openfifth/Koha
4
0
Fork 0
forked from Koha-community/Koha
Code Issues Pull requests Activity Actions
Koha is a free software integrated library system (ILS). Koha is distributed under the GNU GPL version 3 or later. ***Note: this is a synced mirror of the official Koha repo. Note: This project uses its own bug tracker, see https://bugs.koha-community.org/ to report a bug or submit a patch.
61,719 commits 47 branches 703 tags 1.7 GiB
  • Perl 43.6%
  • JavaScript 41.8%
  • HTML 5.8%
  • XSLT 3.1%
  • Vue 1.8%
  • Other 3.4%
Find a file
Exact
David Cook 18dad35de4
 Bug 42361: Fix SQL injection in catalogue_out.pl 
This change removes an SQL injection vulnerability from catalogue_out.pl

Test plan:
0. Apply the patch
1. Go to koha-conf.xml and change the following:
<strict_sql_modes>1</strict_sql_modes>
to:
<strict_sql_modes>0</strict_sql_modes>
2. sudo koha-plack --restart kohadev
3. Go to /cgi-bin/koha/reports/catalogue_out.pl
4. Try out the various options and note no errors occur

Signed-off-by: Sanjar Tulkinov Anvar o'g'li <sanjarbiy11@gmail.com>

Signed-off-by: Jonathan Druart <jonathan.druart@bugs.koha-community.org>
Signed-off-by: Pedro Amorim <pedro.amorim@openfifth.co.uk>
2026-06-09 14:08:08 +00:00
.github/workflows Bug 40027: Use GitHub workflow to automatically close PRs opened on the Koha repo there 2025-10-06 09:15:26 -06:00
acqui Bug 42764: Fix spelling errors across the codebase 2026-06-03 16:09:04 +00:00
admin Bug 42764: Fix spelling errors across the codebase 2026-06-03 16:09:04 +00:00
api Bug 37762: (RM follow-up) Fix swagger defs 2026-05-08 12:25:53 -06:00
authorities Bug 21453: Copy data to the correct subfields when linking authorities with authorities 2026-04-23 09:24:58 -06:00
basket Bug 40163: Fix several http addresses in the code docs 2025-09-23 16:21:29 -06:00
bin Bug 40163: (follow-up) Fix wrong GNU links and update test 2025-09-24 09:25:04 -06:00
bookings Bug 40163: Fix several http addresses in the code docs 2025-09-23 16:21:29 -06:00
C4 Bug 42764: Fix false positives caused by POD letter-code formatting 2026-06-03 16:09:05 +00:00
catalogue Bug 42637: Check if biblio exists before checking if it is fast add 2026-05-18 16:05:41 -06:00
cataloguing Bug 42764: Fix spelling errors across the codebase 2026-06-03 16:09:04 +00:00
circ Bug 41940: Remove uninitialized value warnings in circulation.pl 2026-05-20 09:04:58 -06:00
clubs Bug 40163: Fix several http addresses in the code docs 2025-09-23 16:21:29 -06:00
course_reserves Bug 40163: Fix several http addresses in the code docs 2025-09-23 16:21:29 -06:00
debian Bug 37762: VueJS ILL Module 2026-05-08 12:25:38 -06:00
docs Bug 42726: Add 26.11 release team 2026-06-02 15:07:16 +00:00
erm Bug 40163: Fix several http addresses in the code docs 2025-09-23 16:21:29 -06:00
errors Bug 28146: Respect ReplytoDefault in error pages 2025-10-09 14:58:41 -06:00
etc Bug 37762: VueJS ILL Module 2026-05-08 12:25:38 -06:00
ill Bug 37762: Circulation: Hook to checkouts/checkins 2026-05-08 12:25:43 -06:00
installer Bug 42802: Update kohastructure.sql 2026-06-09 14:08:07 +00:00
Koha Bug 42764: (RM Follow-up): typo fix dbic 2026-06-08 14:16:24 +00:00
