Koha-community/Koha - Koha - Koha: The world's first free and open source library system

Author	SHA1	Message	Date
Julian Maurice	96cc447045	Bug 25898: Prohibit indirect object notation Signed-off-by: Tomas Cohen Arazi <tomascohen@theke.io> Signed-off-by: Katrin Fischer <katrin.fischer.83@web.de> Signed-off-by: Jonathan Druart <jonathan.druart@bugs.koha-community.org>	3 years ago
Jonathan Druart	638786e719	Bug 24663: Remove authnotrequired if set to 0 It defaults to 0 in get_template_and_user Signed-off-by: Martin Renvoize <martin.renvoize@ptfs-europe.com> Signed-off-by: Tomas Cohen Arazi <tomascohen@theke.io> Signed-off-by: Jonathan Druart <jonathan.druart@bugs.koha-community.org>	4 years ago
Jonathan Druart	f01720808a	Bug 16593: Do not allow patrons to delete search history of others patrons A malicious user can delete the search history of all other users by correctly guessing the ID value assigned to the victim's search. As searches are assigned values sequentially, an attacker could quickly remove the searches belonging to all of the application's users. To reproduce: Login with patron A launch a search Note the id generated for this search history: select id from search_history order by id desc limit 1; Login with patron B Hit /cgi-bin/koha/opac-search-history.pl?action=delete&id=<ID> Note that the row is deleted in the DB Test plan Confirm that this patch fixes the issue. The same test can be made at the staff interface Reported by Alex Middleton at Dionach Signed-off-by: Chris Cormack <chrisc@catalyst.net.nz> Signed-off-by: Kyle M Hall <kyle@bywatersolutions.com> Signed-off-by: Kyle M Hall <kyle@bywatersolutions.com>	8 years ago
Jonathan Druart	5fd30dc5f2	Bug 15005: Remove CGI->url calls from pl scripts Same as previous patch for calls in pl scripts. Test plan: - delete an entry of your search history from intranet and opac - with IndependentBranches=OFF, go on the waiting holds and confirm that the link next to 'Holds awaiting pickup for your library on' is correct. - search for items, the pagination should work correctly Signed-off-by: Josef Moravec <josef.moravec@gmail.com> Signed-off-by: Kyle M Hall <kyle@bywatersolutions.com> Signed-off-by: Tomas Cohen Arazi <tomascohen@theke.io>	8 years ago
Jonathan Druart	56c481bc9d	Bug 11430: Intranet changes Signed-off-by: sonia BOUIS <sonia.bouis@univ-lyon3.fr> Signed-off-by: Kyle M Hall <kyle@bywatersolutions.com> Signed-off-by: Tomas Cohen Arazi <tomascohen@gmail.com>	10 years ago
Jonathan Druart	e20270fec4	Bug 11944: use CGI( -utf8 ) everywhere Signed-off-by: Paola Rossi <paola.rossi@cineca.it> Signed-off-by: Bernardo Gonzalez Kriegel <bgkriegel@gmail.com> Signed-off-by: Dobrica Pavlinusic <dpavlin@rot13.org> Signed-off-by: Martin Renvoize <martin.renvoize@ptfs-europe.com> Signed-off-by: Tomas Cohen Arazi <tomascohen@gmail.com>	10 years ago
Jonathan Druart	a6a954efa8	Bug 10862: Add search history to the intranet interface Like OPAC, the search history is now available for intranet. This is controlled by the EnableSearchHistory system preference. Test plan: 1/ Switch on the 'EnableSearchHistory' syspref. 3/ Launch some biblio and authority searches. 4/ Go on your search history page (top right, under "Set library"). 5/ Check that all yours searches are displayed. 6/ Click on some links and check that results are consistent. 7/ Delete your biblio history searches. 8/ Delete your authority searches history searches. 9/ Launch some biblio and authority searches 10/ Play with the 4 delete links (current / previous and biblio / authority). Signed-off-by: Owen Leonard <oleonard@myacpl.org> Signed-off-by: Chris Cormack <chris@bigballofwax.co.nz> Signed-off-by: Galen Charlton <gmc@esilibrary.com>	10 years ago