Bugzilla – Attachment 15999 Details for
Bug 9239
Koha should share Evergreen's QueryParser module for parsing queries
Home
|
New
|
Browse
|
Search
|
[?]
|
Reports
|
Help
|
New Account
|
Log In
[x]
|
Forgot Password
Login:
[x]
[patch]
Bug 9239 QA follow-up: escape CGI input
Bug-9239-QA-follow-up-escape-CGI-input.patch (text/plain), 6.41 KB, created by
Jared Camins-Esakov
on 2013-03-09 15:37:32 UTC
(
hide
)
Description:
Bug 9239 QA follow-up: escape CGI input
Filename:
MIME Type:
Creator:
Jared Camins-Esakov
Created:
2013-03-09 15:37:32 UTC
Size:
6.41 KB
patch
obsolete
>From f11100aed3f5d9aac099361857c0049d21ea4191 Mon Sep 17 00:00:00 2001 >From: Jared Camins-Esakov <jcamins@cpbibliography.com> >Date: Sat, 9 Mar 2013 09:59:51 -0500 >Subject: [PATCH] Bug 9239 QA follow-up: escape CGI input > >Koha was not previously escaping CGI input, which caused problems for >highlighting and is a security issue. >--- > C4/Search.pm | 37 +++++++++++++++++++++---------------- > opac/opac-search.pl | 8 +++++++- > 2 files changed, 28 insertions(+), 17 deletions(-) > >diff --git a/C4/Search.pm b/C4/Search.pm >index eeea101..525f29e 100644 >--- a/C4/Search.pm >+++ b/C4/Search.pm >@@ -1193,11 +1193,16 @@ sub parseQuery { > } > foreach my $limit (@limits) { > } >- foreach my $modifier (@sort_by) { >- $query .= " #$modifier"; >+ if (scalar (@sort_by) > 0) { >+ my $modifier_re = '#(' . join( '|', @{$QParser->modifiers}) . ')'; >+ $query =~ s/$modifier_re//g; >+ foreach my $modifier (@sort_by) { >+ $query .= " #$modifier"; >+ } > } > > $query_desc = $query; >+ $query_desc =~ s/\s+/ /g; > if ( C4::Context->preference("QueryWeightFields") ) { > } > $QParser->add_bib1_filter_map( 'biblioserver', 'su-br', { 'callback' => \&_handle_exploding_index }); >@@ -1205,9 +1210,9 @@ sub parseQuery { > $QParser->add_bib1_filter_map( 'biblioserver', 'su-rl', { 'callback' => \&_handle_exploding_index }); > $QParser->parse( $query ); > $operands[0] = "pqf=" . $QParser->target_syntax('biblioserver'); >-# TODO: once we are using QueryParser, all this special case code for >-# exploded search indexes will be replaced by a callback to >-# _handle_exploding_index >+ } else { >+ my $modifier_re = '#(' . join( '|', @{Koha::QueryParser::Driver::PQF->modifiers}) . ')'; >+ s/$modifier_re//g for @operands; > } > > return ( $operators, \@operands, $indexes, $limits, $sort_by, $scan, $lang, $query_desc); >@@ -1291,17 +1296,17 @@ sub buildQuery { > if ( @limits ) { > $q .= ' and '.join(' and ', @limits); > } >- return ( undef, $q, $q, "q=ccl=$q", $q, '', '', '', '', 'ccl' ); >+ return ( undef, $q, $q, "q=ccl=".uri_escape($q), $q, '', '', '', '', 'ccl' ); > } > if ( $query =~ /^cql=/ ) { >- return ( undef, $', $', "q=cql=$'", $', '', '', '', '', 'cql' ); >+ return ( undef, $', $', "q=cql=".uri_escape($'), $', '', '', '', '', 'cql' ); > } > if ( $query =~ /^pqf=/ ) { > if ($query_desc) { >- $query_cgi = "q=$query_desc"; >+ $query_cgi = "q=".uri_escape($query_desc); > } else { > $query_desc = $'; >- $query_cgi = "q=pqf=$'"; >+ $query_cgi = "q=pqf=".uri_escape($'); > } > return ( undef, $', $', $query_cgi, $query_desc, '', '', '', '', 'pqf' ); > } >@@ -1473,9 +1478,9 @@ sub buildQuery { > $query .= " $operators[$i-1] "; > $query .= " $index_plus " unless $indexes_set; > $query .= " $operand"; >- $query_cgi .= "&op=$operators[$i-1]"; >- $query_cgi .= "&idx=$index" if $index; >- $query_cgi .= "&q=$operands[$i]" if $operands[$i]; >+ $query_cgi .