Main Koha release repository https://koha-community.org
Find a file
Janusz Kaczmarek 4b66fbc4eb
Bug 36799: Illegitimate modification of MARC authid field content (001)
It happens that librarians to save time open an authority editor by putting
in the URL, by hand, the authid prefixed, by mistake, with a blank (e.g.
.../authorities.pl?authid= 100 -- mind the space before 100).  In
such a case the editor opens with the right auth record (i.e. 100) but,
after saving the record, the content of the authid MARC field (001 for
a standard MARC 21 installation) results modified and contains
additional initial blanks.

Moreover, if the heading (1XX field) was modified in the authority record
during such an edit, the changes will not propagate to the linked
bibliographic records.  And won't in the future.

This is because in the authorities.pl script $authid is taken (and
continuously used) directly from CGI parameter, without any
validation and/or correction (line 540 in the current main branch).

Test plan:
==========
1. Open an auth record in the editor with an added space before
   authid value, e.g.:
   http://ktd:8081/cgi-bin/koha/authorities/detail.pl?authid= 100
   Modify the heading field -- in the ktd data set:
       150 Computerized typesetting
   Save the record.
2. a) Open the record for editing again--see the space added before
   the authid in field 001.  Close the editor (with Cancel).
   b) Try to go to the linked biblio records with Used in X records.
   Note no results, if using ES.
   c) Remove the space before authid (after an:) in the URL.
   Go to the linked biblio records.  See that the content of
   the field controlled by the modified auth record did not
   update.
3. Apply the patch; restart_all.
4. Repeat p. 1 and 2 with a different authid.  Everything should
   be OK now.

