Write an API that would allow us to select and run reports directly from the Koha Community Reports Library, as discussed at Koha US Conference 2016 during the reports Round table.
I think doing something with mana that biblibre is working on is a much better idea.
Running stuff directly from a wiki that anyone can edit, is a hugely insecure idea.
CONCAT('<script>alert\(\"',title,'\"\)</script>') AS Title
ORDER BY biblionumber
Is a safe but annoying one, it could easily be changed to run some much more dangerous js, or dump the persons sessionid etc.
I would hope people are reading the sql they are cutting and pasting.
(In reply to Chris Cormack from comment #1)
> I think doing something with mana that biblibre is working on is a much
> better idea.
Agreed, this sounds like a good fit for Mana - see bug 17047
Agreed that Mana does what was disscussed at that round table.
I'm marking resolved duplicate.
*** This bug has been marked as a duplicate of bug 17047 ***
(In reply to Lisette Scheer from comment #3)
> Agreed that Mana does what was disscussed at that round table.
> I'm marking resolved duplicate.
> *** This bug has been marked as a duplicate of bug 17047 ***
Thx for the bug clean-up Lisette! :)