Galen Charlton 94e349ff6c Bug 11666: remove SQL as an option for MARC framework exports and imports ... The SQL option for MARC framework imports was subject to a bug whereby somebody could use it to gain access to arbitrary information in the database by uploading an SQL file containing unexpected statements. As it is difficult to securely sanitize SQL, this patch removes the option to use SQL as an import or export format. To test: [1] Verify that SQL no longer appears as an import or export option for the MARC frameworks. [2] Verify that exports and imports in CSV, Excel XML, and ODS formats still work. Signed-off-by: Galen Charlton <gmc@esilibrary.com> Signed-off-by: Tomas Cohen Arazi <tomascohen@gmail.com> Works as advertised. The UI doesn't offer exporting/importing in the SQL format. Crafting the URL to export SQL fallbacks to a spreadsheet format (ODS). Signed-off-by: Katrin Fischer <Katrin.Fischer.83@web.de> Works as described, passes all tests and QA script. Signed-off-by: Galen Charlton <gmc@esilibrary.com>		2014-02-05 19:48:27 +00:00
..
AuthoritiesMarc
Barcodes	Bug 11539: removing 2 unused files	2014-01-14 20:55:28 +00:00
ClassSortRoutine	Bug 9770: fix sorting of Dewey call numbers that contain prefixes	2013-07-15 16:12:47 +00:00
Creators	Bug 10763 - [SIGNED-OFF] Update POD of C4::Creators::Lib::html_table() to use TT syntax	2013-08-20 14:31:34 +00:00
External	Bug 10320: (follow-up) correct license statement	2013-09-08 07:04:45 +00:00
Form
Heading
ILSDI	Bug 9823: Refactor return from GetReservesFromBiblionumber	2014-01-30 16:19:55 +00:00
Installer	Bug 11124: QA Follow-up adding optional dependency HTTPD::Bench::ApacheBench	2013-12-13 19:49:18 +00:00
Labels	Bug 11402: make Labels::_guide_box return undef if undefned data is passed	2013-12-30 16:17:35 +00:00
Linker
Members	Bug 7919: Fix unit test (Members_AttributeTypes.t)	2012-12-07 18:26:37 -05:00
OAI	Bug 9295: Introduce operator equal/ notequal to OAI set mapping instead of hardcoded 'equal' value.	2013-10-10 23:03:30 +00:00
Output
Patroncards
Reports	Bug 10761: (follow-up) use explicit return in C4::Reports::Guided::delete_report()	2013-08-21 14:45:41 +00:00
Search
Serials	Bug 7688: (follow-up) update license statements	2013-10-30 02:56:32 +00:00
SIP	Bug 9823: Refactor return from GetReservesFromBiblionumber	2014-01-30 16:19:55 +00:00
Utils	Bug 11474: (follow-up) correct typos in POD	2014-01-06 05:46:32 +00:00
VirtualShelves	Bug 10853: All existing routing to get a CSV should return a MARC csv	2013-10-11 02:16:33 +00:00
Accounts.pm	Bug 2546: make description of standard fine types translatable	2013-12-05 18:44:33 +00:00
Acquisition.pm	Bug 11549: [follow-up] Make NewOrder calculate new parent_ordernumber	2014-01-23 16:19:50 +00:00
Auth.pm	Bug 10952: (follow-up) clear seach history from session after saving it to DB	2014-01-10 16:49:01 +00:00
Auth_cas_servers.yaml.orig
Auth_with_cas.pm	Bug 10927: remove disused C4::Utils module	2013-10-03 14:53:02 +00:00
Auth_with_ldap.pm	Bug 10908: restore docs on principal_name LDAP option	2013-10-21 15:28:11 +00:00
AuthoritiesMarc.pm	Bug 11533: fix authority searching with no sorting when QueryParser is enabled	2014-01-24 14:02:48 +00:00
BackgroundJob.pm	Bug 10601: (follow-up) improvements to ->set() and ->get()	2013-09-18 17:23:44 +00:00
Barcodes.pm
Biblio.pm	Bug 9823: Refactor return from GetReservesFromBiblionumber	2014-01-30 16:19:55 +00:00
Bookseller.pm	Bug 7965: Silence warns in staff log	2014-01-10 15:42:09 +00:00
Boolean.pm	Bug 10080 - Change system pref IndependantBranches to IndependentBranches	2013-05-22 07:58:23 -07:00
Branch.pm	Bug 11051: remove unneccessary SQL queries in GetBranches	2014-01-10 16:02:39 +00:00
Breeding.pm	Bug 11419: display Z39.50 search errors more completely	2013-12-27 00:25:39 +00:00
Budgets.pm	Bug 10983: Remove unused private subroutines from C4::Budgets	2013-12-13 15:14:18 +00:00
Calendar.pm
Category.pm	Bug 7919: FIX the "all" categories method	2013-01-02 16:50:52 -05:00
Charset.pm	Bug 8015: (follow-up) trap exceptions thrown by SetUTF8Flag()	2013-10-31 22:48:59 +00:00
