- Koha-devel - lists.koha-community.org

Re: XSS Vulnerabilities in Koha
by Rick Welykochy 31 Aug '07

31 Aug '07

[moved to Koha-devel] ... Chris Cormack wrote: > We did fix this up a while back for the opac, but overtime > vulnerabilities might have crept back in. I'm not too worried about the > intranet side, if someone malicious has access to that, you have bigger > problems than xss :-) But Id certainly like to see patches for the opac. Correct me if I am wrong, but XSS does not require the attacker to have access to your server. Just the ability to carefully construct a URL to that server that allows an attack via a (naive) user on the server, the Intranet in this case. If one is already logged into the Intranet and then is somehow tricked into clicking on a malicious (XSS) link found elsewhere, in an email or on another site, bingo! Gotcha! I certainly do not profess to be an expert in XSS, but I'd imagine that if one was determined enough to get access to the Koha Intranet of a particular library for some nefarious purpose, a cookie theft might be possible. It would be educational to see an XSS in action on Koha, a real world example. Then more eyes could have a look and help with an XSS audit. My brief read on the web about XSS indicates that there are many many varieties of the exploit, so that one would have to keep in mind these many attack vectors while reviewing the sourcecode. And it would seem that many attacks originate in user-supplied form data, so that proper escaping and entity replacement of significant delimiters like < and > are paramount as a first level of defense. Which brings to mind another audit: one for SQL injection attacks. I haven't had a close at the code, but a grep of "->quote(" turns up 102 uses in Koha/2.2.9, which leaves one feeling somewhat confident that the problem has been addressed at one stage. cheers rickw -- _________________________________ Rick Welykochy || Praxis Services I didn't have time to write a short letter, so I wrote a long one instead. -- Mark Twain

3 4

[Fwd: Re: [Koha-devel] how to contribute to Koha]
by Paul POULAIN 31 Aug '07

31 Aug '07

-- Paul POULAIN et Henri Damien LAURENT Consultants indépendants en logiciels libres et bibliothéconomie (http://www.koha-fr.org) Tel : 04 91 31 45 19

1 0

how to contribute to Koha
by samuel desseaux 31 Aug '07

31 Aug '07

Hello! I'm newbie on this list and i would like to contribute to the development of Koha. My name is Samuel (you can say "sam",if you want). I'm 32 years old and i live in North of France. I work in a library and i am in charge of everything concerning computers,IT. At work, i use Horizon of Dynix but i hope that one day, i could use a free software like Koha. So, i'd like to know how i could contrubute. I can coding, debugging,translating,writing documentations ( i don't know in which field there's a lack of contributors). Bye sam

2 1

IMPORTANT Koha 3.0 updatedatase and kohastructure.sql
by Joshua M. Ferraro 31 Aug '07

31 Aug '07

Hi all, For years, we've had trouble maintaining the official Koha SQL definition, it seems like every developer probably has a slightly different definition. This is fine, however, we need to decide on an appropriate process for updating the official kohastructure.sql file that forms the basis for the new Web Installer in Koha 3.0. If you look back through the history of this file: http://cvs.savannah.nongnu.org/viewvc/koha/installer/kohastructure.sql?root… You'll notice vastly different versions ... people seem to just overwrite it with a new def exported in their favorite tool (mysqldump, phpmyadmin, etc.). Recently I had to revert kohastructure.sql in CVS because it patently failed for me ... I noticed that there are some definitions missing as well, and discrepancies between versions w/respect to the constraints. For instance, I asked Paul this afternoon to send me his 3.0 SQL definition, but that didn't include the 'defaultvalue' column in the marc_subfield_structure table, and, as a result, the MARC editor is broken for new installations when using that definition. I'd also like to point out that updatedatabase should start completely blank for 3.0. IMO updatedatabase shouldn't be the upgrade path from 1.x or 2.x to 3.0 ... rather, it should be the upgrade path for 3.0 to 3.2, etc. Other thoughts? I'd like to get feedback from everyone on the best way to maintain kohastructure.sql and updatedatabase, to make sure we always have a known SQL definition and update process. Comments, ideas? Cheers, -- Joshua Ferraro SUPPORT FOR OPEN-SOURCE SOFTWARE President, Technology migration, training, maintenance, support LibLime Featuring Koha Open-Source ILS jmf(a)liblime.com |Full Demos at http://liblime.com/koha |1(888)KohaILS

5 5

dummy function for gettext?
by Owen Leonard 31 Aug '07

31 Aug '07

I'm curious about something in the 3.0 templates: <script language="JavaScript" type="text/javascript"> function _(s) { return s } // dummy function for gettext </script> Can anyone tell me what purpose that serves? Thanks, Owen -- Web Developer Nelsonville Public Library http://www.myacpl.org