koha-tmpl Bug 42555: (Bug 25314 follow-up) Destroyed labels for customized facets 2026-06-05 14:26:15 +00:00
labels Bug 42764: Fix spelling errors across the codebase 2026-06-03 16:09:04 +00:00
lib Bug 41521: Silent perlcritic warnings 2026-03-24 09:55:54 +01:00
members Bug 42764: Fix spelling errors across the codebase 2026-06-03 16:09:04 +00:00
misc Bug 42764: Fix spelling errors across the codebase 2026-06-03 16:09:04 +00:00
offline_circ Bug 40163: Fix several http addresses in the code docs 2025-09-23 16:21:29 -06:00
opac Bug 42764: Fix spelling errors across the codebase 2026-06-03 16:09:04 +00:00
patron_lists Bug 32176: Remove duplicated code to select patron from autocomplete 2025-10-31 15:26:25 -06:00
patroncards Bug 42764: Fix spelling errors across the codebase 2026-06-03 16:09:04 +00:00
plugins Bug 25952: Skip invalid repositories when searching for plugins 2025-11-21 08:41:52 -07:00
pos Bug 41705: Use PRG pattern for POS receipt printing to avoid popup blockers 2026-06-03 12:08:08 +00:00
preservation Bug 35267: Apply preferences to preview and mailing 2026-04-17 09:18:06 -06:00
recalls Bug 40163: Fix several http addresses in the code docs 2025-09-23 16:21:29 -06:00
reports Bug 42361: Fix SQL injection in catalogue_out.pl 2026-06-09 14:08:08 +00:00
reserve Bug 37762: Circulation: Hook to holds 2026-05-08 12:25:43 -06:00
reviews Bug 40163: Fix several http addresses in the code docs 2025-09-23 16:21:29 -06:00
rotating_collections Bug 40163: Fix several http addresses in the code docs 2025-09-23 16:21:29 -06:00
serials Bug 38009: Add a generate next button in serials receive page 2026-05-08 16:05:46 -06:00
services Bug 40163: Fix several http addresses in the code docs 2025-09-23 16:21:29 -06:00
sip2 Bug 37893: Fix http links 2025-11-18 11:21:20 -07:00
skel Bug 11078: Add locking to rebuild_zebra 2014-02-28 22:21:41 +00:00
suggestion Bug 42757: Use default suggestor or fallback to librarian 2026-06-05 14:26:14 +00:00
svc Bug 42084: (QA follow-up) Simplify 2026-06-03 12:08:17 +00:00
t Bug 42783: Fix ManageMarcImport_spec.ts 2026-06-08 14:16:25 +00:00
tags Bug 42254: (QA follow-up) Remove unused var, fixing a FIXME 2026-04-28 15:48:24 -06:00
tools Bug 29016: (QA follow-up) Restore biblio<->item log expansion 2026-05-05 13:42:10 -06:00
virtualshelves Bug 40916: Fix another occurance 2025-10-06 09:15:22 -06:00
xt Bug 42764: Include filename in codespell test output 2026-06-04 10:59:10 +01:00
.codespell-ignore Bug 42764: Fix false positives caused by POD letter-code formatting 2026-06-03 16:09:05 +00:00
.editorconfig Bug 27375: Set YAML file settings in .editorconfig 2021-11-03 15:40:52 +01:00
.git-blame-ignore-revs Bug 39096: Add 'tidy all' commits to a git blame ignore file 2025-02-17 13:10:25 +01:00
.gitignore Bug 26355: Add a Vue island for the self-renewal modal 2026-05-01 09:30:00 -06:00
.htaccess
.mailmap Bug 40041: (follow-up) Fix periods and add Robert Fox 2025-12-05 09:29:04 -07:00
.nvmrc Bug 42353: Store the node version in .nvmrc 2026-04-15 09:14:53 -06:00
.perlcriticrc Bug 25898: Prohibit indirect object notation 2020-10-15 12:56:30 +02:00
.perltidyrc Bug 30002: Adjust perltidy 2023-06-08 08:32:42 -03:00
.prettierrc.js Bug 38664: Treat .vue files like other JS files 2025-02-11 14:58:25 +01:00
