Bug 13127 - SQL report creation mangles HTML if using non-existent auth value
Summary: SQL report creation mangles HTML if using non-existent auth value
Status: CLOSED FIXED
Alias: None
Product: Koha
Classification: Unclassified
Component: Reports (show other bugs)
Version: unspecified
Hardware: All All
: P5 - low trivial (vote)
Assignee: Galen Charlton
QA Contact: Testopia
URL:
Keywords:
Depends on:
Blocks:
 
Reported: 2014-10-22 10:05 UTC by paxed
Modified: 2019-10-14 19:57 UTC (History)
0 users

See Also:
Change sponsored?: ---
Patch complexity: ---
Documentation contact:
Documentation submission:
Text to go in the release notes:
Version(s) released in:


Attachments

Note You need to log in before you can comment on or make changes to this bug.
Description paxed 2014-10-22 10:05:05 UTC
Create a new report from SQL, enter the following as the SQL:

select * from items where itemnumber = '<<whatever|NON_EXISTENT_AUTHVAL>>'

Save the report, and Koha complains "whatever: The authorized value category (NON_EXISTENT_AUTHVAL) you selected does not exist.", with some random garbage characters on the screen. The garbage happens because part of the page HTML looks like this:

<input type='hidden' name='sql' value='select * from items where itemnumber = '<<whatever|NON_EXISTENT_AUTHVAL>>'
' />


This is obviously wrong, the sql in there should be html encoded.
Comment 1 paxed 2018-08-27 11:10:46 UTC
Already fixed in master.