March 2025 - Koha-bugs - lists.koha-community.org

[Bug 38214] New: Audit use of TT url filter for uses that should be uri instead
by bugzilla-daemon＠bugs.koha-community.org 06 Mar '25

06 Mar '25

https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=38214 Bug ID: 38214 Summary: Audit use of TT url filter for uses that should be uri instead Change sponsored?: --- Product: Koha Version: Main Hardware: All OS: All Status: NEW Severity: enhancement Priority: P5 - low Component: Templates Assignee: oleonard(a)myacpl.org Reporter: phil(a)chetcolibrary.org QA Contact: testopia(a)bugs.koha-community.org Shame the two things look so much alike in so many fonts, when you have old eyes. The url filter is for filtering a full URL, when you don't want to escape : or // since starting a URL with http%3A%2F%2F won't work well. The uri filter is for filtering a URL parameter, where you want '/search?query=why%3F' rather than '/search?query=why?' which breaks your URL by having a second '?'. Using url when you should use uri means you are leaving &, @, /, ;, :, =, +, ? and $ unescaped when you shouldn't. In many cases, the wrong use of url is on things like biblionumber, where that doesn't result in any interesting behavior, but in other cases... you can create an authorized value category named This&That=Stuff, and when you try to add a value to it, you will add a value to the category This, and pass the parameter That with the value Stuff to the script. -- You are receiving this mail because: You are watching all bug changes.

1 8

[Bug 38467] Template::Toolkit filters can create risky Javascript when not using RFC3986
by bugzilla-daemon＠bugs.koha-community.org 06 Mar '25

06 Mar '25

https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=38467 Katrin Fischer <katrin.fischer(a)bsz-bw.de> changed: What |Removed |Added ---------------------------------------------------------------------------- Version(s)|25.05.00,25.05.00,24.11.02, |25.05.00,24.11.02,24.05.07, released in|24.05.07,23.11.12,22.11.24 |23.11.12,22.11.24 Status|Pushed to main |RESOLVED Resolution|--- |FIXED -- You are receiving this mail because: You are watching all bug changes.

1 0

[Bug 38454] Memory (L1) cache is not flushed before API requests
by bugzilla-daemon＠bugs.koha-community.org 06 Mar '25

06 Mar '25

https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=38454 Katrin Fischer <katrin.fischer(a)bsz-bw.de> changed: What |Removed |Added ---------------------------------------------------------------------------- Status|Pushed to main |RESOLVED Version(s)|25.05.00,25.05.00,24.11.02, |25.05.00,24.11.02,24.05.07, released in|24.05.07,23.11.12,22.11.24 |23.11.12,22.11.24 Resolution|--- |FIXED -- You are receiving this mail because: You are watching all bug changes.

1 0

[Bug 37816] Stop SIP2 from logging passwords
by bugzilla-daemon＠bugs.koha-community.org 06 Mar '25

06 Mar '25

https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=37816 Katrin Fischer <katrin.fischer(a)bsz-bw.de> changed: What |Removed |Added ---------------------------------------------------------------------------- Status|Pushed to main |RESOLVED Version(s)|25.05.00,25.05.00,24.11.02, |25.05.00,24.11.02,24.05.07, released in|24.05.07,23.11.12,22.11.24 |23.11.12,22.11.24 Resolution|--- |FIXED -- You are receiving this mail because: You are watching all bug changes.

1 0

[Bug 37266] patron_lists/delete.pl should have CSRF protection
by bugzilla-daemon＠bugs.koha-community.org 06 Mar '25

06 Mar '25

1 0

[Bug 28907] Potential unauthorized access in public REST routes
by bugzilla-daemon＠bugs.koha-community.org 06 Mar '25

06 Mar '25

https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=28907 Katrin Fischer <katrin.fischer(a)bsz-bw.de> changed: What |Removed |Added ---------------------------------------------------------------------------- Status|Pushed to main |RESOLVED Resolution|--- |FIXED -- You are receiving this mail because: You are watching all bug changes.

1 0

[Bug 28907] Potential unauthorized access in public REST routes
by bugzilla-daemon＠bugs.koha-community.org 06 Mar '25

06 Mar '25

https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=28907 Katrin Fischer <katrin.fischer(a)bsz-bw.de> changed: What |Removed |Added ---------------------------------------------------------------------------- Version(s)|25.05.00,25.05.00,24.11.02, |25.05.00,24.11.02,24.05.07, released in|24.05.07,23.11.12,22.11.24 |23.11.12,22.11.24 -- You are receiving this mail because: You are watching all bug changes.

1 0

[Bug 38469] Circulation returns vulnerable to reflected XSS
by bugzilla-daemon＠bugs.koha-community.org 06 Mar '25

06 Mar '25

https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=38469 --- Comment #26 from Katrin Fischer <katrin.fischer(a)bsz-bw.de> --- Pushed for 25.05! Well done everyone, thank you! -- You are receiving this mail because: You are watching all bug changes.

1 0

[Bug 38469] Circulation returns vulnerable to reflected XSS
by bugzilla-daemon＠bugs.koha-community.org 06 Mar '25

06 Mar '25

https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=38469 Katrin Fischer <katrin.fischer(a)bsz-bw.de> changed: What |Removed |Added ---------------------------------------------------------------------------- Status|Passed QA |Pushed to main Version(s)|25.05.00,24.11.02,24.05.07, |25.05.00,25.05.00,24.11.02, released in|23.11.12,22.11.24 |24.05.07,23.11.12,22.11.24 -- You are receiving this mail because: You are watching all bug changes.

1 0

[Bug 38467] Template::Toolkit filters can create risky Javascript when not using RFC3986
by bugzilla-daemon＠bugs.koha-community.org 06 Mar '25

06 Mar '25

https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=38467 --- Comment #49 from Katrin Fischer <katrin.fischer(a)bsz-bw.de> --- Pushed for 25.05! Well done everyone, thank you! -- You are receiving this mail because: You are watching all bug changes.

1 0