Bug 15197 - In Rancor, multiple &/</" characters not escaped on saving
Summary: In Rancor, multiple &/</" characters not escaped on saving
Status: CLOSED FIXED
Alias: None
Product: Koha
Classification: Unclassified
Component: Cataloging (show other bugs)
Version: Main
Hardware: All All
: P5 - low critical
Assignee: Jesse Weaver
QA Contact: Testopia
URL:
Keywords:
Depends on:
Blocks:
 
Reported: 2015-11-16 21:41 UTC by Jesse Weaver
Modified: 2019-06-27 09:24 UTC (History)
2 users (show)

See Also:
Change sponsored?: ---
Patch complexity: Trivial patch
Documentation contact:
Documentation submission:
Text to go in the release notes:
Version(s) released in:
Circulation function:

Attachments
Bug 15197: In Rancor, multiple &/</> characters not escaped on saving (943 bytes, patch)
2015-11-16 21:49 UTC, Jesse Weaver 		Details | Diff | Splinter Review
Bug 15197: In Rancor, multiple &/</" characters not escaped on saving (943 bytes, patch)
2015-11-16 21:54 UTC, Jesse Weaver 		Details | Diff | Splinter Review
Bug 15197: In Rancor, multiple &/</" characters not escaped on saving (1.16 KB, patch)
2015-11-16 21:58 UTC, Jesse Weaver 		Details | Diff | Splinter Review
[SIGNED-OFF] Bug 15197: In Rancor, multiple &/</" characters not escaped on saving (1.27 KB, patch)
2015-11-16 22:35 UTC, Bernardo Gonzalez Kriegel 		Details | Diff | Splinter Review
[PASSED QA] Bug 15197: In Rancor, multiple &/</" characters not escaped on saving (1.33 KB, patch)
2015-11-17 11:37 UTC, Katrin Fischer 		Details | Diff | Splinter Review
Show Obsolete (4) View All Add an attachment (proposed patch, testcase, etc.)

Note You need to log in before you can comment on or make changes to this bug.
Description Jesse Weaver 2015-11-16 21:41:58 UTC 
Due to a slight regex issue, multiple special characters will not be correctly escaped when saving a record, and data loss may occur.
Comment 1 Jesse Weaver 2015-11-16 21:49:12 UTC Comment hidden (obsolete)
Comment 2 Jesse Weaver 2015-11-16 21:54:10 UTC Comment hidden (obsolete)
Comment 3 Jesse Weaver 2015-11-16 21:54:52 UTC 
Test plan:

  1) On current master, create a record in Rancor containing multiple <, > or & characters ("A & B & C", for example).
  2) Try to save the record, it will silently fail.
  3) Apply this patch.
  4) The record should now save correctly.
Comment 4 Jesse Weaver 2015-11-16 21:56:44 UTC 
(In reply to Jesse Weaver from comment #3)
> Test plan:
> 
>   1) On current master, create a record in Rancor containing multiple <, >
> or & characters ("A & B & C", for example).
>   2) Try to save the record, it will silently fail.
>   3) Apply this patch.
>   4) The record should now save correctly.

Ugh, I shouldn't comment when tired. The characters in question are <, & and ".
Comment 5 Jesse Weaver 2015-11-16 21:58:35 UTC Comment hidden (obsolete)
Comment 6 Bernardo Gonzalez Kriegel 2015-11-16 22:35:15 UTC Comment hidden (obsolete)
Comment 7 Katrin Fischer 2015-11-17 11:37:20 UTC 
Created attachment 44905 [details] [review]
[PASSED QA] Bug 15197: In Rancor, multiple &/</" characters not escaped on saving

Test plan:

  1) On current master, create a record in Rancor containing multiple &, < or " characters ("A & B & C", for example).
  2) Try to save the record, it will silently fail.
  3) Apply this patch.
  4) The record should now save correctly.

Signed-off-by: Bernardo Gonzalez Kriegel <bgkriegel@gmail.com>
Works well, record saved
No errors

Signed-off-by: Katrin Fischer <katrin.fischer.83@web.de>
Comment 8 Tomás Cohen Arazi (tcohen) 2015-11-17 12:56:56 UTC 
Patch pushed to master.

Thanks Jonathan!