.proverc.dist Bug 19821: Install sample data, ES mappings and Version syspref 2021-10-25 11:27:40 +02:00
.stylelintrc.json Bug 31528: (follow-up) A few additional rules 2022-10-03 08:23:15 -03:00
about.pl Bug 39789: Display the trusted proxy IP addresses and reverse proxy IP header on about page 2026-04-23 16:04:05 -06:00
app.psgi Bug 38365: Integrate CSP middleware into Plack apps 2026-03-16 11:57:12 +01:00
build-resources.PL Bug 40163: (follow-up) Fix wrong GNU links and update test 2025-09-24 09:25:04 -06:00
changelanguage.pl Bug 40163: Fix several http addresses in the code docs 2025-09-23 16:21:29 -06:00
cpanfile Bug 42317: Update minimum version for MARC::File::XML 2026-05-20 09:04:55 -06:00
cypress.config.ts Bug 41362: Allow Cypress tests to use KOHA_USER and KOHA_PASS as override 2026-01-06 07:45:35 -07:00
eslint.config.mjs Bug 38524: Enable ESLint for .ts and .vue files 2025-01-16 15:56:17 +01:00
fix-perl-path.PL Bug 40163: (follow-up) Fix wrong GNU links and update test 2025-09-24 09:25:04 -06:00
gulpfile.js Bug 42356: Silence Sass if-function deprecation warning 2026-04-17 09:18:15 -06:00
help.pl Bug 40163: Fix several http addresses in the code docs 2025-09-23 16:21:29 -06:00
INSTALL Bug 26617: Update INSTALL file to include koha-testing-docker and Gitlab links 2020-10-15 12:56:30 +02:00
Koha.pm Bug 42764: DBRev 26.06.00.001 2026-06-05 14:25:48 +00:00
kohaversion.pl Bug 38664: Tidy the whole codebase 2025-02-11 14:58:24 +01:00
LICENSE Bug 40163: Fix several http addresses in the code docs 2025-09-23 16:21:29 -06:00
mainpage.pl Bug 40163: Fix several http addresses in the code docs 2025-09-23 16:21:29 -06:00
Makefile.PL Bug 41076: Adjust our perl tidiness for v20250105 2026-02-05 09:03:51 -07:00
MANIFEST.SKIP Bug 9546 : Updating make manifest tardist 2013-02-06 23:54:46 -05:00
package.json Bug 34973: Upgrade Font Awesome in the OPAC to 7.2 2026-06-03 12:08:10 +00:00
README Bug 9440 - update Koha's LICENSE file from GPL2 to GPL3 2013-02-12 08:52:10 -05:00
README.md Bug 40163: Fix several http addresses in the code docs 2025-09-23 16:21:29 -06:00
README.robots Bug 6411 add another example to README.robots 2011-07-05 14:48:05 +12:00
rewrite-config.PL Bug 40163: (follow-up) Fix wrong GNU links and update test 2025-09-24 09:25:04 -06:00
rspack.config.js Bug 37762: VueJS ILL Module 2026-05-08 12:25:38 -06:00
SECURITY.md Bug 40527: Initial draft of SECURITY.md 2025-10-09 14:58:41 -06:00
tsconfig.json Bug 32030: Move cypress to t - fix build_js/watch_js 2022-11-08 09:44:52 -03:00
yarn.lock Bug 34973: Update yarn.lock 2026-06-03 12:08:14 +00:00

README.md

Koha is a free software integrated library system (ILS).

Koha is distributed under the GNU GPL version 3 or later.

Note: Koha does not accept pull requests from git hosting sites.

Note: This project has its own bug tracker, to report a bug or submit a patch visit https://bugs.koha-community.org.

For guidelines on submitting patches for Koha please visit https://wiki.koha-community.org/wiki/SubmitingAPatch

The developers handbook can be found at https://wiki.koha-community.org/wiki/Developer_handbook

https://koha-community.org/

Koha Logo