Bug 17393 - selfreg - Patron's info are not correctly inserted if contain non-Latin characters
Summary: selfreg - Patron's info are not correctly inserted if contain non-Latin chara...
Status: CLOSED FIXED
Alias: None
Product: Koha
Classification: Unclassified
Component: OPAC (show other bugs)
Version: unspecified
Hardware: All All
: P5 - low major (vote)
Assignee: Jonathan Druart
QA Contact: Testopia
URL:
Keywords:
Depends on:
Blocks:
 
Reported: 2016-10-04 07:24 UTC by Jonathan Druart
Modified: 2019-06-27 09:24 UTC (History)
4 users (show)

See Also:
Change sponsored?: ---
Patch complexity: ---
Documentation contact:
Documentation submission:
Text to go in the release notes:
Version(s) released in:


Attachments
Bug 17393: Fix non-Latin chars handling in self reg (1.82 KB, patch)
2016-10-04 07:38 UTC, Jonathan Druart
Details | Diff | Splinter Review
Bug 17393: Fix non-Latin chars handling in self reg (1.90 KB, patch)
2016-10-04 08:16 UTC, Marc Véron
Details | Diff | Splinter Review
[PASSED QA] Bug 17393: Fix non-Latin chars handling in self reg (1.97 KB, patch)
2016-10-11 09:24 UTC, Katrin Fischer
Details | Diff | Splinter Review

Note You need to log in before you can comment on or make changes to this bug.
Description Jonathan Druart 2016-10-04 07:24:21 UTC
If you fill the patron self reg with non-latin characters, they will be encoded with HTML entities (é)
This bug leads to generate a userid with weird behaviors:
é => eacute
ł => x
Comment 1 Jonathan Druart 2016-10-04 07:38:01 UTC
Created attachment 56006 [details] [review]
Bug 17393: Fix non-Latin chars handling in self reg

If you fill the patron self reg with non-latin characters, they will be
encoded with HTML entities (é)
This bug leads to generate a userid with weird behaviors:
é => eacute
ł => x

Test plan:
0/ Do not apply the patch
1/ Set up the Self reg feature
2/ fill surname, fistname with something like "Michał pouéàç"
3/ Save
4/ See the bad encoding/replacement on the screen and look at the data
The accentued chars are replaced with their html representation and the
non-Latin chars with a 'x'
in the DB
5/ Apply this patch
6/ Repeat steps 2, 3
7/ Everything should be ok
8/ Try to make sure this HTML::Entities escape was not useful:
fill surname with "surname <script>alert("xss?")</script>"
Save and look at the data
Comment 2 Marc Véron 2016-10-04 08:16:45 UTC
Created attachment 56007 [details] [review]
Bug 17393: Fix non-Latin chars handling in self reg

If you fill the patron self reg with non-latin characters, they will be
encoded with HTML entities (&eacute;)
This bug leads to generate a userid with weird behaviors:
é => eacute
ł => x

Test plan:
0/ Do not apply the patch
1/ Set up the Self reg feature
2/ fill surname, fistname with something like "Michał pouéàç"
3/ Save
4/ See the bad encoding/replacement on the screen and look at the data
The accentued chars are replaced with their html representation and the
non-Latin chars with a 'x'
in the DB
5/ Apply this patch
6/ Repeat steps 2, 3
7/ Everything should be ok
8/ Try to make sure this HTML::Entities escape was not useful:
fill surname with "surname <script>alert("xss?")</script>"
Save and look at the data

Followed test plan, works as expected.
Signed-off-by: Marc Véron <veron@veron.ch>
Comment 3 Katrin Fischer 2016-10-11 09:24:34 UTC
Created attachment 56149 [details] [review]
[PASSED QA] Bug 17393: Fix non-Latin chars handling in self reg

If you fill the patron self reg with non-latin characters, they will be
encoded with HTML entities (&eacute;)
This bug leads to generate a userid with weird behaviors:
é => eacute
ł => x

Test plan:
0/ Do not apply the patch
1/ Set up the Self reg feature
2/ fill surname, fistname with something like "Michał pouéàç"
3/ Save
4/ See the bad encoding/replacement on the screen and look at the data
The accentued chars are replaced with their html representation and the
non-Latin chars with a 'x'
in the DB
5/ Apply this patch
6/ Repeat steps 2, 3
7/ Everything should be ok
8/ Try to make sure this HTML::Entities escape was not useful:
fill surname with "surname <script>alert("xss?")</script>"
Save and look at the data

Followed test plan, works as expected.
Signed-off-by: Marc Véron <veron@veron.ch>

Signed-off-by: Katrin Fischer  <katrin.fischer@bsz-bw.de>
Comment 4 Kyle M Hall 2016-10-21 14:22:11 UTC
Pushed to master for 16.11, thanks Jonathan!
Comment 5 Frédéric Demians 2016-10-22 13:00:23 UTC
Pushed in 16.05. Will be in 16.05.05.
Comment 6 Julian Maurice 2016-10-24 10:40:23 UTC
Pushed in 3.22.x, will be in 3.22.12