Bug 40007

Summary: In the Budget section under Acquisition Module - the END DATE must be greater than the START DATE.
Product: Koha Reporter: Nagappa Bakkannanavar <nagappa.b>
Component: AcquisitionsAssignee: Bugs List <koha-bugs>
Status: NEW --- QA Contact: Testopia <testopia>
Severity: critical    
Priority: P5 - low CC: amar, bikashkumars34, dcook, didier.gautheron, fridolin.somers, jonathan.druart, katrin.fischer, laurent.ducos, lisette, lucas, m.de.rooy, martin.renvoize, nick, phil, philippe.blouin, siddhantswarupmallick, tomascohen
Version: unspecified   
Hardware: All   
OS: Linux   
GIT URL: Initiative type: ---
Sponsorship status: --- Crowdfunding goal: 0
Patch complexity: --- Documentation contact:
Documentation submission: Text to go in the release notes:
Version(s) released in:
Circulation function:

Description Nagappa Bakkannanavar 2025-05-28 07:44:20 UTC
In Acquisition Module, When new Budget is created, the END DATE must be greater than the START DATE. However, application is accepting END DATE which is smaller than START DATE. As a result, at the server backend, the validation is not happening making a way for manipulating the budget and suspicious act that leads to security violation.

Therefore, request you to help us in fixing the issue by setting / writing code guidelines, which allows the user to select / enter START DATE that is SMALLER END DATE.
Comment 1 David Cook 2025-05-29 01:38:58 UTC
Can you explain a bit more why you see this as a security bug rather than a regular bug?
Comment 2 David Cook 2025-10-29 01:40:11 UTC
Changing this to a normal bug since there's no indication how it's a security bug