From 21214eddf9b030a5bcee5609177c6049dfe7d2e7 Mon Sep 17 00:00:00 2001 From: Martin Persson Date: Wed, 5 Aug 2015 16:16:50 +0200 Subject: [PATCH] Bug 14764: OPAC news selector - URL parameter This patch adds an URL-based override for the homebranch variable in opac-main.pl. Allows viewing of arbitrary branches. Possible security issue: The user changes branch parameter to perform SQL or XSS injection. This would not be possible via the database, as the foreign key constraint would block arbitrary code. However, the News retrieval function is using prepared statements which are immune to this. Changes: Parameter 'branch' renamed 'branchcode' Sponsored-By: Halland County Library --- opac/opac-main.pl | 3 +++ 1 file changed, 3 insertions(+) diff --git a/opac/opac-main.pl b/opac/opac-main.pl index b0904c5..657a1c8 100755 --- a/opac/opac-main.pl +++ b/opac/opac-main.pl @@ -51,6 +51,9 @@ my $homebranch; if (C4::Context->userenv) { $homebranch = C4::Context->userenv->{'branch'}; } +if (defined $input->param('branchcode')) { + $homebranch = $input->param('branchcode'); +} my $all_koha_news = &GetNewsToDisplay($news_lang,$homebranch); my $koha_news_count = scalar @$all_koha_news; -- 2.1.4