Commit graph

19 commits

Author SHA1 Message Date
Julian Maurice
96cc447045 Bug 25898: Prohibit indirect object notation
Signed-off-by: Tomas Cohen Arazi <tomascohen@theke.io>

Signed-off-by: Katrin Fischer <katrin.fischer.83@web.de>

Signed-off-by: Jonathan Druart <jonathan.druart@bugs.koha-community.org>
2020-10-15 12:56:30 +02:00
638786e719 Bug 24663: Remove authnotrequired if set to 0
It defaults to 0 in get_template_and_user

Signed-off-by: Martin Renvoize <martin.renvoize@ptfs-europe.com>
Signed-off-by: Tomas Cohen Arazi <tomascohen@theke.io>

Signed-off-by: Jonathan Druart <jonathan.druart@bugs.koha-community.org>
2020-09-03 10:40:35 +02:00
Zoe Bennett
165c56de29 Bug 19999: use Modern::Perl in label scripts
Test Plan:
- Check that it now says 'use Modern::Perl;' and not 'use strict; use
warnings;' in the following labels perl scripts:

label-create-csv.pl
label-create-pdf.pl
label-create-xml.pl
label-edit-batch.pl
label-edit-layout.pl
label-edit-profile.pl
label-edit-template.pl
label-home.pl
label-item-search.pl
label-print.pl
spinelabel-home.pl
spinelabel-print.pl

Signed-off-by: Jonathan Druart <jonathan.druart@bugs.koha-community.org>
2018-02-05 09:45:48 -03:00
af845c143a Bug 18535 - Clicking 'edit printer profile' in label creator causes software error
1) Go to Tools > Label creator
2) If you don't have a printer profile defined, create one.
3) Go to manage > Printer profiles
4) Click the 'edit' button on any of the profiles.
5) INTERNAL SERVER ERROR! "Can't use string ("fields") as a HASH ref
while "strict refs" in use at /usr/share/koha/lib/C4/Creators/Lib.pm
line 147"
6) Apply patch
7) Click the 'edit' button on any of the profiles.
8) Things work as expected

Bug reproduced, is fixed by this patch
Signed-off-by: Marc Véron <veron@veron.ch>

Signed-off-by: Marcel de Rooy <m.de.rooy@rijksmuseum.nl>

Signed-off-by: Kyle M Hall <kyle@bywatersolutions.com>
2017-05-12 08:52:31 -04:00
a70980d825 Bug 17900: Fix possible SQL injection in patron cards template editing
To recreate:
/cgi-bin/koha/patroncards/edit-template.pl?op=edit&element_id=23%20and%201%3d2+union+all+select+1,user(),@@version+--%20

Look at the Profile dropdown list.

To fix this problem and to make sure it does not appears anywhere else
in the label and patroncards modules, I have refactored the way the
queries are built in C4::Creators::Lib
Now all of the subroutine takes a hashref in parameters with a 'fields'
and 'filters' parameters.
From these 2 parameters the new internal subroutine _build_query will
build the query and use placeholders.

Test plan:
1/ Make sure you do not recreate the vulnerability with this patch
applied.
2/ With decent data in the labels and patroncards modules, compare all
the different view (undef the New and Manage button groups) with and
without this patch applied.
=> You should not see any differences.

This vulnerability has been reported by MDSec.

Signed-off-by: Chris Cormack <chris@bigballofwax.co.nz>

Signed-off-by: Marcel de Rooy <m.de.rooy@rijksmuseum.nl>

Signed-off-by: Kyle M Hall <kyle@bywatersolutions.com>
2017-01-30 11:19:55 +00:00
f3e4b5bbb6 Bug 16154: CGI->multi_param - Force scalar context
This patch replaces the occurrences of
  $template->param( foo => $cgi->param('foo') );
with
  $template->param( foo => scalar $cgi->param('foo') );

perl -p -i -e 's/(\s*=>\s*)\$(cgi|input|query)\->param\(/$1scalar
\$$2\->param\(/xms' **/*.pl

Signed-off-by: Owen Leonard <oleonard@myacpl.org>
Signed-off-by: Katrin Fischer <katrin.fischer.83@web.de>

