[koha-commits] main Koha release repository branch 3.22.x updated. v3.22.15-3-g8ba4026

[Git repo owner]

This is an automated email from the git hooks/post-receive script. It was
generated because a ref change was pushed to the repository containing
the project "main Koha release repository".

The branch, 3.22.x has been updated
       via  8ba4026aab60f5dc92910ca8485bb05efcc47593 (commit)
      from  652c627314142d5b26606dbee7220726cbdedb61 (commit)

Those revisions listed above that are new to this repository have
not appeared on any other notification email; so we list those
revisions in full, below.

- Log -----------------------------------------------------------------
commit 8ba4026aab60f5dc92910ca8485bb05efcc47593
Author: Jonathan Druart <jonathan.druart at bugs.koha-community.org>
Date:   Fri Jan 13 16:40:59 2017 +0100

    Bug 17903: Fix possible SQL injection in serial claims
    
    To recreate:
    /cgi-bin/koha/serials/claims.pl?serialid=1)and%20(select*from(select(sleep(20)))a)--%20&letter_code=0
    
    Notice the delay.
    
    The SQL query is not constructed correctly, placeholders must be used.
    
    This vulnerability has been reported by MDSec.
    
    Signed-off-by: Mirko Tietgen <mirko at abunchofthings.net>
    Signed-off-by: Marcel de Rooy <m.de.rooy at rijksmuseum.nl>
    
    Signed-off-by: Kyle M Hall <kyle at bywatersolutions.com>
    (cherry picked from commit 179ff58b0980f348821c727c2fa79a5eca310901)
    Signed-off-by: Julian Maurice <julian.maurice at biblibre.com>

-----------------------------------------------------------------------

Summary of changes:
 C4/Letters.pm |    4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)


hooks/post-receive
-- 
main Koha release repository