2 1

Altering Koha
by Roger Horne 28 Aug '07

28 Aug '07

As I understand it, the reason to use templates is so that users can alter the relevant Koha display. I am however finding it very difficult to see how to make one particular change in the current version. As I have said, the library I am concerned with is a professional library, ie similar to a reference library save that the books can be borrowed. The edition of a book is in most cases relevant since the user may well want an old edition rather than the current one - or vice versa ... (I have one old book where the 3rd edition is in my view much better than the 4th which was abbreviated because of post-war paper shortages.) Alternatively he may need to ensure that he has the latest edition. So I would like eg http://radchams.co.uk/cgi-bin/koha/opac-detail.pl?bib=123 to include a line such as Edition: 17th Ed. I can see how to alter opac-detail.tmpl using something like  ... but I cannot see where or how I would add the appropriate $template->param() command (and what the command would be to get what appears to be 250a). The koha docs are in the main excellent but I cannot see how to do this. Roger -- Roger Horne roger(a)hrothgar.co.uk http://hrothgar.co.uk/YAWS/

1 0

Installation of Koha 3.0
by Axel Bojer 28 Aug '07

28 Aug '07

Hi! I was trying to install koha 2.2.9, but found it overly complex and not very user friendly, but I found some links for it. I don't remember what went wrong, and I will certainly try again later. But it would have been nice if there could have benn for instance debian-packages of it to ease the pain. As I think of it not every small library has the technical know hos to install and build from the command line, and just the though of it scares some light hearted users away. Will Koha 3.0 be easier to install? I mean, the whole point with debian packages of course is that all the dependencies then are taken care of :-) Best regards Axel bojer

2 1

Bug reporting by amateurs
by Roger Horne 28 Aug '07

28 Aug '07

In file:///usr/local/koha/intranet/scripts/misc/release%20notes/release_notes_200RC2.txt it was said that known bugs included * autobarcode not calculated even if autobarcode system parameter is set and MARC=on. It seems that this has not been solved as yet, at any rate if MARC=off. It is, to put it mildly, annoying to find that if one enters a biblio manually using acqui-simple that one has to invent a barcode to be able to enter the new data and that if one fogets to do so one has to start all over again. The problem is, I think, that the no-marc pages require that a barcode be entered when starting even though koha should be producing one manually at a *later* stage. I found that commenting out the lines elsif ((! $barcode) && (! $website)) { print $input->redirect("additem-nomarc.pl?biblionumber=$biblionumber&error=nobarcode"); } at line 73 of /usr/local/koha/intranet/cgi-bin/acqui.simple/saveitem.pl enabled the program to save the data correctly so that it could be found on a subsequent search (with either opac or intranet). Presumably a safer option would involve a check that included whether autoBarcode was true but I did not feel up to that at the time. This alteration did not cause Koha to generate the missing barcode. So on looking at the output of a search the line containing the barcode was blank. A search for autoBarcode did however throw up an anomaly. Line 93 of aqui.simple/additem.pl reads: if (C4::Context->preference('autoBarcode')) { while line 102 of cgi-bin/aqui/aquire.pl reads: my $auto_barcode = C4::Context->boolean_preference("autoBarcode") || 0; Changing the former to if (C4::Context->boolean_preference('autoBarcode')) { seems to do something different since a search produces an error "Sorry that barcode is already in use" although I could not get it to tell me what the barcode was: I doubt that there was one.. (So could the appropriate change to saveitem.pl be the addition of &&(! C4::Context->boolean_preference('autoBarcode' )) (together with use C4::Context)? It seems to work.) Trying to take this further is beyond me but I suppose it might be of interest to someone else. The two different ways of (possibly) calculating the barcode in the two files defeat me at the moment. So how should someone who is not sure what he is doing report this sort of possible (partial) start of a solution to a known problem? Roger -- Roger Horne roger(a)hrothgar.co.uk http://hrothgar.co.uk/YAWS/

5 5

barcode printing status in HEAD.
by Paul POULAIN 27 Aug '07

27 Aug '07

Hello guys, I think that,in head, the barcode management is in a poor state : the tools menu points to tools/barcode.pl, and barcodes/ is unreachable from menus. iirc, katipo wrote that part of the code. Could you have a look & fix what has to be fixed ? (I won't do it, as I don't have any customer using that feature, so I would break more than fix ;-) ) -- Paul POULAIN et Henri Damien LAURENT Consultants indépendants en logiciels libres et bibliothéconomie (http://www.koha-fr.org) Tel : 04 91 31 45 19

