August 2024 - Koha-bugs - lists.koha-community.org

[Bug 37466] Reflected Cross Site Scripting
by bugzilla-daemon＠bugs.koha-community.org 22 Aug '24

22 Aug '24

1 0

[Bug 37464] Remote Code Execution in barcode function leads to reverse shell
by bugzilla-daemon＠bugs.koha-community.org 22 Aug '24

22 Aug '24

https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=37464 Katrin Fischer <katrin.fischer(a)bsz-bw.de> changed: What |Removed |Added ---------------------------------------------------------------------------- Product|Koha security |Koha Version|unspecified |Main Group|Koha security | Component|Koha |Architecture, internals, | |and plumbing --- Comment #16 from Katrin Fischer <katrin.fischer(a)bsz-bw.de> --- (In reply to Chris Cormack from comment #6) > https://github.com/mbeijen/GD-Barcode if we want to It was reported to the author of the GD::Barcode: https://github.com/mbeijen/GD-Barcode/issues/7 -- You are receiving this mail because: You are watching all bug changes.

1 0

[Bug 37370] opac-export.pl can be used even if exporting disabled
by bugzilla-daemon＠bugs.koha-community.org 22 Aug '24

22 Aug '24

1 0

[Bug 37323] Remote-Code-Execution (RCE) in picture-upload.pl
by bugzilla-daemon＠bugs.koha-community.org 22 Aug '24

22 Aug '24

https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=37323 Katrin Fischer <katrin.fischer(a)bsz-bw.de> changed: What |Removed |Added ---------------------------------------------------------------------------- Status|Pushed to oldstable |RESOLVED Resolution|--- |FIXED -- You are receiving this mail because: You are watching all bug changes.

1 0

[Bug 37323] Remote-Code-Execution (RCE) in picture-upload.pl
by bugzilla-daemon＠bugs.koha-community.org 22 Aug '24

22 Aug '24

https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=37323 Katrin Fischer <katrin.fischer(a)bsz-bw.de> changed: What |Removed |Added ---------------------------------------------------------------------------- Status|Pushed to stable |Pushed to oldstable -- You are receiving this mail because: You are watching all bug changes.

1 0

[Bug 37323] Remote-Code-Execution (RCE) in picture-upload.pl
by bugzilla-daemon＠bugs.koha-community.org 22 Aug '24

22 Aug '24

https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=37323 Katrin Fischer <katrin.fischer(a)bsz-bw.de> changed: What |Removed |Added ---------------------------------------------------------------------------- Status|Pushed to main |Pushed to stable -- You are receiving this mail because: You are watching all bug changes.

1 0

[Bug 37323] Remote-Code-Execution (RCE) in picture-upload.pl
by bugzilla-daemon＠bugs.koha-community.org 22 Aug '24

22 Aug '24

https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=37323 Katrin Fischer <katrin.fischer(a)bsz-bw.de> changed: What |Removed |Added ---------------------------------------------------------------------------- Version|unspecified |Main Product|Koha security |Koha Group|Koha security | CC| |gmcharlt(a)gmail.com, | |kyle.m.hall(a)gmail.com Component|Koha |Patrons QA Contact| |testopia(a)bugs.koha-communit | |y.org --- Comment #36 from Katrin Fischer <katrin.fischer(a)bsz-bw.de> --- I've filed this as a follow-up bug: Bug 37712 - Switch picture-upload.pl to use Koha::Uploader -- You are receiving this mail because: You are watching all bug changes.

1 0

[Bug 37712] New: Switch picture-upload.pl to use Koha::Uploader
by bugzilla-daemon＠bugs.koha-community.org 22 Aug '24

22 Aug '24

https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=37712 Bug ID: 37712 Summary: Switch picture-upload.pl to use Koha::Uploader Change sponsored?: --- Product: Koha Version: Main Hardware: All OS: All Status: NEW Severity: enhancement Priority: P5 - low Component: Architecture, internals, and plumbing Assignee: koha-bugs(a)lists.koha-community.org Reporter: katrin.fischer(a)bsz-bw.de QA Contact: testopia(a)bugs.koha-community.org This came up in discusson on bug 37323. -- You are receiving this mail because: You are watching all bug changes. You are the assignee for the bug.

