June 2015 - Koha-bugs - lists.koha-community.org

[Bug 14408] Path traversal vulnerabilty
by bugzilla-daemon＠bugs.koha-community.org 23 Jun '15

23 Jun '15

http://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=14408 Fridolin SOMERS <fridolin.somers(a)biblibre.com> changed: What |Removed |Added ---------------------------------------------------------------------------- Blocks| |14439 -- You are receiving this mail because: You are watching all bug changes. You are the assignee for the bug.

1 0

[Bug 14423] Multiple XSS and XSRF issues in Staff Client
by bugzilla-daemon＠bugs.koha-community.org 23 Jun '15

23 Jun '15

http://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=14423 Tomás Cohen Arazi <tomascohen(a)gmail.com> changed: What |Removed |Added ---------------------------------------------------------------------------- Status|Passed QA |Pushed to Master --- Comment #27 from Tomás Cohen Arazi <tomascohen(a)gmail.com> --- Patches pushed to master. Thanks Chris! -- You are receiving this mail because: You are the assignee for the bug. You are watching all bug changes.

1 0

[Bug 14426] SQL Injection in Staff Client
by bugzilla-daemon＠bugs.koha-community.org 23 Jun '15

23 Jun '15

http://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=14426 Tomás Cohen Arazi <tomascohen(a)gmail.com> changed: What |Removed |Added ---------------------------------------------------------------------------- Status|Passed QA |Pushed to Master --- Comment #16 from Tomás Cohen Arazi <tomascohen(a)gmail.com> --- Patch pushed to master. Thanks Jonathan! -- You are receiving this mail because: You are watching all bug changes. You are the assignee for the bug.

1 0

[Bug 14408] Path traversal vulnerabilty
by bugzilla-daemon＠bugs.koha-community.org 23 Jun '15

23 Jun '15

http://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=14408 --- Comment #29 from Jonathan Druart <jonathan.druart(a)biblibre.com> --- (In reply to Fridolin SOMERS from comment #25) > There is a problem with some pages calling get_template_and_user with empty > string in template_name : > > acqui/updatesupplier.pl > opac/opac-ratings.pl > tools/quotes/quotes_ajax.pl > tools/quotes/quotes-upload_ajax.pl > > Should we accept empty string or correct those pages to use has_permission() > ? Yes, I think so. Did you open a new bug report? -- You are receiving this mail because: You are watching all bug changes. You are the assignee for the bug.

1 0

[Bug 14423] Multiple XSS and XSRF issues in Staff Client
by bugzilla-daemon＠bugs.koha-community.org 23 Jun '15

23 Jun '15

http://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=14423 --- Comment #26 from Fridolin SOMERS <fridolin.somers(a)biblibre.com> --- Pushed to 3.14.x, will be in 3.14.16 -- You are receiving this mail because: You are the assignee for the bug. You are watching all bug changes.

1 0

[Bug 14426] SQL Injection in Staff Client
by bugzilla-daemon＠bugs.koha-community.org 23 Jun '15

23 Jun '15

http://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=14426 --- Comment #15 from Fridolin SOMERS <fridolin.somers(a)biblibre.com> --- Pushed to 3.14.x, will be in 3.14.16 -- You are receiving this mail because: You are the assignee for the bug. You are watching all bug changes.

1 0

[Bug 14408] Path traversal vulnerabilty
by bugzilla-daemon＠bugs.koha-community.org 23 Jun '15

23 Jun '15

http://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=14408 --- Comment #28 from Fridolin SOMERS <fridolin.somers(a)biblibre.com> --- Pushed to 3.14.x, will be in 3.14.16 -- You are receiving this mail because: You are watching all bug changes. You are the assignee for the bug.

1 0

[Bug 14408] Path traversal vulnerabilty
by bugzilla-daemon＠bugs.koha-community.org 23 Jun '15

23 Jun '15

http://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=14408 --- Comment #27 from Jonathan Druart <jonathan.druart(a)biblibre.com> --- (In reply to Fridolin SOMERS from comment #26) > also, minor error : > dot must be espaced in regexp and I dont understand why there is a "?" at > the end : > ^[$safe_chars]+\.tt$ > > Do I create a new Bug ? Chris, I would say this changes could do the trick: - die "bad template path" unless $in->{'template_name'} =~ m/^[$safe_chars]+.tt?$/ig; #sanitize input + die "bad template path" unless $in->{'template_name'} =~ m/^[$safe_chars]+\.tt$/ig; #sanitize input -- You are receiving this mail because: You are the assignee for the bug. You are watching all bug changes.

1 0

[Bug 14408] Path traversal vulnerabilty
by bugzilla-daemon＠bugs.koha-community.org 23 Jun '15

23 Jun '15

http://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=14408 --- Comment #26 from Fridolin SOMERS <fridolin.somers(a)biblibre.com> --- also, minor error : dot must be espaced in regexp and I dont understand why there is a "?" at the end : ^[$safe_chars]+\.tt$ Do I create a new Bug ? -- You are receiving this mail because: You are watching all bug changes. You are the assignee for the bug.

1 0

[Bug 14408] Path traversal vulnerabilty
by bugzilla-daemon＠bugs.koha-community.org 23 Jun '15

23 Jun '15

http://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=14408 --- Comment #25 from Fridolin SOMERS <fridolin.somers(a)biblibre.com> --- There is a problem with some pages calling get_template_and_user with empty string in template_name : acqui/updatesupplier.pl opac/opac-ratings.pl tools/quotes/quotes_ajax.pl tools/quotes/quotes-upload_ajax.pl Should we accept empty string or correct those pages to use has_permission() ? -- You are receiving this mail because: You are watching all bug changes. You are the assignee for the bug.

1 0