3 3

Time estimate for the translation of koha
by Axel Bojer 20 Aug '07

20 Aug '07

Hello! I am new to this list. We, two norwegians, are trying to get sponsored a translation of koha to norwegian bokmål. We are already involved in other translation projects and have a translation list for the most used data terms, so we have something to start with :-) Our first step is to estimate the work and time included. I searched your web pages for something describing the amount of work needed for this, but found nothing. So then I downloaded the installation files for 2.2.9 to have a look at the translation files, but the result is a bit confusing. First I searched for the pot-files: # tree -fin koha-2.2.9|grep pot$ koha-2.2.9/scripts/misc/translator/po/css_opac.pot [472] koha-2.2.9/scripts/misc/translator/po/default_intranet.pot [2576] These two files together fills about 3000 strings (see the parentheses, the amount are taken from kbabels catalog manager), that means approximately 40 man hours (a full week) for both translation and proofreading if this is all that is needed for a full translation. But then I searched for po-files: # tree -fin koha-2.2.9|grep po$ koha-2.2.9/scripts/misc/translator/po/css_intranet_zh_TW.po [3998] koha-2.2.9/scripts/misc/translator/po/css_opac_en_EN.po [471] koha-2.2.9/scripts/misc/translator/po/css_opac_es_ES.po [509] koha-2.2.9/scripts/misc/translator/po/css_opac_eu.po [425] koha-2.2.9/scripts/misc/translator/po/css_opac_fr_FR.po [509] koha-2.2.9/scripts/misc/translator/po/css_opac_it_IT.po [509] koha-2.2.9/scripts/misc/translator/po/css_opac_pl_PL.po [509] koha-2.2.9/scripts/misc/translator/po/css_opac_ta_MY.po [509] koha-2.2.9/scripts/misc/translator/po/css_opac_uk_UA.po [509] koha-2.2.9/scripts/misc/translator/po/css_opac_zh_CN.po [509] koha-2.2.9/scripts/misc/translator/po/css_opac_zh_TW.po [509] koha-2.2.9/scripts/misc/translator/po/default_intranet_en_EN.po [2313] koha-2.2.9/scripts/misc/translator/po/default_intranet_es_AR.po [2613] koha-2.2.9/scripts/misc/translator/po/default_intranet_es_ES.po [2613] koha-2.2.9/scripts/misc/translator/po/default_intranet_eu.po [3561] koha-2.2.9/scripts/misc/translator/po/default_intranet_fr_FR.po [2613] koha-2.2.9/scripts/misc/translator/po/default_intranet_it_IT.po [2613] koha-2.2.9/scripts/misc/translator/po/default_intranet_pl_PL.po [2613] koha-2.2.9/scripts/misc/translator/po/default_intranet_ta_MY.po [2613] koha-2.2.9/scripts/misc/translator/po/default_intranet_uk_UA.po [2613] koha-2.2.9/scripts/misc/translator/po/default_intranet_zh_TW.po [2613] koha-2.2.9/scripts/misc/translator/po/default_opac_pl_PL.po [200] koha-2.2.9/scripts/misc/translator/po/default_opac_zh_TW.po [205] koha-2.2.9/scripts/misc/translator/po/npl_intranet_uk_UA.po [3175] koha-2.2.9/scripts/misc/translator/po/npl_intranet_zh_CN.po [3175] koha-2.2.9/scripts/misc/translator/po/npl_intranet_zh_TW.po [3175] koha-2.2.9/scripts/misc/translator/po/npl_opac_hu_HU.po [507] koha-2.2.9/scripts/misc/translator/po/npl_opac_jp_JP.po [507] koha-2.2.9/scripts/misc/translator/po/npl_opac_kr_KR.po [507] koha-2.2.9/scripts/misc/translator/po/npl_opac_uk_UA.po [507] koha-2.2.9/scripts/misc/translator/po/npl_opac_zh_CN.po [507] koha-2.2.9/scripts/misc/translator/po/npl_opac_zh_TW.po [507] New files that only exists as po and not pot includes: -- css_intranet* [3998] -- default_opac* [200--205] -- npl_intranet* [3175] -- npl_opac* [507] (I also see these same files on net: http://cvs.savannah.nongnu.org/viewvc/koha/misc/translator/po/?root=koha&pa… some with an age of 2--3 years, last change four months ago) If we have to translate these also, we will have about 8000 strings more, that makes a big difference! Do you have the pot-files for these files? (I also see that the likenamed files don't always have the same amount of strings, wich puzzles me -- see, again, the parantheses). Are alle these files needed, if not wich one are and what are the others for? I also see that you have a web interface: Best regards Axel Bojer

3 7