Commit graph

28 commits

Author SHA1 Message Date
Julian Maurice
96cc447045 Bug 25898: Prohibit indirect object notation
Signed-off-by: Tomas Cohen Arazi <tomascohen@theke.io>

Signed-off-by: Katrin Fischer <katrin.fischer.83@web.de>

Signed-off-by: Jonathan Druart <jonathan.druart@bugs.koha-community.org>
2020-10-15 12:56:30 +02:00
638786e719 Bug 24663: Remove authnotrequired if set to 0
It defaults to 0 in get_template_and_user

Signed-off-by: Martin Renvoize <martin.renvoize@ptfs-europe.com>
Signed-off-by: Tomas Cohen Arazi <tomascohen@theke.io>

Signed-off-by: Jonathan Druart <jonathan.druart@bugs.koha-community.org>
2020-09-03 10:40:35 +02:00
Zoe Bennett
165c56de29 Bug 19999: use Modern::Perl in label scripts
Test Plan:
- Check that it now says 'use Modern::Perl;' and not 'use strict; use
warnings;' in the following labels perl scripts:

label-create-csv.pl
label-create-pdf.pl
label-create-xml.pl
label-edit-batch.pl
label-edit-layout.pl
label-edit-profile.pl
label-edit-template.pl
label-home.pl
label-item-search.pl
label-print.pl
spinelabel-home.pl
spinelabel-print.pl

Signed-off-by: Jonathan Druart <jonathan.druart@bugs.koha-community.org>
2018-02-05 09:45:48 -03:00
a70980d825 Bug 17900: Fix possible SQL injection in patron cards template editing
To recreate:
/cgi-bin/koha/patroncards/edit-template.pl?op=edit&element_id=23%20and%201%3d2+union+all+select+1,user(),@@version+--%20

Look at the Profile dropdown list.

To fix this problem and to make sure it does not appears anywhere else
in the label and patroncards modules, I have refactored the way the
queries are built in C4::Creators::Lib
Now all of the subroutine takes a hashref in parameters with a 'fields'
and 'filters' parameters.
From these 2 parameters the new internal subroutine _build_query will
build the query and use placeholders.

Test plan:
1/ Make sure you do not recreate the vulnerability with this patch
applied.
2/ With decent data in the labels and patroncards modules, compare all
the different view (undef the New and Manage button groups) with and
without this patch applied.
=> You should not see any differences.

This vulnerability has been reported by MDSec.

Signed-off-by: Chris Cormack <chris@bigballofwax.co.nz>

Signed-off-by: Marcel de Rooy <m.de.rooy@rijksmuseum.nl>

Signed-off-by: Kyle M Hall <kyle@bywatersolutions.com>
2017-01-30 11:19:55 +00:00
f3e4b5bbb6 Bug 16154: CGI->multi_param - Force scalar context
This patch replaces the occurrences of
  $template->param( foo => $cgi->param('foo') );
with
  $template->param( foo => scalar $cgi->param('foo') );

perl -p -i -e 's/(\s*=>\s*)\$(cgi|input|query)\->param\(/$1scalar
\$$2\->param\(/xms' **/*.pl

Signed-off-by: Owen Leonard <oleonard@myacpl.org>
Signed-off-by: Katrin Fischer <katrin.fischer.83@web.de>

Signed-off-by: Brendan Gallagher <brendan@bywatersolutions.com>
2016-04-26 23:16:43 +00:00
Jonathan Druart
a6c9bd0eb5 Bug 9978: Replace license header with the correct license (GPLv3+)
Signed-off-by: Chris Nighswonger <cnighswonger@foundations.edu>
Signed-off-by: Tomas Cohen Arazi <tomascohen@gmail.com>
Signed-off-by: Katrin Fischer <katrin.fischer@bsz-bw.de>

http://bugs.koha-community.org/show_bug.cgi?id=9987

Signed-off-by: Kyle M Hall <kyle@bywatersolutions.com>
Signed-off-by: Tomas Cohen Arazi <tomascohen@gmail.com>
2015-04-20 09:59:38 -03:00
Jonathan Druart
e20270fec4 Bug 11944: use CGI( -utf8 ) everywhere
Signed-off-by: Paola Rossi <paola.rossi@cineca.it>
Signed-off-by: Bernardo Gonzalez Kriegel <bgkriegel@gmail.com>
Signed-off-by: Dobrica Pavlinusic <dpavlin@rot13.org>

Signed-off-by: Martin Renvoize <martin.renvoize@ptfs-europe.com>
Signed-off-by: Tomas Cohen Arazi <tomascohen@gmail.com>
2015-01-13 13:07:21 -03:00
afd2418d73 Bug 11349: Change .tmpl -> .tt in scripts using templates
Since we switched to Template Toolkit we don't need to stick with the
sufix we used for HTML::Template::Pro.

This patch changes the occurences of '.tmpl' in favour of '.tt'.

To test:
- Apply the patch
- Install koha, and verify that every page can be accesed

Regards
To+

P.S. a followup will remove the glue code.

Signed-off-by: Chris Cormack <chrisc@catalyst.net.nz>

Signed-off-by: Jonathan Druart <jonathan.druart@biblibre.com>
Signed-off-by: Tomas Cohen Arazi <tomascohen@gmail.com>
2014-07-17 11:05:49 -03:00
Dobrica Pavlinusic
130e3d9c10 Bug 8315 - remove use C4::* version
This patch touches a lot of code, but basically it removes version
information from use C4::* in our code.

