{"push_id":554161482,"size":9,"distinct_size":9,"ref":"refs/heads/master","head":"c667b9ddbf42f9729d8f4035c7e872d5e980a5e9","before":"7a4cdb823ff28e159d6d3564533c74e70377d725","commits":[{"sha":"ef5c16009760ddcbd1c4284d3641647f8d29c071","author":{"email":"a4ed5d8b9e88a5c4401757374b1604745a5e46b6@rijksmuseum.nl","name":"Marcel de Rooy"},"message":"Bug 7143: Release team 3.20\n\nUpdated the release team with the roles for 3.20 pages on the wiki and\nchecked with the votes on the IRC meeting log.\nSimplified the section on Former release team members by moving that\ninformation (in a compressed format) to the Developers section.\nIf someone had a role for multiple releases, I used constructs as 3.X.\nSorted the Additional thanks-section.\n\nSigned-off-by: Justin <justinvos@live.com>\n\nSigned-off-by: Marcel de Rooy <m.de.rooy@rijksmuseum.nl>\n2015-01-14: Amended. Replaced abbreviations like RM by Release Manager.\nReplaced one occurrence of 3.x by 3.X (for Owen).\n\nSigned-off-by: Tomas Cohen Arazi <tomascohen@gmail.com>","distinct":true,"url":"https://api.github.com/repos/colinsc/koha/commits/ef5c16009760ddcbd1c4284d3641647f8d29c071"},{"sha":"5c8c53b6dcec760dd039b6501c0251d763b76470","author":{"email":"a4ed5d8b9e88a5c4401757374b1604745a5e46b6@rijksmuseum.nl","name":"Marcel de Rooy"},"message":"Bug 7143: QA Follow-up for abbrev PM\n\nReplacing PM by Packaging Manager\n\nSigned-off-by: Marcel de Rooy <m.de.rooy@rijksmuseum.nl>\nSigned-off-by: Tomas Cohen Arazi <tomascohen@gmail.com>","distinct":true,"url":"https://api.github.com/repos/colinsc/koha/commits/5c8c53b6dcec760dd039b6501c0251d763b76470"},{"sha":"be1bb8db4efeea1c45048ca9526a3ebae8477ae0","author":{"email":"8bf4de7d20b37969080dc26f52a336a016210a46@web.de","name":"Katrin Fischer"},"message":"Bug 7143: Adding back version numbers\n\nAdding back version numbers to the former release team members\nin the list of developers.\n\nSigned-off-by: Marcel de Rooy <m.de.rooy@rijksmuseum.nl>\nAdded prefix \"3.16\" to Galen's Release Maintainer. (See Roles for 3.18)\n\nSigned-off-by: Tomas Cohen Arazi <tomascohen@gmail.com>","distinct":true,"url":"https://api.github.com/repos/colinsc/koha/commits/be1bb8db4efeea1c45048ca9526a3ebae8477ae0"},{"sha":"b57d9af154bf6fe5d2c85262212765b0d1fe2bde","author":{"email":"873112ddc5ebe351bdd89d40c84b1e1f4a244d69@gmail.com","name":"Thomas"},"message":"Bug 13583 - Able to view menu for Statistics even when user does not have permission\n\nAdded check for borrowers that stops the Statistics link being shown. This could be done through the css but that function currently appears to be broke\n\nTesting Plan:\n\n-Search for a patron with an account that does not have the 'borrowers' permission\n*Statistics should not be seen in the menu.\n\n-Change the accounts permissions so they have the 'borrowers' permission\n*Statistics should be present in the menu.\n\nSigned-off-by: Katrin Fischer <Katrin.Fischer.83@web.de>\nWorks as described.\n\nSigned-off-by: Tomas Cohen Arazi <tomascohen@gmail.com>","distinct":true,"url":"https://api.github.com/repos/colinsc/koha/commits/b57d9af154bf6fe5d2c85262212765b0d1fe2bde"},{"sha":"ba02e09e6d129718c7e4aafb8d92f488ae1e1f39","author":{"email":"90effa772b5c8a7a3420e6b7ea56e265888c5743@biblibre.com","name":"Jonathan Druart"},"message":"Bug 13583: (follow-up) Able to view menu for Statistics even when user does not have permission\n\nSame changes as the previous patch, for the .tt file.\n\nSigned-off-by: Tomas Cohen Arazi <tomascohen@gmail.com>","distinct":true,"url":"https://api.github.com/repos/colinsc/koha/commits/ba02e09e6d129718c7e4aafb8d92f488ae1e1f39"},{"sha":"312bf659565766ac57e68155cbeaa08f316be83c","author":{"email":"90effa772b5c8a7a3420e6b7ea56e265888c5743@biblibre.com","name":"Jonathan Druart"},"message":"Bug 12637: UTF-8 problems when creating a patron list\n\nEncoding problems appear when creating a patron list from the patron search results page.