August 2024 - Koha-bugs - lists.koha-community.org

[Bug 37210] SQL injection in overdue.pl
by bugzilla-daemon＠bugs.koha-community.org 01 Aug '24

01 Aug '24

1 0

[Bug 37018] SQL injection using q under api/
by bugzilla-daemon＠bugs.koha-community.org 01 Aug '24

01 Aug '24

https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=37018 Katrin Fischer <katrin.fischer(a)bsz-bw.de> changed: What |Removed |Added ---------------------------------------------------------------------------- QA Contact| |testopia(a)bugs.koha-communit | |y.org Product|Koha security |Koha Status|Passed QA |Pushed to stable Text to go in the|24.05.02 |24.11.00,24.05.02 release notes| | Component|Koha |REST API Version|unspecified |Main Group|Koha security | --- Comment #157 from Katrin Fischer <katrin.fischer(a)bsz-bw.de> --- Pushed for 24.11! Well done everyone, thank you! -- You are receiving this mail because: You are watching all bug changes.

1 0

[Bug 37247] On subscriptions operation allowed without authentication
by bugzilla-daemon＠bugs.koha-community.org 01 Aug '24

01 Aug '24

https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=37247 Katrin Fischer <katrin.fischer(a)bsz-bw.de> changed: What |Removed |Added ---------------------------------------------------------------------------- Text to go in the|24.05.02 |24.11.00,24.05.02 release notes| | Status|Passed QA |Pushed to stable Product|Koha security |Koha Component|Koha |Serials Version|unspecified |Main Assignee|chris(a)bigballofwax.co.nz |koha-bugs(a)lists.koha-commun | |ity.org Group|Koha security | --- Comment #27 from Katrin Fischer <katrin.fischer(a)bsz-bw.de> --- Pushed for 24.11! Well done everyone, thank you! -- You are receiving this mail because: You are the assignee for the bug. You are watching all bug changes.

1 0

[Bug 37146] plugin_launcher.pl allows running of any Perl file on file system
by bugzilla-daemon＠bugs.koha-community.org 01 Aug '24

01 Aug '24

1 0

[Bug 36863] CSRF Plack middleware doesn't handle the CONNECT HTTP method
by bugzilla-daemon＠bugs.koha-community.org 01 Aug '24

01 Aug '24

1 0

[Bug 37074] Comment approval and un-approval should be CSRF-protected
by bugzilla-daemon＠bugs.koha-community.org 01 Aug '24

01 Aug '24

1 0

[Bug 14322] Can't link to an item search
by bugzilla-daemon＠bugs.koha-community.org 01 Aug '24

01 Aug '24

https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=14322 --- Comment #24 from Brendan Lawlor <blawlor(a)clamsnet.org> --- (In reply to David Nind from comment #18) > It looked like everything was all working as expected, however I came across > a situation using the + New field: > - Home library is: Centerville > - Barcode is 39999% > - AND Title is %perl% > - Search (6 results) > - Copy shareable link > - Paste the link in a new tab > - Get 321 results > - When you edit the search the AND is changed to an OR Thanks, David, for testing and spotting that bug! This was caused because of assuming getting the 'c' param would return an array. When there is only a single 'c' param it's just a string, so I added a check for that too. -- You are receiving this mail because: You are watching all bug changes.

1 0

[Bug 36532] Any authenticated OPAC user can run opac-dismiss-message.pl for any user/any message
by bugzilla-daemon＠bugs.koha-community.org 01 Aug '24

01 Aug '24

https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=36532 --- Comment #15 from Marcel de Rooy <m.de.rooy(a)rijksmuseum.nl> --- (In reply to Fridolin Somers from comment #14) > I've done a message to @fredericdemians in chat Seeing that it was reverted in 22.11.x -- You are receiving this mail because: You are watching all bug changes.

1 0

[Bug 14322] Can't link to an item search
by bugzilla-daemon＠bugs.koha-community.org 01 Aug '24

01 Aug '24

https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=14322 --- Comment #23 from Brendan Lawlor <blawlor(a)clamsnet.org> --- Created attachment 169952 --> https://bugs.koha-community.org/bugzilla3/attachment.cgi?id=169952&action=e… Bug 14322: (follow-up) Perl tidy -- You are receiving this mail because: You are watching all bug changes.

1 0

[Bug 14322] Can't link to an item search
by bugzilla-daemon＠bugs.koha-community.org 01 Aug '24

01 Aug '24

https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=14322 --- Comment #22 from Brendan Lawlor <blawlor(a)clamsnet.org> --- Created attachment 169951 --> https://bugs.koha-community.org/bugzilla3/attachment.cgi?id=169951&action=e… Bug 14322: (follow-up) add check for single logical operator param -- You are receiving this mail because: You are watching all bug changes.

1 0