Koha-community/Koha
13
7
Fork 0
Code Issues Releases Wiki Activity
Main Koha release repository https://koha-community.org
28623 commits 35 branches 616 tags 1.8 GiB
Perl 45.6%
JavaScript 39.3%
HTML 7.2%
XSLT 3.7%
Vue 1.4%
Other 2.3%
Find a file
Jonathan Druart 3562816dd1 Bug 18124: Restrict CSRF token to user's session 
Currently the CSRF token generated is based on the borrowernumber, and
is valid across user's session.
We need to restrict the CSRF token to the current session.

With this patch the CSRF token is generated concatenating the id
(borrowernumber) and the CGISESSID cookie.

Test plan:
Run t/Token.t

Signed-off-by: Marcel de Rooy <m.de.rooy@rijksmuseum.nl>
Signed-off-by: Julian Maurice <julian.maurice@biblibre.com>

Signed-off-by: Kyle M Hall <kyle@bywatersolutions.com>
2017-03-30 09:07:08 +00:00
acqui Bug 18256: Koha::Items - Remove GetItemsCount 2017-03-22 19:18:15 +00:00
admin Bug 13757: Add the option to set patron attributes editable in the OPAC 2017-03-24 18:44:51 +00:00
api/v1 Bug 17927: (QA followup) Fix timestamp nullable in hold.json 2017-02-07 17:55:43 +00:00
authorities Bug 16018: Merge.pl code cleanup 2017-02-17 13:32:40 +00:00
basket Bug 17830: CSRF - Handle unicode characters in userid 2016-12-30 17:47:18 +00:00
C4 Bug 18144: Restore pieces of C4/Auth to make Google OpenID Connect work 2017-03-29 13:10:00 +00:00
catalogue Bug 18256: Koha::Items - Remove GetItemsCount 2017-03-22 19:18:15 +00:00
cataloguing Bug 17922: Use correct number of digits when replacing date placeholders 2017-02-07 17:52:56 +00:00
circ Bug 16530: Add a new method to the Branches TT Plugin to avoid c/p 2017-03-03 18:34:36 +00:00
course_reserves Bug 18264 - (QA Followup) Remove use of GetBiblioFromItemNumber Replace <blank> with (blank) 2017-03-22 19:04:43 +00:00
debian Bug 18069: Remove residue of rebuild_zebra -x 2017-03-22 21:14:31 +00:00
docs Bug 7143: [QA Follow-up] Handling tabs 2017-01-19 13:42:30 +00:00
errors Bug 15288: Error pages: Code duplication removal and better translatability 2016-01-27 05:57:34 +00:00
etc Bug 15427 : Enable TLS support for MySQL 2017-03-03 18:33:07 +00:00
installer Bug 13757 - DBRev 16.12.00.016 2017-03-24 18:49:15 +00:00
Koha Bug 18124: Restrict CSRF token to user's session 2017-03-30 09:07:08 +00:00
koha-tmpl Bug 13757: Better display for attr changes in members-update.pl 2017-03-24 18:45:17 +00:00
labels Bug 17900: Fix possible SQL injection in patron cards template editing 2017-01-30 11:19:55 +00:00
members Bug 13757: Better display for attr changes in members-update.pl 2017-03-24 18:45:17 +00:00
misc Bug 18066: Hea V2 2017-03-23 00:10:46 +00:00
offline_circ Bug 17501: Remove Koha::Upload::get from Koha::Upload 2017-01-20 14:20:05 +00:00
opac Bug 13757: (QA followup) Filter out non-editable params before storing 2017-03-24 18:45:22 +00:00
OpenILS
patron_lists Bug 16154: CGI->multi_param - Force scalar context 2016-04-26 23:16:43 +00:00
patroncards Bug 18246: Patron card creator: Unit not always displays properly in layouts 2017-03-22 20:58:10 +00:00
plugins Bug 15879: Allow multiple plugin directories to be defined in koha-conf.xml 2017-01-11 14:03:00 +00:00
reports Bug 17935: Adjust some POD lines, fix a few typos 2017-02-14 14:12:50 +00:00
reserve Bug 17941 don't compute priority more than needed 2017-03-03 16:50:27 +00:00
reviews Bug 15839: Koha::Reviews - Remove C4::Review residue 2016-09-09 10:31:00 +00:00