Sponsored-by: Ignatianum University in Cracow
Signed-off-by: Roman Dolny <roman.dolny@jezuici.pl>
Signed-off-by: Nick Clemens <nick@bywatersolutions.com>
Signed-off-by: Katrin Fischer <katrin.fischer@bsz-bw.de>
2024-05-13 10:36:10 +02:00
acqui Bug 35927: Selecting MARC framework again doesn't work when adding to basket from an external source 2024-05-10 17:46:16 +02:00
admin Bug 33737: (QA follow-up) Add missing column configuration 2024-05-10 17:46:14 +02:00
api Bug 36018: biblio->active_orders should be ->uncancelled_orders 2024-05-10 16:45:46 +02:00
authorities Bug 36799: Illegitimate modification of MARC authid field content (001) 2024-05-13 10:36:10 +02:00
basket Bug 34478: Add 'op' to sendbasketform 2024-03-01 10:58:53 +01:00
bin
bookings Bug 35574: Bookings tab from biblio details should only require manage_bookings permission 2023-12-18 15:21:04 +01:00
C4 Bug 36335: Fix ILS-DI GetRecords bad encoding for UNIMARC 2024-05-10 17:46:15 +02:00
catalogue Bug 35994: Show acq_status on catalogue/detail 2024-05-10 16:45:54 +02:00
cataloguing Bug 36786: (Bug 31791 follow-up) Koha explodes when trying to edit a biblio with invalid biblionumber 2024-05-08 18:23:43 +02:00
circ Bug 34972: (QA follow-up) Remove some ModReserveCancelAll imports 2024-05-07 15:53:43 +02:00
clubs Bug 34478: Manual fix - add op clubs/templates-add-modify 2024-03-01 10:57:55 +01:00
course_reserves Bug 34478: Manual fix - Course reserves 2024-03-01 10:56:56 +01:00
debian Bug 35812: Fix search URL aliases in Plack Apache config 2024-05-10 14:11:55 +02:00
docs Update docs/contributors.yaml 2024-05-02 16:47:37 +02:00
erm Bug 32922: Remove space in shebang 2023-02-20 09:44:06 -03:00
errors Bug 36148: Improve error handling and restore programming errors 2024-03-01 11:01:06 +01:00
etc Bug 34041: (follow-up) escape double dashes to prevent issues 2024-05-10 17:46:12 +02:00
ill Bug 35106: CSRF fix 2024-04-29 18:53:09 +02:00
installer Bug 35149: DBRev 23.12.00.056 2024-05-13 10:36:09 +02:00
Koha Bug 34788: (follow-up): Fix translations 2024-05-10 17:46:15 +02:00
koha-tmpl Bug 35149: Add Option to ignore submit of checkout field when empty 2024-05-13 10:36:08 +02:00
labels Bug 36511: Some scripts missing a dependency following Bug 24879 2024-04-10 09:09:50 +02:00
lib Bug 35681: Use ::Bootstrap version of FromANSI 2024-05-02 16:47:39 +02:00
members Bug 33849: Do not reset new patrons home library when error occurs 2024-05-13 10:36:09 +02:00
misc Bug 33418: Add overlay_framework option to connexion scripts 2024-05-10 16:45:50 +02:00
offline_circ Bug 34478: Changes for offline_circ 2024-03-01 10:58:34 +01:00
opac Bug 19768: Add "Title notes" tab to OpacSerialDefaultTab preference 2024-05-08 20:04:09 +02:00
patron_lists Bug 34478: Changes for patron_lists/add-modify 2024-03-01 10:57:41 +01:00
patroncards Bug 34478: (follow-up) patroncards: FIXMEs for op and missing script 2024-03-01 11:00:00 +01:00
plugins Bug 30897: Add option to disable automated restart 2024-04-11 16:53:42 +02:00
pos Bug 33478: Apply formatting to RECEIPT 2024-04-26 20:15:44 +02:00
preservation Bug 34030: Add a "print slips" action links to print in batch 2023-10-23 11:33:55 -03:00
recalls Bug 33478: Apply formatting to RECALL_REQUESTER_DET 2024-04-26 20:15:45 +02:00
reports Bug 36380: Add filter value on patron statistics report summary 2024-05-10 15:19:11 +02:00
reserve Bug 30579: Disentangle multi-hold and single bib forms 2024-05-07 15:53:57 +02:00
reviews Bug 34478: op =~ ^cud- in pl/pm 2024-03-01 10:56:11 +01:00
rotating_collections Bug 34478: Manual fix - add op - rotating_collections/addItems 2024-03-01 10:57:33 +01:00
serials Bug 26567: Allow to limit subscription search to subscriptions with routing lists 2024-05-10 16:45:44 +02:00
services Bug 17600: Standardize our EXPORT_OK 2021-07-16 08:58:47 +02:00
skel
suggestion Bug 34963: Restore the ability to blank fields when editing a suggestion 2024-04-19 18:06:36 +02:00
svc Bug 33418: Add overlay_framework option to connexion scripts 2024-05-10 16:45:50 +02:00
t Bug 35994: (QA follow-up) Fix Biblio.t 2024-05-10 16:45:54 +02:00
tags Bug 34478: Add 'op' to tags/review 2024-03-01 10:58:25 +01:00
tools Bug 36526: Remove circular dependency from Koha::Objects 2024-05-03 16:02:44 +02:00
virtualshelves Bug 34478: Correct op name for list edit confirmation 2024-03-01 11:00:09 +01:00
xt Bug 36374: flag JS files to keep tidy 2024-04-29 15:19:33 +02:00
.editorconfig Bug 27375: Set YAML file settings in .editorconfig 2021-11-03 15:40:52 +01:00
.eslintrc.json Bug 36400: Centralize {js,ts,vue} formatting config in .prettierrc.js 2024-04-22 08:57:39 +02:00
.gitignore Bug 36546: (QA follow-up) Add bundle spec to .gitignore 2024-04-30 15:55:37 -03:00
.htaccess Fix file permissions: if it is not a script, it should not be executable. 2010-04-16 00:40:34 -04:00
.mailmap 23.11.00: Update mailmap 2023-11-30 14:58:47 -03:00
.perlcriticrc
.perltidyrc Bug 30002: Adjust perltidy 2023-06-08 08:32:42 -03:00
.prettierrc.js Bug 36400: (follow-up) remove option editorconfig from .prettierrc.js 2024-04-22 08:57:40 +02:00
.proverc.dist Bug 19821: Install sample data, ES mappings and Version syspref 2021-10-25 11:27:40 +02:00
.stylelintrc.json Bug 31528: (follow-up) A few additional rules 2022-10-03 08:23:15 -03:00
about.pl Bug 32693: About script: Process only the tab being queried 2024-04-22 12:39:24 +02:00
app.psgi Bug 20582: Fix PSGI file when behind a reverse proxy 2020-10-06 12:00:04 +02:00
build-resources.PL Bug 32609: Use the current yarn.lock to generate node_modules 2023-02-10 11:07:57 -03:00
changelanguage.pl Bug 25898: Prohibit indirect object notation 2020-10-15 12:56:30 +02:00
cpanfile Bug 25159: Add ability to specify a pre-modified version of action log data and store as diff 2024-05-02 16:47:42 +02:00
cypress.config.ts Bug 36012: Extend cypress's requestTimeout value 2024-03-22 15:07:36 +01:00
fix-perl-path.PL Bug 28606: Remove $DEBUG and $ENV{DEBUG} 2021-06-24 11:53:44 +02:00
gulpfile.js Bug 36730: (Bug 35428 follow-up) po files (sometimes) fail to update 2024-05-07 15:53:44 +02:00
help.pl Bug 17600: Standardize our EXPORT_OK 2021-07-16 08:58:47 +02:00
INSTALL Bug 26617: Update INSTALL file to include koha-testing-docker and Gitlab links 2020-10-15 12:56:30 +02:00
Koha.pm Bug 35149: DBRev 23.12.00.056 2024-05-13 10:36:09 +02:00
kohaversion.pl Bug 26384: Fix executable flags 2020-09-11 09:56:56 +02:00
LICENSE
mainpage.pl Bug 34478: Remove generate_csrf from pl 2024-03-01 10:55:56 +01:00
Makefile.PL Bug 36546: Deploy swagger_bundle.json via make 2024-04-30 14:32:10 +02:00
MANIFEST.SKIP Bug 9546 : Updating make manifest tardist 2013-02-06 23:54:46 -05:00
package.json Bug 36546: Deploy swagger_bundle.json via make 2024-04-30 14:32:10 +02:00
README Bug 9440 - update Koha's LICENSE file from GPL2 to GPL3 2013-02-12 08:52:10 -05:00
README.md
README.robots Bug 6411 add another example to README.robots 2011-07-05 14:48:05 +12:00
rewrite-config.PL
tsconfig.json Bug 32030: Move cypress to t - fix build_js/watch_js 2022-11-08 09:44:52 -03:00
webpack.config.js Bug 35919: Add record sources admin page 2024-04-26 17:06:04 +02:00
yarn.lock Bug 36546: Fix js-yaml dependency in package.json 2024-04-30 14:32:09 +02:00

Koha is a free software integrated library system (ILS).

Koha is distributed under the GNU GPL version 3 or later.

Note: Koha does not accept pull requests from git hosting sites.

Note: This project has its own bug tracker, to report a bug or submit a patch visit http://bugs.koha-community.org.

For guidelines on submitting patches for Koha please visit https://wiki.koha-community.org/wiki/SubmitingAPatch

The developers handbook can be found at https://wiki.koha-community.org/wiki/Developer_handbook

http://koha-community.org/

Koha Logo