A new request with request id 15724 has been created by koha-devel-request@lists.koha-community.org. Short info on the request is :
Title : Koha-devel Digest, Vol 190, Issue 7
Category :
Description : Send Koha-devel mailing list submissions to
koha-devel@lists.koha-community.org
To subscribe or unsubscribe via the World Wide Web, visit
https://lists.koha-community.org/cgi-bin/mailman/listinfo/koha-devel
or, via email, send a message with subject or body 'help' to
koha-devel-request@lists.koha-community.org
You can reach the person managing the list at
koha-devel-owner@lists.koha-community.org
When replying, please edit your Subject line so it is more specific
than "Re: Contents of Koha-devel digest..."
Today's Topics:
1. Re: Koha-devel Digest, Vol 190, Issue 4 REST API + DataTables
(Mark Hofstetter)
2. Security releases for all stable branches - UPGRADE!
(Jonathan Druart)
3. Re: Security releases for all stable branches - UPGRADE!
(Mason James)
4. REST API + DataTables (dcook@prosentient.com.au)
----------------------------------------------------------------------
Message: 1
Date: Mon, 6 Sep 2021 13:32:00 +0200
From: Mark Hofstetter <mark@hofstetter.at>
To: koha-devel@lists.koha-community.org,
koha-devel-request@lists.koha-community.org
Subject: Re: [Koha-devel] Koha-devel Digest, Vol 190, Issue 4 REST API
+ DataTables
Message-ID: <83d3ea8a-a6e5-9b44-277c-a487a2c8f7b5@hofstetter.at>
Content-Type: text/plain; charset=utf-8; format=flowed
Hi,
I've written some plugins that work with datatables which seems quite
straightforward to me
the plugins are too specific to use widely but I would be happy to share
the code anyway!
regards
Mark
------------------------------
Message: 2
Date: Mon, 6 Sep 2021 14:00:00 +0200
From: Jonathan Druart <jonathan.druart@bugs.koha-community.org>
To: koha-devel <koha-devel@lists.koha-community.org>, koha
<koha@lists.katipo.co.nz>
Subject: [Koha-devel] Security releases for all stable branches -
UPGRADE!
Message-ID:
<CAJzKNY5_61OwpJ+0RWgJ9vTP=LYR7=V8jZ2UShwVCGYLKeRffg@mail.gmail.com>
Content-Type: text/plain; charset="UTF-8"
Hello everybody,
Don't ignore this email!
Last week a critical security bug was reported on our bug tracker. We
fixed it and built debian packages for the four stable releases we
currently support.
The security flaw can cause a privilege escalation from OPAC users. It
can be highly damaging, especially if your staff interface is
accessible via login from everywhere without further security measures
like IP restrictions in place.
How to fix the problem?
If you are using a debian-based system you should upgrade using the
debian packages:
% apt update
% apt install koha-common
If you are using an older version of Koha (<19.11) you should either
upgrade to a newer version, or apply those two patches (they should
apply on older versions as well):
https://paste.debian.net/hidden/885fb5ec/
https://paste.debian.net/hidden/1184f523/
https://paste.debian.net/plainh/ae9f9f25
You can apply them using the following command:
% wget "https://paste.debian.net/plainh/885fb5ec" -O 28929_1.patch
% wget "https://paste.debian.net/plainh/1184f523" -O 28929_2.patch
% wget "https://paste.debian.net/plainh/ae9f9f25" -O 28947.patch
% patch -p1 -d /usr/share/koha/intranet/cgi-bin/ <
/kohadevbox/koha/28929_1.patch
% patch -p1 -d /usr/share/koha/opac/cgi-bin/ < /kohadevbox/koha/28929_2.patch
% patch -d /usr/share/koha/opac/cgi-bin/opac/ < /kohadevbox/koha/28947.patch
The two bugs are 28929 and 28947. As they contain information about
how to recreate the vulnerability they will stay hidden two more days to let
you upgrade your systems.
Let us know if you have any questions!
Regards,
Jonathan
------------------------------
Message: 3
Date: Tue, 7 Sep 2021 00:57:43 +1200
From: Mason James <mtj@kohaaloha.com>
To: koha-devel <koha-devel@lists.koha-community.org>, koha
<koha@lists.katipo.co.nz>
Subject: Re: [Koha-devel] Security releases for all stable branches -
UPGRADE!
Message-ID: <b9e50e7d-b4b9-c62b-188b-634e8ebb93ef@kohaaloha.com>
Content-Type: text/plain; charset=utf-8; format=flowed
hi folks
i think there might be a small typo in the patch commands - but this worked OK for me...
cd /tmp
wget "https://paste.debian.net/plainh/885fb5ec" -O 28929_1.patch
wget "https://paste.debian.net/plainh/1184f523" -O 28929_2.patch
wget "https://paste.debian.net/plainh/ae9f9f25" -O 28947.patch
sudo patch -p1 -d /usr/share/koha/intranet/cgi-bin/ < 28929_1.patch
sudo patch -p1 -d /usr/share/koha/opac/cgi-bin/ < 28929_2.patch
sudo patch -p1 -d /usr/share/koha/opac/cgi-bin/ < 28947.patch
output looks like...
