Bug 17045

Summary: Write API to Allow instant use of reports library
Product: Koha Reporter: Lisette Scheer <lisettepalouse+koha>
Component: ReportsAssignee: Galen Charlton <gmcharlt>
Status: RESOLVED DUPLICATE QA Contact: Testopia <testopia>
Severity: enhancement    
Priority: P5 - low CC: chris, katrin.fischer, lisettepalouse+koha, magnus
Version: unspecified   
Hardware: All   
OS: All   
See Also: https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=17047
Change sponsored?: --- Patch complexity: ---
Documentation contact: Documentation submission:
Text to go in the release notes:
Version(s) released in:

Description Lisette Scheer 2016-08-03 22:33:21 UTC
Write an API that would allow us to select and run reports directly from the Koha Community Reports Library, as discussed at Koha US Conference 2016 during the reports Round table.
Comment 1 Chris Cormack 2016-08-03 23:57:32 UTC
I think doing something with mana that biblibre is working on is a much better idea.

Running stuff directly from a wiki that anyone can edit, is a hugely insecure idea. 
SELECT
  biblionumber, 
  CONCAT('<script>alert\(\"',title,'\"\)</script>') AS Title 
FROM biblio 
ORDER BY biblionumber

Is a safe but annoying one, it could easily be changed to run some much more dangerous js, or dump the persons sessionid etc.

I would hope people are reading the sql they are cutting and pasting.
Comment 2 Magnus Enger 2016-08-04 07:22:42 UTC
(In reply to Chris Cormack from comment #1)
> I think doing something with mana that biblibre is working on is a much
> better idea.

Agreed, this sounds like a good fit for Mana - see bug 17047
Comment 3 Lisette Scheer 2019-02-21 18:45:23 UTC
Agreed that Mana does what was disscussed at that round table. 
I'm marking resolved duplicate.
Lisette

*** This bug has been marked as a duplicate of bug 17047 ***
Comment 4 Katrin Fischer 2019-02-21 19:01:40 UTC
(In reply to Lisette Scheer from comment #3)
> Agreed that Mana does what was disscussed at that round table. 
> I'm marking resolved duplicate.
> Lisette
> 
> *** This bug has been marked as a duplicate of bug 17047 ***

Thx for the bug clean-up Lisette! :)