Summary: | Write API to Allow instant use of reports library | ||
---|---|---|---|
Product: | Koha | Reporter: | Lisette Scheer <lisettepalouse+koha> |
Component: | Reports | Assignee: | Galen Charlton <gmcharlt> |
Status: | RESOLVED DUPLICATE | QA Contact: | Testopia <testopia> |
Severity: | enhancement | ||
Priority: | P5 - low | CC: | chris, lisettepalouse+koha, magnus |
Version: | unspecified | ||
Hardware: | All | ||
OS: | All | ||
See Also: | https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=17047 | ||
Change sponsored?: | --- | Patch complexity: | --- |
Documentation contact: | Documentation submission: | ||
Text to go in the release notes: | Version(s) released in: | ||
Circulation function: |
Description
Lisette Scheer
2016-08-03 22:33:21 UTC
I think doing something with mana that biblibre is working on is a much better idea. Running stuff directly from a wiki that anyone can edit, is a hugely insecure idea. SELECT biblionumber, CONCAT('<script>alert\(\"',title,'\"\)</script>') AS Title FROM biblio ORDER BY biblionumber Is a safe but annoying one, it could easily be changed to run some much more dangerous js, or dump the persons sessionid etc. I would hope people are reading the sql they are cutting and pasting. (In reply to Chris Cormack from comment #1) > I think doing something with mana that biblibre is working on is a much > better idea. Agreed, this sounds like a good fit for Mana - see bug 17047 Agreed that Mana does what was disscussed at that round table. I'm marking resolved duplicate. Lisette *** This bug has been marked as a duplicate of bug 17047 *** (In reply to Lisette Scheer from comment #3) > Agreed that Mana does what was disscussed at that round table. > I'm marking resolved duplicate. > Lisette > > *** This bug has been marked as a duplicate of bug 17047 *** Thx for the bug clean-up Lisette! :) |