Signed-off-by: Brendan Gallagher <brendan@bywatersolutions.com>
2016-04-26 23:16:43 +00:00
Jonathan Druart
a6c9bd0eb5 Bug 9978: Replace license header with the correct license (GPLv3+)
Signed-off-by: Chris Nighswonger <cnighswonger@foundations.edu>
Signed-off-by: Tomas Cohen Arazi <tomascohen@gmail.com>
Signed-off-by: Katrin Fischer <katrin.fischer@bsz-bw.de>

http://bugs.koha-community.org/show_bug.cgi?id=9987

Signed-off-by: Kyle M Hall <kyle@bywatersolutions.com>
Signed-off-by: Tomas Cohen Arazi <tomascohen@gmail.com>
2015-04-20 09:59:38 -03:00
Jonathan Druart
e20270fec4 Bug 11944: use CGI( -utf8 ) everywhere
Signed-off-by: Paola Rossi <paola.rossi@cineca.it>
Signed-off-by: Bernardo Gonzalez Kriegel <bgkriegel@gmail.com>
Signed-off-by: Dobrica Pavlinusic <dpavlin@rot13.org>

Signed-off-by: Martin Renvoize <martin.renvoize@ptfs-europe.com>
Signed-off-by: Tomas Cohen Arazi <tomascohen@gmail.com>
2015-01-13 13:07:21 -03:00
afd2418d73 Bug 11349: Change .tmpl -> .tt in scripts using templates
Since we switched to Template Toolkit we don't need to stick with the
sufix we used for HTML::Template::Pro.

This patch changes the occurences of '.tmpl' in favour of '.tt'.

To test:
- Apply the patch
- Install koha, and verify that every page can be accesed

Regards
To+

P.S. a followup will remove the glue code.

Signed-off-by: Chris Cormack <chrisc@catalyst.net.nz>

Signed-off-by: Jonathan Druart <jonathan.druart@biblibre.com>
Signed-off-by: Tomas Cohen Arazi <tomascohen@gmail.com>
2014-07-17 11:05:49 -03:00
Dobrica Pavlinusic
130e3d9c10 Bug 8315 - remove use C4::* version
This patch touches a lot of code, but basically it removes version
information from use C4::* in our code.

Signed-off-by: Chris Cormack <chris@bigballofwax.co.nz>
Signed-off-by: Paul Poulain <paul.poulain@biblibre.com>
All script still compiles after the patch (confirmed by pre-applypatch hook)
2012-07-13 14:17:20 +02:00
Chris Nighswonger
b8d5a69e4e Bug 5203 - Creating a label template causes fatal error if description field is empty
This is due to the underlying script not having any defaults hard coded which results
in skewed hash elements when the parameter array is coerced into a hash at a later point.

This also occurs in layouts and profiles. This patch adds defaults to all three.

No documentation changes are necessary.
2010-09-23 13:52:40 -04:00
Lars Wirzenius
772ada9bf3 Fix FSF address in directory labels/
Signed-off-by: Galen Charlton <gmcharlt@gmail.com>
2010-03-16 20:17:50 -04:00
Chris Nighswonger
84d5b28f12 Bringing label, patroncard, and creator modules into conformity with the rest of C4 style.
Signed-off-by: Galen Charlton <gmcharlt@gmail.com>
2010-02-08 20:54:34 -05:00
Chris Nighswonger
4a675bcaad [5/30] A rework of Label Creator code
This rework removes code held in common with the Patron Card Creator
and move is to the new C4::Creators module.
2010-01-11 18:16:52 -05:00
dd08a539dc remove unnecesary import of HTM:::Template::pro
Signed-off-by: Galen Charlton <gmcharlt@gmail.com>
2009-09-05 21:43:12 -04:00
0bbcfeda0e replace syslog with warns
As discussed with Chris Nighswonger on #koha, this patch
removes the calls to syslog and replaces them with warns
so that error messages generated by the labels code
are sent to the Apache error log.  This avoids splitting
this sort of logging across multiple files and is consistent
with current practice in most of the rest of Koha.

Signed-off-by: Galen Charlton <gmcharlt@gmail.com>
2009-09-05 21:43:12 -04:00
Chris Nighswonger
c468a724b4 [22/40] General code cleanup of new labels module code. 2009-09-01 15:51:39 -04:00
Chris Nighswonger
0645c95a36 [13/40] Work on profile editor interface. 2009-09-01 15:49:53 -04:00
Chris Nighswonger
bc895d8626 Adding Printer Profiles feature to the Label Creator.
Signed-off-by: Chris Cormack <chris@bigballofwax.co.nz>
Signed-off-by: Joshua Ferraro <jmf@liblime.com>
2008-02-16 11:26:38 -06:00