Bugzilla – Attachment 19670 Details for
Bug 10590
in opac-topissues limit param is not protected
Home
|
New
|
Browse
|
Search
|
[?]
|
Reports
|
Help
|
New Account
|
Log In
[x]
|
Forgot Password
Login:
[x]
[patch]
[PASSED QA] Bug 10590 - in opac-topissues limit param is not protected
PASSED-QA-Bug-10590---in-opac-topissues-limit-para.patch (text/plain), 1.94 KB, created by
Katrin Fischer
on 2013-07-15 14:55:51 UTC
(
hide
)
Description:
[PASSED QA] Bug 10590 - in opac-topissues limit param is not protected
Filename:
MIME Type:
Creator:
Katrin Fischer
Created:
2013-07-15 14:55:51 UTC
Size:
1.94 KB
patch
obsolete
>From f12c70fa54b0e8b92c84db6adb59e40bd53b7064 Mon Sep 17 00:00:00 2001 >From: Fridolyn SOMERS <fridolyn.somers@biblibre.com> >Date: Mon, 15 Jul 2013 13:00:18 +0200 >Subject: [PATCH] [PASSED QA] Bug 10590 - in opac-topissues limit param is not > protected > >In opac-topissues page, the limit URL argument is directly added to SQL query. > >This patch adds protections : limit must only contain digits and must be lower than 100. > >Test plan : >- Edit URL to : /cgi-bin/koha/opac-topissues.pl?limit=10&branch=&itemtype=&timeLimit=999&do_it=1 >=> You get the results of 10 most cheched-out of all time >- Edit URL to : /cgi-bin/koha/opac-topissues.pl?limit=&branch=&itemtype=&timeLimit=999&do_it=1 >=> You get the results of 10 most cheched-out of all time >- Edit URL to : /cgi-bin/koha/opac-topissues.pl?limit=9999&branch=&itemtype=&timeLimit=999&do_it=1 >=> You get the results of 100 most cheched-out of all time >- Edit URL to : /cgi-bin/koha/opac-topissues.pl?limit=WHERE&branch=&itemtype=&timeLimit=999&do_it=1 >=> You get the results of 10 most cheched-out of all time > >Signed-off-by: Robin Sheat <robin@catalyst.net.nz> >Signed-off-by: Galen Charlton <gmc@esilibrary.com> >Signed-off-by: Jonathan Druart <jonathan.druart@biblibre.com> >Signed-off-by: Katrin Fischer <katrin.fischer@bsz-bw.de> >--- > opac/opac-topissues.pl | 4 +++- > 1 file changed, 3 insertions(+), 1 deletion(-) > >diff --git a/opac/opac-topissues.pl b/opac/opac-topissues.pl >index 38c6df0..41d7c84 100755 >--- a/opac/opac-topissues.pl >+++ b/opac/opac-topissues.pl >@@ -52,7 +52,9 @@ my ($template, $borrowernumber, $cookie) > }); > my $dbh = C4::Context->dbh; > # Displaying results >-my $limit = $input->param('limit') || 10; >+my $limit = $input->param('limit'); >+$limit = 10 unless ($limit && $limit =~ /^\d+$/); # control user input for SQL query >+$limit = 100 if $limit > 100; > my $branch = $input->param('branch') || ''; > my $itemtype = $input->param('itemtype') || ''; > my $timeLimit = $input->param('timeLimit') || 3; >-- >1.7.10.4
You cannot view the attachment while viewing its details because your browser does not support IFRAMEs.
View the attachment on a separate page
.
View Attachment As Diff
View Attachment As Raw
Actions:
View
|
Diff
|
Splinter Review
Attachments on
bug 10590
:
19646
|
19659
|
19660
|
19661
|
19662
|
19663
|
19664
|
19665
|
19666
|
19667
|
19668
|
19669
| 19670 |
19671