August 2018 - Koha-bugs - lists.koha-community.org

[Bug 13618] Prevent XSS in the Staff Client and the OPAC
by bugzilla-daemon＠bugs.koha-community.org 14 Aug '18

14 Aug '18

https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=13618 Jonathan Druart <jonathan.druart(a)bugs.koha-community.org> changed: What |Removed |Added ---------------------------------------------------------------------------- Status|Needs Signoff |Signed Off -- You are receiving this mail because: You are watching all bug changes.

1 0

[Bug 13618] Prevent XSS in the Staff Client and the OPAC
by bugzilla-daemon＠bugs.koha-community.org 14 Aug '18

14 Aug '18

https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=13618 --- Comment #234 from Jonathan Druart <jonathan.druart(a)bugs.koha-community.org> --- Created attachment 77808 --> https://bugs.koha-community.org/bugzilla3/attachment.cgi?id=77808&action=ed… Bug 13618: [DO NOT PUSH] Add script to add the html filters Usage: perl add_html_filters.pl **/*.inc **/*.tt It also takes --test for debugging Then: git grep Asset|grep -v USE | grep -v '| $raw' => We should deal with them on a separate commit Signed-off-by: Owen Leonard <oleonard(a)myacpl.org> Signed-off-by: Martin Renvoize <martin.renvoize(a)ptfs-europe.com> -- You are receiving this mail because: You are watching all bug changes.

1 0

[Bug 13618] Prevent XSS in the Staff Client and the OPAC
by bugzilla-daemon＠bugs.koha-community.org 14 Aug '18

14 Aug '18

https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=13618 Jonathan Druart <jonathan.druart(a)bugs.koha-community.org> changed: What |Removed |Added ---------------------------------------------------------------------------- Attachment #77806|0 |1 is obsolete| | --- Comment #233 from Jonathan Druart <jonathan.druart(a)bugs.koha-community.org> --- Created attachment 77807 --> https://bugs.koha-community.org/bugzilla3/attachment.cgi?id=77807&action=ed… Bug 13618: [DO NOT PUSH] have fun In order to generate quickly a lot of relevant data I have modified a bit TestBuilder->_gen_text to insert <script> tags in DB. The transaction have been removed from t/db_dependent/Koha/Patrons.t To use it, use a clean data (sample data only) the run t/db_dependent/Koha/Patrons.t (only once, it will fail it you run it more) Search for patrons, without this patch you will get a looot of alert boxes. Signed-off-by: Owen Leonard <oleonard(a)myacpl.org> Signed-off-by: Martin Renvoize <martin.renvoize(a)ptfs-europe.com> -- You are receiving this mail because: You are watching all bug changes.

1 0

[Bug 13618] Prevent XSS in the Staff Client and the OPAC
by bugzilla-daemon＠bugs.koha-community.org 14 Aug '18

14 Aug '18

https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=13618 --- Comment #232 from Martin Renvoize <martin.renvoize(a)ptfs-europe.com> --- I was going to upload the patches for you Nick, but it turns out some of them are too large for bugzilla so Jonathan is adding my signoff lines to his tracking branch on gitlab ;) Note, bug 15717 is rolled into this branch patchset.. it all checks out too ;) -- You are receiving this mail because: You are watching all bug changes.

1 0

[Bug 13618] Prevent XSS in the Staff Client and the OPAC
by bugzilla-daemon＠bugs.koha-community.org 14 Aug '18

14 Aug '18

https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=13618 Jonathan Druart <jonathan.druart(a)bugs.koha-community.org> changed: What |Removed |Added ---------------------------------------------------------------------------- Attachment #77805|0 |1 is obsolete| | --- Comment #231 from Jonathan Druart <jonathan.druart(a)bugs.koha-community.org> --- Created attachment 77806 --> https://bugs.koha-community.org/bugzilla3/attachment.cgi?id=77806&action=ed… Bug 13618: [DO NOT PUSH] have fun In order to generate quickly a lot of relevant data I have modified a bit TestBuilder->_gen_text to insert <script> tags in DB. The transaction have been removed from t/db_dependent/Koha/Patrons.t To use it, use a clean data (sample data only) the run t/db_dependent/Koha/Patrons.t (only once, it will fail it you run it more) Search for patrons, without this patch you will get a looot of alert boxes. Signed-off-by: Owen Leonard <oleonard(a)myacpl.org> Signed-off-by: Martin Renvoize <martin.renvoize(a)ptfs-europe.com> -- You are receiving this mail because: You are watching all bug changes.

