| Summary: | Vulnerabilitiy warning for package C4::Biblio | ||
|---|---|---|---|
| Product: | Koha | Reporter: | Marc Véron <veron> |
| Component: | Architecture, internals, and plumbing | Assignee: | Bugs List <koha-bugs> |
| Status: | NEW --- | QA Contact: | Testopia <testopia> |
| Severity: | normal | ||
| Priority: | P5 - low | CC: | brendan, f.demians, jonathan.druart, julian.maurice, kyle, m.de.rooy |
| Version: | unspecified | ||
| Hardware: | All | ||
| OS: | All | ||
| See Also: | https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=29771 | ||
| GIT URL: | Initiative type: | --- | |
| Sponsorship status: | --- | Comma delimited list of Sponsors: | |
| Crowdfunding goal: | 0 | Patch complexity: | --- |
| Documentation contact: | Documentation submission: | ||
| Text to go in the release notes: | Version(s) released in: | ||
| Circulation function: | |||
|
Description
Marc Véron
2016-09-02 09:11:13 UTC
For these param/multi_param reports you do not (really) need Koha security. Steps to recreate? Marc, is it still valid? I guess it comes from 2623 my $ind1 = _default_ind_to_space( substr( $cgi->param($param), 0, 1 ) ); 2624 my $ind2 = _default_ind_to_space( substr( $cgi->param( $params[ $i + 1 ] ), 0, 1 ) ); (In reply to Jonathan Druart from comment #3) > Marc, is it still valid? Sorry, I have no time to test at the moment. This is not a security bug, moving out the Koha security project. |