June 2015 - Koha-bugs - lists.koha-community.org

[Bug 14441] New: TrackClicks cuts off/breaks URLs
by bugzilla-daemon＠bugs.koha-community.org 23 Jun '15

23 Jun '15

http://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=14441 Bug ID: 14441 Summary: TrackClicks cuts off/breaks URLs Change sponsored?: --- Product: Koha Version: master Hardware: All OS: All Status: NEW Severity: normal Priority: P5 - low Component: OPAC Assignee: oleonard(a)myacpl.org Reporter: katrin.fischer(a)bsz-bw.de QA Contact: testopia(a)bugs.koha-community.org I did a quick test with the TrackClicks preference and it appears to break URLs with multiple parameters? The second URL parameter is cut of for the links I looked at: Without TrackClicks: http://<domain_external>?identifier=1003033849-9-1373538128402-3&field=ALLEGROID With TrackClicks set to track anonymously: URL visible in the OPAC: https://<domain_opac>/cgi-bin/koha/tracklinks.pl?uri= http://<domain_external>?identifier=1003033849-9-1373538128402-3&field=ALLEGROID;biblionumber=2647 URL it tries to access: http://<domain_external>?identifier=1003033849-9-1373538128402-3 ... will result in an error message in this case as an important bit is missing. -- You are receiving this mail because: You are watching all bug changes.

1 0

[Bug 14408] Path traversal vulnerabilty
by bugzilla-daemon＠bugs.koha-community.org 23 Jun '15

23 Jun '15

http://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=14408 --- Comment #32 from Fridolin SOMERS <fridolin.somers(a)biblibre.com> --- I've created Bug 14439 and Bug 14440 -- You are receiving this mail because: You are watching all bug changes. You are the assignee for the bug.

1 0

[Bug 14408] Path traversal vulnerabilty
by bugzilla-daemon＠bugs.koha-community.org 23 Jun '15

23 Jun '15

http://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=14408 Fridolin SOMERS <fridolin.somers(a)biblibre.com> changed: What |Removed |Added ---------------------------------------------------------------------------- Blocks| |14440 -- You are receiving this mail because: You are the assignee for the bug. You are watching all bug changes.

1 0

[Bug 14423] Multiple XSS and XSRF issues in Staff Client
by bugzilla-daemon＠bugs.koha-community.org 23 Jun '15

23 Jun '15

http://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=14423 --- Comment #28 from Mason James <mtj(a)kohaaloha.com> --- Pushed to 3.16.x, will be in 3.16.12 -- You are receiving this mail because: You are watching all bug changes. You are the assignee for the bug.

1 0

[Bug 14426] SQL Injection in Staff Client
by bugzilla-daemon＠bugs.koha-community.org 23 Jun '15

23 Jun '15

http://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=14426 --- Comment #17 from Mason James <mtj(a)kohaaloha.com> --- Pushed to 3.16.x, will be in 3.16.12 -- You are receiving this mail because: You are the assignee for the bug. You are watching all bug changes.

1 0

[Bug 14412] SQL Injection in OPAC Interface
by bugzilla-daemon＠bugs.koha-community.org 23 Jun '15

23 Jun '15

http://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=14412 --- Comment #10 from Mason James <mtj(a)kohaaloha.com> --- Pushed to 3.16.x, will be in 3.16.12 -- You are receiving this mail because: You are watching all bug changes.

1 0

[Bug 14408] Path traversal vulnerabilty
by bugzilla-daemon＠bugs.koha-community.org 23 Jun '15

23 Jun '15

http://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=14408 --- Comment #31 from Mason James <mtj(a)kohaaloha.com> --- Pushed to 3.16.x, will be in 3.16.12 -- You are receiving this mail because: You are the assignee for the bug. You are watching all bug changes.

1 0

[Bug 14416] Stored XSS flaw affects OPAC and Staff interface
by bugzilla-daemon＠bugs.koha-community.org 23 Jun '15

23 Jun '15

http://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=14416 --- Comment #18 from Mason James <mtj(a)kohaaloha.com> --- Pushed to 3.16.x, will be in 3.16.12 -- You are receiving this mail because: You are watching all bug changes.

1 0

[Bug 14408] Path traversal vulnerabilty
by bugzilla-daemon＠bugs.koha-community.org 23 Jun '15

23 Jun '15

http://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=14408 Jacek Ablewicz <abl(a)biblos.pk.edu.pl> changed: What |Removed |Added ---------------------------------------------------------------------------- CC| |abl(a)biblos.pk.edu.pl -- You are receiving this mail because: You are watching all bug changes.

1 0

[Bug 14408] Path traversal vulnerabilty
by bugzilla-daemon＠bugs.koha-community.org 23 Jun '15

23 Jun '15

http://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=14408 --- Comment #30 from Jacek Ablewicz <abl(a)biblos.pk.edu.pl> --- (In reply to Liz Rea from comment #24) > Pushed to 3.18.x will be in 3.18.08 Correction from the last patch in this set (Bug 14408: Allow integers in template paths) seems to be missing in 3.18.8 / 3.18.x branch (not 100% sure if it is or isn't an issue in 3.18, but it may be so, as there are plenty of *.tt files in 3.18.x with numbers in their names: addorderiso2709.tt, z3950_*.tt, marc21_field_*.tt and so on). -- You are receiving this mail because: You are the assignee for the bug. You are watching all bug changes.

1 0