1 0

[Bug 13618] Prevent XSS in the Staff Client and the OPAC
by bugzilla-daemon＠bugs.koha-community.org 14 Aug '18

14 Aug '18

https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=13618 Jonathan Druart <jonathan.druart(a)bugs.koha-community.org> changed: What |Removed |Added ---------------------------------------------------------------------------- Status|Passed QA |Needs Signoff -- You are receiving this mail because: You are watching all bug changes.

1 0

[Bug 13618] Prevent XSS in the Staff Client and the OPAC
by bugzilla-daemon＠bugs.koha-community.org 14 Aug '18

14 Aug '18

https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=13618 Martin Renvoize <martin.renvoize(a)ptfs-europe.com> changed: What |Removed |Added ---------------------------------------------------------------------------- Attachment #77804|0 |1 is obsolete| | --- Comment #230 from Martin Renvoize <martin.renvoize(a)ptfs-europe.com> --- Created attachment 77805 --> https://bugs.koha-community.org/bugzilla3/attachment.cgi?id=77805&action=ed… Bug 13618: [DO NOT PUSH] have fun In order to generate quickly a lot of relevant data I have modified a bit TestBuilder->_gen_text to insert <script> tags in DB. The transaction have been removed from t/db_dependent/Koha/Patrons.t To use it, use a clean data (sample data only) the run t/db_dependent/Koha/Patrons.t (only once, it will fail it you run it more) Search for patrons, without this patch you will get a looot of alert boxes. Signed-off-by: Owen Leonard <oleonard(a)myacpl.org> Signed-off-by: Martin Renvoize <martin.renvoize(a)ptfs-europe.com> -- You are receiving this mail because: You are watching all bug changes.

1 0

[Bug 13618] Prevent XSS in the Staff Client and the OPAC
by bugzilla-daemon＠bugs.koha-community.org 14 Aug '18

14 Aug '18

https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=13618 --- Comment #229 from Martin Renvoize <martin.renvoize(a)ptfs-europe.com> --- Created attachment 77804 --> https://bugs.koha-community.org/bugzilla3/attachment.cgi?id=77804&action=ed… Bug 13618: [DO NOT PUSH] have fun In order to generate quickly a lot of relevant data I have modified a bit TestBuilder->_gen_text to insert <script> tags in DB. The transaction have been removed from t/db_dependent/Koha/Patrons.t To use it, use a clean data (sample data only) the run t/db_dependent/Koha/Patrons.t (only once, it will fail it you run it more) Search for patrons, without this patch you will get a looot of alert boxes. Signed-off-by: Owen Leonard <oleonard(a)myacpl.org> Signed-off-by: Martin Renvoize <martin.renvoize(a)ptfs-europe.com> -- You are receiving this mail because: You are watching all bug changes.

1 0

[Bug 13618] Prevent XSS in the Staff Client and the OPAC
by bugzilla-daemon＠bugs.koha-community.org 14 Aug '18

14 Aug '18

https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=13618 Martin Renvoize <martin.renvoize(a)ptfs-europe.com> changed: What |Removed |Added ---------------------------------------------------------------------------- Status|Signed Off |Passed QA --- Comment #228 from Martin Renvoize <martin.renvoize(a)ptfs-europe.com> --- I've spent a few hours with this one this evening... The QA script raises a few warnings, but I think they're false positives or pre-existing issues in all cases at this point. I'm sure there will be issues with a patchset of this magnitude, but I am confident we will correct them before release and that they would not be caught at this point by delaying any further. ********** Passing QA ********** -- You are receiving this mail because: You are watching all bug changes.

1 0

[Bug 16189] New: Add an exception to SMS via email documentation in the Koha manual
by bugzilla-daemon＠bugs.koha-community.org 14 Aug '18

14 Aug '18

https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=16189 Bug ID: 16189 Summary: Add an exception to SMS via email documentation in the Koha manual Change sponsored?: --- Product: Koha Version: master Hardware: All URL: https://lists.katipo.co.nz/pipermail/koha/2016-April/0 45114.html OS: All Status: NEW Severity: minor Priority: P5 - low Component: Documentation Assignee: nengard(a)gmail.com Reporter: indradg(a)gmail.com QA Contact: testopia(a)bugs.koha-community.org Add an "exception note" that basically says "this may not work for all providers. Especially, users in India should aware of any liability - both civil and criminal, for sending unauthorised bulk SMS using this feature." -- You are receiving this mail because: You are watching all bug changes.

1 4