| Summary: | Write API to Allow instant use of reports library | ||
|---|---|---|---|
| Product: | Koha | Reporter: | Lisette Scheer <lisette> |
| Component: | Reports | Assignee: | Galen Charlton <gmcharlt> |
| Status: | RESOLVED DUPLICATE | QA Contact: | Testopia <testopia> |
| Severity: | enhancement | ||
| Priority: | P5 - low | CC: | chris, lisette, magnus |
| Version: | unspecified | ||
| Hardware: | All | ||
| OS: | All | ||
| See Also: | https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=17047 | ||
| GIT URL: | Initiative type: | --- | |
| Sponsorship status: | --- | Comma delimited list of Sponsors: | |
| Crowdfunding goal: | 0 | Patch complexity: | --- |
| Documentation contact: | Documentation submission: | ||
| Text to go in the release notes: | Version(s) released in: | ||
| Circulation function: | |||
|
Description
Lisette Scheer
2016-08-03 22:33:21 UTC
I think doing something with mana that biblibre is working on is a much better idea.
Running stuff directly from a wiki that anyone can edit, is a hugely insecure idea.
SELECT
biblionumber,
CONCAT('<script>alert\(\"',title,'\"\)</script>') AS Title
FROM biblio
ORDER BY biblionumber
Is a safe but annoying one, it could easily be changed to run some much more dangerous js, or dump the persons sessionid etc.
I would hope people are reading the sql they are cutting and pasting.
(In reply to Chris Cormack from comment #1) > I think doing something with mana that biblibre is working on is a much > better idea. Agreed, this sounds like a good fit for Mana - see bug 17047 Agreed that Mana does what was disscussed at that round table. I'm marking resolved duplicate. Lisette *** This bug has been marked as a duplicate of bug 17047 *** (In reply to Lisette Scheer from comment #3) > Agreed that Mana does what was disscussed at that round table. > I'm marking resolved duplicate. > Lisette > > *** This bug has been marked as a duplicate of bug 17047 *** Thx for the bug clean-up Lisette! :) |