Signed-off-by: Chris Cormack <chris@bigballofwax.co.nz>
Signed-off-by: Paul Poulain <paul.poulain@biblibre.com>
All script still compiles after the patch (confirmed by pre-applypatch hook)
2012-07-13 14:17:20 +02:00
Chris Nighswonger
14a0c39e84 Bug 6269 - can't undefine a printer profile
This patch adds a 'No Profile/N/A' selection to the printer profile
drop-down menu along with code to handle the selection of it. This
selection is the default selection for new templates.

Documentation should be updated to reflect this change.

Signed-off-by: Liz Rea <lrea@nekls.org>
Signed-off-by: Chris Cormack <chrisc@catalyst.net.nz>
2011-08-21 19:56:00 +12:00
Chris Nighswonger
b8d5a69e4e Bug 5203 - Creating a label template causes fatal error if description field is empty
This is due to the underlying script not having any defaults hard coded which results
in skewed hash elements when the parameter array is coerced into a hash at a later point.

This also occurs in layouts and profiles. This patch adds defaults to all three.

No documentation changes are necessary.
2010-09-23 13:52:40 -04:00
573ac9488f remove a bunch of unconditional debug warns
Signed-off-by: Galen Charlton <gmcharlt@gmail.com>
2010-07-02 10:57:08 -04:00
Lars Wirzenius
772ada9bf3 Fix FSF address in directory labels/
Signed-off-by: Galen Charlton <gmcharlt@gmail.com>
2010-03-16 20:17:50 -04:00
Chris Nighswonger
84d5b28f12 Bringing label, patroncard, and creator modules into conformity with the rest of C4 style.
Signed-off-by: Galen Charlton <gmcharlt@gmail.com>
2010-02-08 20:54:34 -05:00
Chris Nighswonger
ff13d25bb3 Bugfix: Various Label Creator bugs
This fixes:

* A bug which caused the label template editor to throw
an error when saving when no previous profile was applied.

* A typo which caused a 'fetch without execute' error in Labels.pm

It also comments out several useless warns
2010-01-19 22:27:09 -05:00
Chris Nighswonger
4a675bcaad [5/30] A rework of Label Creator code
This rework removes code held in common with the Patron Card Creator
and move is to the new C4::Creators module.
2010-01-11 18:16:52 -05:00
Chris Nighswonger
3bab38c3fc Bug 3706 Label templates/layouts do not save properly
Two issues here:

1. No radio box was selected by default in the format section of the layout editor. This actually needs some additional attention to allow the user
to establish a default method of entering the format string. As noted in comments in the code, this would probably be best implimented by adding yet
another syspref. However, I don't have time atm.

2. On saving a new template, if no profile was assigned to the new template, the script threw an error and died.

Both issues are addressed in this patch.

Signed-off-by: Galen Charlton <gmcharlt@gmail.com>
2009-10-14 10:17:10 -04:00
dd08a539dc remove unnecesary import of HTM:::Template::pro
Signed-off-by: Galen Charlton <gmcharlt@gmail.com>
2009-09-05 21:43:12 -04:00
0bbcfeda0e replace syslog with warns
As discussed with Chris Nighswonger on #koha, this patch
removes the calls to syslog and replaces them with warns
so that error messages generated by the labels code
are sent to the Apache error log.  This avoids splitting
this sort of logging across multiple files and is consistent
with current practice in most of the rest of Koha.

Signed-off-by: Galen Charlton <gmcharlt@gmail.com>
2009-09-05 21:43:12 -04:00
Chris Nighswonger
ded8c88e95 [36/40] Bugfix for profile update on profile/template association change. 2009-09-01 15:54:18 -04:00
Chris Nighswonger
c468a724b4 [22/40] General code cleanup of new labels module code. 2009-09-01 15:51:39 -04:00
Chris Nighswonger
e12ae1892c [9/40] Work on template interface. 2009-09-01 15:48:50 -04:00
Chris Nighswonger
11a213a82f Bumping DB to 061 - Adding the ability to choose font type to the Label tool.
Signed-off-by: Joshua Ferraro <jmf@liblime.com>
2008-03-08 11:19:34 -06:00
Chris Nighswonger
668aabcab1 Modifying Label Creation to handle no Printer Profile existence case.
Signed-off-by: Chris Cormack <chris@bigballofwax.co.nz>
Signed-off-by: Joshua Ferraro <jmf@liblime.com>
2008-02-16 11:26:41 -06:00
Chris Nighswonger
bc895d8626 Adding Printer Profiles feature to the Label Creator.
Signed-off-by: Chris Cormack <chris@bigballofwax.co.nz>
Signed-off-by: Joshua Ferraro <jmf@liblime.com>
2008-02-16 11:26:38 -06:00
Paul POULAIN
a502aa1c76 HTML::Template => HTML::Template::Pro
HTML::Template is no more used, some were remaining,
fixing the "use ...;" to H::T::Pro only

Signed-off-by: Chris Cormack <crc@liblime.com>
Signed-off-by: Joshua Ferraro <jmf@liblime.com>
2007-12-02 14:55:55 -06:00
Paul POULAIN
8b7085a8ab removing useless code
the 3 parameters :
intranetcolorstylesheet => C4::Context->preference("intranetcolorstylesheet"),
intranetstylesheet => C4::Context->preference("intranetstylesheet"),
IntranetNav => C4::Context->preference("IntranetNav"),

are filled by Auth.pm automatically, removing them in templates

Signed-off-by: Chris Cormack <crc@liblime.com>
Signed-off-by: Joshua Ferraro <jmf@liblime.com>
2007-10-24 17:03:38 -05:00
Ryan Higgins
6e2564450e Adding labels generator.
Signed-off-by: Joshua Ferraro <jmf@liblime.com>
Signed-off-by: Chris Cormack <crc@liblime.com>
2007-08-18 17:39:38 -05:00