Main Koha release repository
https://koha-community.org
Jonathan Druart
779fa7c6da
If an attacker can get an authenticated Koha user to visit their page with the code below, they can update the victim's details to arbitrary values. Test plan: Trigger /cgi-bin/koha/opac-memberentry.pl?action=update&borrower_B_city=HACKED&borrower_firstname=KOHA&borrower_surname=test => Without this patch, the update will be done (or modification request) => With this patch applied you will get a crash "Wrong CSRF token" (no need to stylish) Do some regression tests with this patch applied (Update patron infos) QA note: I am not sure it's useful to create a digest of the DB pass, but just in case... Reported by Alex Middleton at Dionach. Signed-off-by: Chris Cormack <chris@bigballofwax.co.nz> Signed-off-by: Katrin Fischer <katrin.fischer.83@web.de> Signed-off-by: Kyle M Hall <kyle@bywatersolutions.com> |
||
|---|---|---|
| acqui | ||
| admin | ||
| api/v1 | ||
| authorities | ||
| basket | ||
| C4 | ||
| catalogue | ||
| cataloguing | ||
| circ | ||
| course_reserves | ||
| debian | ||
| docs | ||
| errors | ||
| etc | ||
| install_misc | ||
| installer | ||
| Koha | ||
| koha-tmpl | ||
| labels | ||
| members | ||
| misc | ||
| offline_circ | ||
| opac | ||
| OpenILS | ||
| patron_lists | ||
| patroncards | ||
| plugins | ||
| reports | ||
| reserve | ||
| reviews | ||
| rotating_collections | ||
| selenium | ||
| serials | ||
| services | ||
| skel | ||
| sms | ||
| suggestion | ||
| svc | ||
| t | ||
| tags | ||
| test | ||
| tmp/modified_authorities | ||
| tools | ||
| virtualshelves | ||
| xt | ||
| .editorconfig | ||
| .htaccess | ||
| .mailmap | ||
| about.pl | ||
| changelanguage.pl | ||
| edithelp.pl | ||
| fix-perl-path.PL | ||
| help.pl | ||
| INSTALL | ||
| install-CPAN.pl | ||
| INSTALL.debian | ||
| INSTALL.fedora7 | ||
| INSTALL.opensuse | ||
| INSTALL.ubuntu | ||
| Koha.pm | ||
| koha_perl_deps.pl | ||
| kohaversion.pl | ||
| LICENSE | ||
| mainpage.pl | ||
| Makefile.PL | ||
| MANIFEST.SKIP | ||
| README | ||
| README.md | ||
| README.robots | ||
| rewrite-config.PL | ||
Koha is a free software integrated library system (ILS).
Koha is distributed under the GNU GPL version 3 or later.
Note: This is a synced mirror of the official Koha repo.
Note: Koha does not accept pull requests from git hosting sites.
Note: This project has its own bug tracker, to report a bug or submit a patch visit http://bugs.koha-comminity.org.
For guidelines on submitting patches for Koha please visit https://wiki.koha-community.org/wiki/SubmitingAPatch
The developers handbook can be found at https://wiki.koha-community.org/wiki/Developer_handbook