------------------
mason@xen1:/tmp$ sudo patch -p1 -d /usr/share/koha/intranet/cgi-bin/ < 28929_1.patch
patching file members/memberentry.pl
Hunk #1 succeeded at 225 (offset 10 lines).
mason@xen1:/tmp$ sudo patch -p1 -d /usr/share/koha/opac/cgi-bin/ < 28929_2.patch
patching file opac/opac-memberentry.pl
Hunk #1 succeeded at 523 (offset 1 line).
mason@xen1:/tmp$ sudo patch -p1 -d /usr/share/koha/opac/cgi-bin/ < 28947.patch
patching file opac/opac-memberentry.pl
patch unexpectedly ends in middle of line
------------------
it seems you can ignore the 'patch unexpectedly ends' message
On 7/09/21 12:00 am, Jonathan Druart wrote:
> Hello everybody,
>
> Don't ignore this email!
>
> Last week a critical security bug was reported on our bug tracker. We
> fixed it and built debian packages for the four stable releases we
> currently support.
>
> The security flaw can cause a privilege escalation from OPAC users. It
> can be highly damaging, especially if your staff interface is
> accessible via login from everywhere without further security measures
> like IP restrictions in place.
>
>
> How to fix the problem?
> If you are using a debian-based system you should upgrade using the
> debian packages:
> % apt update
> % apt install koha-common
>
> If you are using an older version of Koha (<19.11) you should either
> upgrade to a newer version, or apply those two patches (they should
> apply on older versions as well):
> https://paste.debian.net/hidden/885fb5ec/
> https://paste.debian.net/hidden/1184f523/
> https://paste.debian.net/plainh/ae9f9f25
>
> You can apply them using the following command:
> % wget "https://paste.debian.net/plainh/885fb5ec" -O 28929_1.patch
> % wget "https://paste.debian.net/plainh/1184f523" -O 28929_2.patch
> % wget "https://paste.debian.net/plainh/ae9f9f25" -O 28947.patch
> % patch -p1 -d /usr/share/koha/intranet/cgi-bin/ <
> /kohadevbox/koha/28929_1.patch
> % patch -p1 -d /usr/share/koha/opac/cgi-bin/ < /kohadevbox/koha/28929_2.patch
> % patch -d /usr/share/koha/opac/cgi-bin/opac/ < /kohadevbox/koha/28947.patch
>
> The two bugs are 28929 and 28947. As they contain information about
> how to recreate the vulnerability they will stay hidden two more days to let
> you upgrade your systems.
>
> Let us know if you have any questions!
>
> Regards,
> Jonathan
> _______________________________________________
> Koha-devel mailing list
> Koha-devel@lists.koha-community.org
> https://lists.koha-community.org/cgi-bin/mailman/listinfo/koha-devel
> website : https://www.koha-community.org/
> git : https://git.koha-community.org/
> bugs : https://bugs.koha-community.org/
------------------------------
Message: 4
Date: Tue, 7 Sep 2021 10:15:17 +1000
From: <dcook@prosentient.com.au>
To: "'Mark Hofstetter'" <mark@hofstetter.at>
Cc: <koha-devel@lists.koha-community.org>
Subject: [Koha-devel] REST API + DataTables
Message-ID: <108b01d7a37d$7011c050$503540f0$@prosentient.com.au>
Content-Type: text/plain; charset="utf-8"
Thanks, Mark. That would be great!
David Cook
Senior Software Engineer
Prosentient Systems
Suite 7.03
6a Glen St
Milsons Point NSW 2061
Australia
Office: 02 9212 0899
Online: 02 8005 0595
-----Original Message-----
From: Koha-devel <koha-devel-bounces@lists.koha-community.org> On Behalf Of Mark Hofstetter
Sent: Monday, 6 September 2021 9:32 PM
To: koha-devel@lists.koha-community.org; koha-devel-request@lists.koha-community.org
Subject: Re: [Koha-devel] Koha-devel Digest, Vol 190, Issue 4 REST API + DataTables
Hi,
I've written some plugins that work with datatables which seems quite straightforward to me
the plugins are too specific to use widely but I would be happy to share the code anyway!
regards
Mark
_______________________________________________
Koha-devel mailing list
Koha-devel@lists.koha-community.org
https://lists.koha-community.org/cgi-bin/mailman/listinfo/koha-devel
website : https://www.koha-community.org/ git : https://git.koha-community.org/ bugs : https://bugs.koha-community.org/
------------------------------
Subject: Digest Footer
_______________________________________________
Koha-devel mailing list
Koha-devel@lists.koha-community.org
https://lists.koha-community.org/cgi-bin/mailman/listinfo/koha-devel
website : https://www.koha-community.org/
git : https://git.koha-community.org/
bugs : https://bugs.koha-community.org/
------------------------------
End of Koha-devel Digest, Vol 190, Issue 7
******************************************
NOTE: You are receiving this mail because, the Requester/Technician wanted you to get notified on this request creation.