong bowuyuan bian. The various XSLT files for opac and intranet display it like: Gugong bowuyuan cangpin daxi. Compendium of collections in the Palace Museum. Taoci bian. 1, Xinshiqi shidai zhi handai = Ceramics. 1, From the Neolithic Age to the Han Dynasty / Note that the order of the MARC record should have been followed. So in this case first the transliterated Chinese and after that the translated English part. (Note that the MARC detail view in OPAC is correct.) -- You are receiving this mail because: You are watching all bug changes.

1 0

[Bug 13003] New: Prevent accidental form submission when scanning barcodes, in addbiblio.pl
by bugzilla-daemon＠bugs.koha-community.org 29 Sep '14

29 Sep '14

http://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=13003 Bug ID: 13003 Summary: Prevent accidental form submission when scanning barcodes, in addbiblio.pl Change sponsored?: --- Product: Koha Version: master Hardware: All OS: All Status: NEW Severity: minor Priority: P5 - low Component: Cataloging Assignee: gmcharlt(a)gmail.com Reporter: mtj(a)kohaaloha.com QA Contact: testopia(a)bugs.koha-community.org CC: m.de.rooy(a)rijksmuseum.nl Currently in addbiblio.pl, scanning a barcode into any field will accidentally save the record (if the scanner is programmed to add a 'CR' character to the string) the easiest solution seems to be to remove the focus from the page's submit button - perhaps using the blur() JS method? http://www.w3schools.com/jsref/met_submit_blur.asp -- You are receiving this mail because: You are watching all bug changes.

1 0

[Bug 13002] New: checkuniquemember capitalizes search names but not the names in DB
by bugzilla-daemon＠bugs.koha-community.org 29 Sep '14

29 Sep '14

http://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=13002 Bug ID: 13002 Summary: checkuniquemember capitalizes search names but not the names in DB Change sponsored?: --- Product: Koha Version: master Hardware: All OS: All Status: NEW Severity: enhancement Priority: P5 - low Component: Patrons Assignee: koha-bugs(a)lists.koha-community.org Reporter: olli-antti.kivilahti(a)jns.fi QA Contact: testopia(a)bugs.koha-community.org CC: gmcharlt(a)gmail.com, kyle.m.hall(a)gmail.com This causes matching to fail atleast in MariaDB/MySQL because they are case-sensitive. -- You are receiving this mail because: You are the assignee for the bug. You are watching all bug changes.

1 1

[Bug 13000] New: Split additem.pl into three tabs to allow implicit posting of the form with [enter]
by bugzilla-daemon＠bugs.koha-community.org 26 Sep '14

26 Sep '14

http://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=13000 Bug ID: 13000 Summary: Split additem.pl into three tabs to allow implicit posting of the form with [enter] Change sponsored?: --- Product: Koha Version: master Hardware: All OS: All Status: NEW Severity: enhancement Priority: P5 - low Component: Cataloging Assignee: gmcharlt(a)gmail.com Reporter: viktor.sarge(a)regionhalland.se QA Contact: testopia(a)bugs.koha-community.org CC: m.de.rooy(a)rijksmuseum.nl We recently upgraded from 3.14.x to 3.16.3 and the staff feels that the fix in bug 10310 to "prevent submit form pressing enter" is a regression. Previously they were able to submit a new item by just scanning a barcode (where the scanner submits [enter] after the barcode), but with 10310 that is no longer possible and since they prefer using the keyboard it's either a lot of tabbing or getting a hold of the mouse to click submit. The dummy submit button that prevents implicit posting of the form by hitting [enter] is necessary for the current layout of additem.pl. My suggestion is to split additem.pl into three tabs "Add item", "Add & duplicate" and "Add multiple items". That way implicit posting could be allowed and our librarians be happy again when adding new books. -- You are receiving this mail because: You are watching all bug changes.

1 0

[Bug 5598] New: More Granular Cloning Circulation & Fine Rules
by bugzilla-daemon＠bugs.koha-community.org 25 Sep '14

25 Sep '14

http://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=5598 Summary: More Granular Cloning Circulation & Fine Rules Change sponsored?: --- Product: Koha Version: rel_3_2 Platform: All OS/Version: All Status: NEW Severity: enhancement Priority: P5 Component: System Administration AssignedTo: paul.poulain(a)biblibre.com ReportedBy: helen.linda(a)goddard.edu QAContact: koha-bugs(a)lists.koha-community.org CC: gmcharlt(a)gmail.com Estimated Hours: 0.0 Currently Koha only allows cloning of rules at the library/branch level. There should be an ability to clone rules on patron categories. That way, if you have multiple patron categories, but many of them share a rule regarding an item type, you could write the rule for the one patron type, then select "Clone to" and be able to multi-select the other patron categories to which that rule also applies. -- Configure bugmail: http://bugs.koha-community.org/bugzilla3/userprefs.cgi?tab=email ------- You are receiving this mail because: ------- You are the QA contact for the bug.

1 2