Bug 40007 - In the Budget section under Acquisition Module - the END DATE must be greater than the START DATE.
Summary: In the Budget section under Acquisition Module - the END DATE must be greater...
Status: NEW
Alias: None
Product: Koha
Classification: Unclassified
Component: Acquisitions (show other bugs)
Version: unspecified
Hardware: All Linux
: P5 - low critical
Assignee: Bugs List
QA Contact: Testopia
URL:
Keywords:
Depends on:
Blocks:
 
Reported: 2025-05-28 07:44 UTC by Nagappa Bakkannanavar
Modified: 2025-10-29 01:40 UTC (History)
17 users (show)

See Also:
GIT URL:
Initiative type: ---
Sponsorship status: ---
Crowdfunding goal: 0
Patch complexity: ---
Documentation contact:
Documentation submission:
Text to go in the release notes:
Version(s) released in:
Circulation function:


Attachments

Note You need to log in before you can comment on or make changes to this bug.
Description Nagappa Bakkannanavar 2025-05-28 07:44:20 UTC
In Acquisition Module, When new Budget is created, the END DATE must be greater than the START DATE. However, application is accepting END DATE which is smaller than START DATE. As a result, at the server backend, the validation is not happening making a way for manipulating the budget and suspicious act that leads to security violation.

Therefore, request you to help us in fixing the issue by setting / writing code guidelines, which allows the user to select / enter START DATE that is SMALLER END DATE.
Comment 1 David Cook 2025-05-29 01:38:58 UTC
Can you explain a bit more why you see this as a security bug rather than a regular bug?
Comment 2 David Cook 2025-10-29 01:40:11 UTC
Changing this to a normal bug since there's no indication how it's a security bug