[koha-commits] main Koha release repository branch master updated. v16.11.00-348-g904716f

[Git repo owner]

This is an automated email from the git hooks/post-receive script. It was
generated because a ref change was pushed to the repository containing
the project "main Koha release repository".

The branch, master has been updated
       via  904716f581102887c27d5bfc727430564cc12284 (commit)
      from  e2d1bafa22f213658fc040d541534299c126bd1b (commit)

Those revisions listed above that are new to this repository have
not appeared on any other notification email; so we list those
revisions in full, below.

- Log -----------------------------------------------------------------
commit 904716f581102887c27d5bfc727430564cc12284
Author: Jonathan Druart <jonathan.druart at bugs.koha-community.org>
Date:   Tue Jan 10 18:06:51 2017 +0100

    Bug 17902: Fix possible SQL injection in serials editing
    
    /cgi-bin/koha/serials/serials-edit.pl?serstatus=*/+,2,3,'2016-12-12','2016-12-12',6,'jjj7','jjj8'%20--%20-&subscriptionid=1+and+1%3d2+Union+all+select+111+/*
    
    The SQL query is not constructed correctly, placeholders must be used.
    Subscription id and status list can be provided by the user.
    
    This vulnerability has been reported by MDSec.
    
    Signed-off-by: Mirko Tietgen <mirko at abunchofthings.net>
    
    Signed-off-by: Nick Clemens <nick at bywatersolutions.com>
    
    Signed-off-by: Kyle M Hall <kyle at bywatersolutions.com>

-----------------------------------------------------------------------

Summary of changes:
 C4/Serials.pm |   13 +++++++------
 1 file changed, 7 insertions(+), 6 deletions(-)


hooks/post-receive
-- 
main Koha release repository