1 0

[Bug 37706] New: Date filter not used in circulation report
by bugzilla-daemon＠bugs.koha-community.org 22 Aug '24

22 Aug '24

https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=37706 Bug ID: 37706 Summary: Date filter not used in circulation report Change sponsored?: --- Product: Koha Version: 23.11 Hardware: All OS: All Status: NEW Severity: enhancement Priority: P5 - low Component: Reports Assignee: koha-bugs(a)lists.koha-community.org Reporter: andreas.jonsson(a)kreablo.se QA Contact: testopia(a)bugs.koha-community.org I noticed that the cirulation report was putting a significant load on the system so I added some debug logging to reports/issues_stats.pl to see what was going on: use Data::Dumper; warn Dumper([$line, $column, $podsp, $type, $daysel, $monthsel, $calc, \@filters, $attribute_filters]); my $results = calculate( $line, $column, $podsp, $type, $daysel, $monthsel, $calc, \@filters, $attribute_filters); and: warn "strsth: $strsth"; my $sth = $dbh->prepare($strsth); and: warn "strsth2: $strsth2"; my $sth2 = $dbh->prepare($strsth2); As you can see a filter was selected for the date period: 2024/08/22 08:02:52] [WARN] $VAR1 = [ 'branch', 'itemtype', '', 'issue', '', '', '1', [ '2024-08-21', '2024-08-21', ... We get a warnings because the date validation tries to numerically compare the date strings (which will cause the validation to always succeed even when selecting a start date greater than the end date): [2024/08/22 08:02:52] [WARN] Argument "2024-08-21" isn't numeric in numeric lt (<) at /usr/share/koha/intranet/cgi-bin/reports/issues_stats.pl line 216. [2024/08/22 08:02:52] [WARN] Argument "2024-08-21" isn't numeric in numeric lt (<) at /usr/share/koha/intranet/cgi-bin/reports/issues_stats.pl line 216. But neither sql queries refer to the selected date period: [2024/08/22 08:02:52] [WARN] strsth: SELECT distinctrow branch FROM statistics LEFT JOIN borrowers ON (statistics.borrowernumber = borrowers.borrowernumber) WHERE branch IS NOT NULL AND branch != '' AND branch LIKE ? group by branch order by branch at /usr/share/koha/intranet/cgi-bin/reports/issues_stats.pl line 327. [2024/08/22 08:03:28] [WARN] strsth2: SELECT distinctrow itemtype FROM statistics LEFT JOIN borrowers ON (statistics.borrowernumber = borrowers.borrowernumber) WHERE itemtype IS NOT NULL AND itemtype != '' group by itemtype order by itemtype at /usr/share/koha/intranet/cgi-bin/reports/issues_stats.pl line 418. So, the date filter is not actually used (other than for claiming that it was used in the generated report). -- You are receiving this mail because: You are watching all bug changes. You are the assignee for the bug.

1 1

[Bug 37704] New: Custom authorized values do not appear in a selector in Advanced Editor
by bugzilla-daemon＠bugs.koha-community.org 22 Aug '24

22 Aug '24

https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=37704 Bug ID: 37704 Summary: Custom authorized values do not appear in a selector in Advanced Editor Change sponsored?: --- Product: Koha Version: unspecified Hardware: All OS: All Status: NEW Severity: enhancement Priority: P5 - low Component: Cataloging Assignee: koha-bugs(a)lists.koha-community.org Reporter: esther.melander(a)bywatersolutions.com QA Contact: testopia(a)bugs.koha-community.org CC: m.de.rooy(a)rijksmuseum.nl To see with existing Koha Authorized Values: 1. Edit the Default framework and add the authorized value RELTERMS to tag 100 $e. 2. Open a blank record in the Basic Editor and see the authorized values in the 100 $e. 3. Open a blank record in the Advanced Editor and key in 100 _ _ $e See the authorized values box appear. To replicate with custom authorized values: 1. Create an Authorized Value category called CANDY. Add some values like Reeses, Lollipop, etc. 2. Edit the default framework and modify the authorized value for 100 $e to CANDY. 3. Open a blank record in the Basic Editor. See the CANDY authorized values in 100 $e. 3. Open a blank record in the Advanced Editor and key in 100 _ _ $e The authorized values box does not appear. -- You are receiving this mail because: You are the assignee for the bug. You are watching all bug changes.

1 6