rotating_collections Bug 15758: Koha::Libraries - Remove GetBranches 2016-09-08 14:36:03 +00:00
serials Bug 13726: Fix for serials/acqui-search-result.pl 2016-12-30 11:54:32 +00:00
services Bug 9978: Replace license header with the correct license (GPLv3+) 2015-04-20 09:59:38 -03:00
skel
sms Bug 15258: Fix Perl scripts declaring unused variables 2015-12-30 17:24:45 -07:00
suggestion Bug 17252 - Koha::AuthorisedValues - Remove GetAuthorisedValueByCode 2016-10-21 15:35:21 +00:00
svc Revert "Bug 12461 - Add patron clubs feature" 2017-02-26 20:41:27 -05:00
t Bug 18124: Restrict CSRF token to user's session 2017-03-30 09:07:08 +00:00
tags Bug 16154: CGI->multi_param - Assign a list 2016-04-26 23:16:43 +00:00
test Bug 9819 - 'stopwords'-related code removed 2015-12-30 15:49:35 +00:00
tmp/modified_authorities
tools Bug 18312: Fix export unless a file is supplied 2017-03-29 13:11:06 +00:00
virtualshelves Bug 7663: Fix bad merge conflict with bug 15584 2017-03-03 18:18:14 +00:00
xt Bug 17469: Add missing sample notices fr-CA test 2017-01-19 13:39:10 +00:00
.editorconfig Bug 12545: Add EditorConfig.org file to the source tree 2014-08-22 11:07:45 -03:00
.htaccess Fix file permissions: if it is not a script, it should not be executable. 2010-04-16 00:40:34 -04:00
.mailmap (RM followup) .mailmap updates 2015-05-22 17:02:21 -03:00
about.pl Bug 17990: Refactor Perl module versions check 2017-02-17 12:13:44 +00:00
changelanguage.pl Bug 16776: Do not forget external language choice in language switcher 2016-08-10 13:51:33 +00:00
edithelp.pl Bug 16447: Remove occurrence of the borrow permission which does no longer exist 2016-05-05 21:28:14 +00:00
fix-perl-path.PL Bug 9978: (followup) Replace license header with the correct license (GPLv3+) 2015-04-20 09:59:43 -03:00
help.pl Bug 16724: Fix link to the online documentation links 2016-06-24 12:00:42 +00:00
INSTALL Bug 17626: Remove existing install instructions and link to the wiki pages instead 2016-11-22 11:29:07 +00:00
install-CPAN.pl Bug 9978: Replace license header with the correct license (GPLv3+) 2015-04-20 09:59:38 -03:00
Koha.pm Bug 13757 - DBRev 16.12.00.016 2017-03-24 18:49:15 +00:00
koha_perl_deps.pl Bug 17990: Refactor Perl module versions check 2017-02-17 12:13:44 +00:00
kohaversion.pl Bug 13758: Move the Koha version from kohaversion.pl 2015-05-07 11:39:04 -03:00
LICENSE
mainpage.pl Bug 14610 - Add and update scripts 2016-10-26 12:15:14 +00:00
Makefile.PL Bug 15427 : Enable TLS support for MySQL 2017-03-03 18:33:07 +00:00
MANIFEST.SKIP
README Bug 9440 - update Koha's LICENSE file from GPL2 to GPL3 2013-02-12 08:52:10 -05:00
README.md Bug 15465 [QA Followup] - Update wording, switch logo, add links 2016-02-24 04:02:26 +00:00
README.robots
rewrite-config.PL Bug 15427 : Enable TLS support for MySQL 2017-03-03 18:33:07 +00:00

README.md

Koha is a free software integrated library system (ILS).

Koha is distributed under the GNU GPL version 3 or later.

Note: This is a synced mirror of the official Koha repo.

Note: Koha does not accept pull requests from git hosting sites.

Note: This project has its own bug tracker, to report a bug or submit a patch visit http://bugs.koha-comminity.org.

For guidelines on submitting patches for Koha please visit https://wiki.koha-community.org/wiki/SubmitingAPatch

The developers handbook can be found at https://wiki.koha-community.org/wiki/Developer_handbook

http://koha-community.org/

Koha Logo