= "&op=".uri_escape($operators[$i-1]); >+ $query_cgi .= "&idx=".uri_escape($index) if $index; >+ $query_cgi .= "&q=".uri_escape($operands[$i]) if $operands[$i]; > $query_desc .= > " $operators[$i-1] $index_plus $operands[$i]"; > } >@@ -1485,8 +1490,8 @@ sub buildQuery { > $query .= " and "; > $query .= "$index_plus " unless $indexes_set; > $query .= "$operand"; >- $query_cgi .= "&op=and&idx=$index" if $index; >- $query_cgi .= "&q=$operands[$i]" if $operands[$i]; >+ $query_cgi .= "&op=and&idx=".uri_escape($index) if $index; >+ $query_cgi .= "&q=".uri_escape($operands[$i]) if $operands[$i]; > $query_desc .= " and $index_plus $operands[$i]"; > } > } >@@ -1498,8 +1503,8 @@ sub buildQuery { > $query .= " $index_plus " unless $indexes_set; > $query .= $operand; > $query_desc .= " $index_plus $operands[$i]"; >- $query_cgi .= "&idx=$index" if $index; >- $query_cgi .= "&q=$operands[$i]" if $operands[$i]; >+ $query_cgi .= "&idx=".uri_escape($index) if $index; >+ $query_cgi .= "&q=".uri_escape($operands[$i]) if $operands[$i]; > $previous_operand = 1; > } > } #/if $operands >diff --git a/opac/opac-search.pl b/opac/opac-search.pl >index 6be3333..d2ba9fc 100755 >--- a/opac/opac-search.pl >+++ b/opac/opac-search.pl >@@ -358,10 +358,12 @@ unless (@servers) { > # operators include boolean and proximity operators and are used > # to evaluate multiple operands > my @operators = $cgi->param('op'); >+@operators = map { uri_unescape($_) } @operators; > > # indexes are query qualifiers, like 'title', 'author', etc. They > # can be single or multiple parameters separated by comma: kw,right-Truncation > my @indexes = $cgi->param('idx'); >+@indexes = map { uri_unescape($_) } @indexes; > > # if a simple index (only one) display the index used in the top search box > if ($indexes[0] && !$indexes[1]) { >@@ -369,16 +371,20 @@ if ($indexes[0] && !$indexes[1]) { > } > # an operand can be a single term, a phrase, or a complete ccl query > my @operands = $cgi->param('q'); >+@operands = map { uri_unescape($_) } @operands; > > $template->{VARS}->{querystring} = join(' ', @operands); > > # if a simple search, display the value in the search box > if ($operands[0] && !$operands[1]) { >- $template->param(ms_value => $operands[0]); >+ my $ms_query = $operands[0]; >+ $ms_query =~ s/ #\S+//; >+ $template->param(ms_value => $ms_query); > } > > # limits are use to limit to results to a pre-defined category such as branch or language > my @limits = $cgi->param('limit'); >+@limits = map { uri_unescape($_) } @limits; > > if($params->{'multibranchlimit'}) { > push @limits, '('.join( " or ", map { "branch: $_ " } @{ GetBranchesInCategory( $params->{'multibranchlimit'} ) } ).')'; >-- >1.7.9.5
You cannot view the attachment while viewing its details because your browser does not support IFRAMEs.
View the attachment on a separate page
.
View Attachment As Diff
View Attachment As Raw
Actions:
View
|
Diff
|
Splinter Review
Attachments on
bug 9239
:
14020
|
14021
|
14022
|
14023
|
14172
|
14173
|
14174
|
14175
|
14180
|
14181
|
14182
|
14183
|
14847
|
14949
|
14950
|
14951
|
14952
|
14953
|
15121
|
15437
|
15865
|
15867
|
15929
|
15999
|
16004
|
16051
|
16125
|
16130
|
16131
|
16132
|
16133
|
16136
|
16140
|
16141
|
16142
|
16143
|
16144
|
16145
|
16146
|
16147
|
16148
|
16149
|
16150
|
16151
|
16152
|
16153
|
16154
|
16155
|
16180
|
16181
|
16182
|
16183
|
16184
|
16185
|
16186
|
16187
|
16188
|
16189
|
16190
|
16191
|
16192
|
16193
|
16194
|
16195