Circulation.pm	Bug 10277 - Add C4::Context->IsSuperLibrarian()	2013-12-30 15:47:23 +00:00
ClassSortRoutine.pm
ClassSource.pm	Bug 10643: fix inappropriate uses of $sth->finish() in C4::ClassSource.pm	2013-08-09 15:32:22 +00:00
Context.pm	Bug 11389: reenable Pg as a DB scheme that Koha can connect to	2014-01-13 20:56:14 +00:00
Contract.pm
CourseReserves.pm	bug 8215: (followup) rename GetItemReservesInfo	2013-05-21 15:51:03 -07:00
Creators.pm
Csv.pm	Bug 10853: All existing routing to get a CSV should return a MARC csv	2013-10-11 02:16:33 +00:00
Dates.pm
Debug.pm
Heading.pm
HoldsQueue.pm	Bug 10243: (follow-up) prevent TransportCostMatrix from overriding library holds policy	2013-10-30 03:13:41 +00:00
HTML5Media.pm	Bug 8377: Followup move style in a css file and do not pass template to a pm	2012-12-27 09:28:00 -05:00
Images.pm	Bug 8710 - Don't show the images tab in the OPAC if the record has no local images	2012-11-28 18:54:40 -05:00
ImportBatch.pm	Bug 8015: (follow-up) trap exceptions thrown by SetUTF8Flag()	2013-10-31 22:48:59 +00:00
ImportExportFramework.pm	Bug 11666: remove SQL as an option for MARC framework exports and imports	2014-02-05 19:48:27 +00:00
Input.pm	Bug 7919 : Display of values depending on the connexion library	2012-12-05 10:10:57 -05:00
Installer.pm	Bug 10523: Remove two obsolete routines from Installer.pm	2013-10-31 16:51:47 +00:00
ItemCirculationAlertPreference.pm
Items.pm	Bug 11473 - add 'biblio' and 'item' to cataloguing logging info	2014-01-17 05:42:44 +00:00
ItemType.pm	Bug 10513: display a warning/message when returning a chosen item type	2013-09-16 17:45:31 +00:00
Koha.pm	Bug 11279: (follow-up) remove unnecessary check on number of quotes	2013-12-19 15:06:39 +00:00
Labels.pm
Languages.pm	Bug 10309 - New OPAC theme based on Bootstrap	2013-10-14 23:13:05 +00:00
Letters.pm	Bug 9788: (follow-up) for expirationdate in Letter.pm	2014-01-17 05:08:39 +00:00
Linker.pm
Log.pm	Bug 7067 - OPAC Borrower Self Registration	2012-12-14 08:08:59 -05:00
Maintainance.pm
MarcModificationTemplates.pm	Bug 8015: (follow-up) don't require userenv	2013-10-31 22:51:13 +00:00
Matcher.pm	Bug 10230: no need to use SimpleSearch for matching auths	2013-05-19 08:40:13 -04:00
Members.pm	Bug 10277 - Add C4::Context->IsSuperLibrarian()	2013-12-30 15:47:23 +00:00
Message.pm
NewsChannels.pm
Output.pm	Bug 10016: force zero browser-side caching of SCO pages	2013-10-21 18:05:12 +00:00
Overdues.pm	Bug 2720 - Overdues which debar automatically should undebar automatically when returned	2013-10-31 01:53:22 +00:00
Patroncards.pm
Print.pm
Ratings.pm
Record.pm	Bug 11066: make RIS and Bibtex exports RDA compatible	2014-01-03 15:54:38 +00:00
Reports.pm
Reserves.pm	Bug 9823: (follow-up) improve POD for C4::Reserves::GetReservesFromBiblionumber	2014-01-30 16:48:26 +00:00
Review.pm
Ris.pm	Bug 11066: make RIS and Bibtex exports RDA compatible	2014-01-03 15:54:38 +00:00
RotatingCollections.pm	Bug 11384: rename the collections_tracking.ctId column	2013-12-23 16:14:57 +00:00
Scheduler.pm
Scrubber.pm
Search.pm	Bug 11572: ensure that running Z39.50 search from staff search results detects ISBN	2014-02-04 18:16:00 +00:00
Serials.pm	Bug 10851: (follow-up) fix issues reported by QA script	2014-02-04 17:48:37 +00:00
Service.pm
ShelfBrowser.pm	Bug 10856: (follow-up) if callnumbers are equal, order should be on itemnumber	2013-10-04 15:57:03 +00:00
SMS.pm
SocialData.pm
SQLHelper.pm	Bug 11221: ensure that SQLHelper uses NULL rather than 0000-00-00 as default date value	2013-11-19 15:29:08 +00:00
Stats.pm
Suggestions.pm	Bug 10277 - Add C4::Context->IsSuperLibrarian()	2013-12-30 15:47:23 +00:00
Tags.pm	Bug 9136: C4::Tags not Plack-compatible	2012-12-22 15:47:48 -05:00
Templates.pm	Bug 7684: multiple fixes for inventory	2013-11-01 00:10:49 +00:00
TmplToken.pm
TmplTokenType.pm
TTParser.pm
UploadedFile.pm
VirtualShelves.pm	Bug 10386: improvements to VirtualShelves.t	2013-06-28 05:19:49 -07:00
XISBN.pm	Bug 9728: XISBN unit test update	2013-06-18 09:46:37 -07:00
XSLT.pm	Bug 10550: Fix database typo wthdrawn	2013-09-08 01:58:41 +00:00