Bug 17045 - Write API to Allow instant use of reports library
Summary: Write API to Allow instant use of reports library
Status: RESOLVED DUPLICATE of bug 17047
Alias: None
Product: Koha
Classification: Unclassified
Component: Reports (show other bugs)
Version: unspecified
Hardware: All All
: P5 - low enhancement (vote)
Assignee: Galen Charlton
QA Contact: Testopia
URL:
Keywords:
Depends on:
Blocks:
 
Reported: 2016-08-03 22:33 UTC by Lisette Scheer
Modified: 2019-02-21 19:01 UTC (History)
4 users (show)

See Also:
Change sponsored?: ---
Patch complexity: ---
Documentation contact:
Documentation submission:
Text to go in the release notes:
Version(s) released in:


Attachments

Note You need to log in before you can comment on or make changes to this bug.
Description Lisette Scheer 2016-08-03 22:33:21 UTC
Write an API that would allow us to select and run reports directly from the Koha Community Reports Library, as discussed at Koha US Conference 2016 during the reports Round table.
Comment 1 Chris Cormack 2016-08-03 23:57:32 UTC
I think doing something with mana that biblibre is working on is a much better idea.

Running stuff directly from a wiki that anyone can edit, is a hugely insecure idea. 
SELECT
  biblionumber, 
  CONCAT('<script>alert\(\"',title,'\"\)</script>') AS Title 
FROM biblio 
ORDER BY biblionumber

Is a safe but annoying one, it could easily be changed to run some much more dangerous js, or dump the persons sessionid etc.

I would hope people are reading the sql they are cutting and pasting.
Comment 2 Magnus Enger 2016-08-04 07:22:42 UTC
(In reply to Chris Cormack from comment #1)
> I think doing something with mana that biblibre is working on is a much
> better idea.

Agreed, this sounds like a good fit for Mana - see bug 17047
Comment 3 Lisette Scheer 2019-02-21 18:45:23 UTC
Agreed that Mana does what was disscussed at that round table. 
I'm marking resolved duplicate.
Lisette

*** This bug has been marked as a duplicate of bug 17047 ***
Comment 4 Katrin Fischer 2019-02-21 19:01:40 UTC
(In reply to Lisette Scheer from comment #3)
> Agreed that Mana does what was disscussed at that round table. 
> I'm marking resolved duplicate.
> Lisette
> 
> *** This bug has been marked as a duplicate of bug 17047 ***

Thx for the bug clean-up Lisette! :)