March 2025 - Koha-bugs - lists.koha-community.org

[Bug 28907] Potential unauthorized access in public REST routes
by bugzilla-daemon＠bugs.koha-community.org 06 Mar '25

06 Mar '25

https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=28907 --- Comment #71 from Katrin Fischer <katrin.fischer(a)bsz-bw.de> --- Pushed for 25.05! Well done everyone, thank you! -- You are receiving this mail because: You are watching all bug changes.

1 0

[Bug 28907] Potential unauthorized access in public REST routes
by bugzilla-daemon＠bugs.koha-community.org 06 Mar '25

06 Mar '25

https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=28907 Katrin Fischer <katrin.fischer(a)bsz-bw.de> changed: What |Removed |Added ---------------------------------------------------------------------------- Version(s)|25.05.00,24.11.02,24.05.07, |25.05.00,25.05.00,24.11.02, released in|23.11.12,22.11.24 |24.05.07,23.11.12,22.11.24 Status|Passed QA |Pushed to main -- You are receiving this mail because: You are watching all bug changes.

1 0

[Bug 38961] XSS in vendor search
by bugzilla-daemon＠bugs.koha-community.org 06 Mar '25

06 Mar '25

https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=38961 Katrin Fischer <katrin.fischer(a)bsz-bw.de> changed: What |Removed |Added ---------------------------------------------------------------------------- Version|unspecified |Main QA Contact|testopia(a)bugs.koha-communit |jonathan.druart(a)gmail.com |y.org | -- You are receiving this mail because: You are watching all bug changes.

1 0

[Bug 38961] XSS in vendor search
by bugzilla-daemon＠bugs.koha-community.org 06 Mar '25

06 Mar '25

1 0

[Bug 38488] Add TT filter using HTML scrubber
by bugzilla-daemon＠bugs.koha-community.org 06 Mar '25

06 Mar '25

1 0

[Bug 38469] Circulation returns vulnerable to reflected XSS
by bugzilla-daemon＠bugs.koha-community.org 06 Mar '25

06 Mar '25

1 0

[Bug 38467] Template::Toolkit filters can create risky Javascript when not using RFC3986
by bugzilla-daemon＠bugs.koha-community.org 06 Mar '25

06 Mar '25

https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=38467 Katrin Fischer <katrin.fischer(a)bsz-bw.de> changed: What |Removed |Added ---------------------------------------------------------------------------- QA Contact|testopia(a)bugs.koha-communit |julian.maurice(a)biblibre.com |y.org | -- You are receiving this mail because: You are watching all bug changes.

1 0

[Bug 38467] Template::Toolkit filters can create risky Javascript when not using RFC3986
by bugzilla-daemon＠bugs.koha-community.org 06 Mar '25

06 Mar '25

https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=38467 Katrin Fischer <katrin.fischer(a)bsz-bw.de> changed: What |Removed |Added ---------------------------------------------------------------------------- Keywords|dependency | -- You are receiving this mail because: You are watching all bug changes.

1 0

[Bug 38467] Template::Toolkit filters can create risky Javascript when not using RFC3986
by bugzilla-daemon＠bugs.koha-community.org 06 Mar '25

06 Mar '25

1 0

[Bug 37266] patron_lists/delete.pl should have CSRF protection
by bugzilla-daemon＠bugs.koha-community.org 06 Mar '25

06 Mar '25

https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=37266 Owen Leonard <oleonard(a)myacpl.org> changed: What |Removed |Added ---------------------------------------------------------------------------- Attachment #177887|0 |1 is obsolete| | --- Comment #16 from Owen Leonard <oleonard(a)myacpl.org> --- Created attachment 179008 --> https://bugs.koha-community.org/bugzilla3/attachment.cgi?id=179008&action=e… Bug 37266: patron_lists/delete.pl should have CSRF protection This patch adds CSRF protection to patron list deletions. Also changed: The "Delete selected lists" button is now in a floating toolbar. To test, apply the patch and go to Tools -> Patron lists. - If necessary, create a few patron lists. - Test the two methods for list deletion available on the page: - Check one or more checkboxes and then click the "Delete selected lists" at the top of the page. - Click the "Actions" button for an individual list and choose "Delete list." - Open the checkout page for a patron. - Under the "Patron lists" tab, add the patron to a list. - Click the "Actions" button for an that list and choose "Delete list." - When you are taken to the patron lists page the list should have been deleted. - Perform the same test on the patron details page. Sponsored-by: Athens County Public Libraries Signed-off-by: Phil Ringnalda <phil(a)chetcolibrary.org> Signed-off-by: Julian Maurice <julian.maurice(a)biblibre.com> -- You are receiving this mail because: You are watching all bug changes.

1 0