\n\nTest plan:\n1. Perform a patron search in the patrons module\n2. Select one or more patrons\n3. Choose \"Add selected patrons to: [ New list ]\"\n4. Enter a patron list title with UTF-8 characters.\n5. The list will be created with bad encoding.\n6. Apply the patch and verify there is no bad encoding anymore.\n\nSigned-off-by: Owen Leonard <oleonard@myacpl.org>\n\nSigned-off-by: Marcel de Rooy <m.de.rooy@rijksmuseum.nl>\nPatch works fine.\nNote that I - very ironically - had to remove UTF8 characters from the commit\nmessage to apply and attach the patches with git/git-bz.\nHopefully, an upgrade to a newer git version will resolve that too.\n\nSigned-off-by: Tomas Cohen Arazi <tomascohen@gmail.com>","distinct":true,"url":"https://api.github.com/repos/colinsc/koha/commits/312bf659565766ac57e68155cbeaa08f316be83c"},{"sha":"52fe1238915bf88fbb5f048029b67250e59409a0","author":{"email":"c399d7bb1458750875a0eab93ccb0d89287091a7@gmail.com","name":"Liz"},"message":"Bug 13510 - Cross site scripting bug in opac-downloadshelf and opac-shelves\n\nA specially crafted url causes XSS in Koha\n\nTo test:\n\ncgi-bin/koha/opac-shelves.pl?viewshelf=2%22%3E%3Cscript%3Eprompt(987898)%3C/script%3E\n\ncgi-bin/koha/opac-downloadshelf.pl?shelfid=2%22%3Cscript%3Eprompt(1)%3C/script%3E&showprivateshelves\n\nThese should cause a popup without the patch. With the patch, no popup.\n\nYou may need to create these lists, the xss will not be triggered if the list doesn't exist or you don't\nhave permission to view them.\n\nSigned-off-by: Chris <chris@bigballofwax.co.nz>\n\nFixes the two listed problems\n\nSigned-off-by: Katrin Fischer <katrin.fischer@bsz-bw.de>\nConfirmed patch fixes the problem.\n\nSigned-off-by: Martin Renvoize <martin.renvoize@ptfs-europe.com>\nSigned-off-by: Tomas Cohen Arazi <tomascohen@gmail.com>","distinct":true,"url":"https://api.github.com/repos/colinsc/koha/commits/52fe1238915bf88fbb5f048029b67250e59409a0"},{"sha":"da6ee1c469c63f6d28dd1302032a19596eb7cd57","author":{"email":"711c73f64afdce07b7e38039a96d2224209e9a6c@bigballofwax.co.nz","name":"Chris"},"message":"Bug 13510 : Fixing the third XSS issue\n\nTo test\n\n1/ Make sure you have some items in your database, that have values in items.issue\nIf nessecary do something like\n\nUPDATE items SET issues = 10 WHERE itemnumber=somenumber\n\n2/ Hit a url like http://localhost:8080/cgi-bin/koha/opac-topissues.pl?do_it=1&timeLimit=3%3Cscript%3Eprompt%28924513%29%3C/script%3E\n\n3/ Notice you will get a prompt\n4/ Apply patch\n5/ Test again\n\nSigned-off-by: Katrin Fischer <katrin.fischer@bsz-bw.de>\nSigned-off-by: Martin Renvoize <martin.renvoize@ptfs-europe.com>\nSigned-off-by: Tomas Cohen Arazi <tomascohen@gmail.com>","distinct":true,"url":"https://api.github.com/repos/colinsc/koha/commits/da6ee1c469c63f6d28dd1302032a19596eb7cd57"},{"sha":"c667b9ddbf42f9729d8f4035c7e872d5e980a5e9","author":{"email":"eb5a7ed6178886f9a3c70794f3de5f89db9dcb5f@bsz-bw.de","name":"Katrin Fischer"},"message":"Bug 13609: Cross Site Scripting problem in authority search result list paging\n\nTo test:\n- Use an installation a reasonable amount of authorities, so that you can\n  have a search result list with more than one page\n- Activate OpacAuthorities\n- Create an OPAC link like shown below, verify that an alert is shown\n- Apply patch\n- Refresh the page and no alert should appear\n- Verify the paging still works correctly for 'numbers' and 'arrows'\n\nURL:\n.../cgi-bin/koha/opac-authorities-home.pl?and_or=and&marclist=match&op=do_search&operator=contains&orderby=HeadingAsc2\"><script>prompt(987898)</script>\n\nSigned-off-by: Jonathan Druart <jonathan.druart@biblibre.com>\nSigned-off-by: Tomas Cohen Arazi <tomascohen@gmail.com>\nSigned-off-by: Chris Cormack <chrisc@catalyst.net.nz>","distinct":true,"url":"https://api.github.com/repos/colinsc/koha/commits/c667b9ddbf42f9729d8f4035c7e872d5e980a5e9"}]}