Caused by bug 18497
Created attachment 76056 [details] [review] Bug 20945: Escape SQL parameters when constructing download links TO test: 1 - Create a report that takes a parameter 2 - Enter a parameter containing '%' 3 - Attempt to download report, note link is misconstructed 4 - Apply patch 5 - Reload 6 - Note URL is now correct
I've been testing with the following SQL: select * from borrowers where firstname like <<TEST|Asort1>> and surname like <<surname>> Asort1 has a % in my test. But I can download fine in all formats and the URL looks like this: cgi-bin/koha/reports/guided_reports.pl?reports=2&phase=Run+this+report¶m_name=TEST|Asort1&sql_params=%25¶m_name=surname&sql_params=%25 Can you explain more about the problem? What am I missing?
Ah, I don't see it in Chrome, but I do in Firefox, what browser are you using?
Firefox - maybe a different version? But it trying to be smart could explain.
(In reply to Katrin Fischer from comment #4) > Firefox - maybe a different version? But it trying to be smart could explain. My version: 61.0b13 Just to check, that URL you pasted is the report url, I meant the URL of the download links. To download as tab I get: http://localhost:8081/cgi-bin/koha/reports/guided_reports.pl?reports=1&phase=Export&format=tab&report_id=13&reportname=Test&sql_params=%25¶m_name=Enter|Asort1 Versus the report URL: http://localhost:8081/cgi-bin/koha/reports/guided_reports.pl?reports=13&phase=Run+this+report¶m_name=Enter%7CAsort1&sql_params=%2525# Notice the param changes from: %2525 in the report URL to %25 in the download URL This has the effect of running the report with param as '%' when downloading (because it translates %25 as an html code) The results will download, however, they will include all the barcodes, instead of the limited set it should be
Created attachment 76423 [details] [review] Bug 20945: Escape SQL parameters when constructing download links TO test: 1 - Create a report that takes a parameter 2 - Enter a parameter containing '%' 3 - Attempt to download report, note link is misconstructed 4 - Apply patch 5 - Reload 6 - Note URL is now correct Signed-off-by: Katrin Fischer <katrin.fischer.83@web.de>
Created attachment 76558 [details] [review] Bug 20945: Escape SQL parameters when constructing download links TO test: 1 - Create a report that takes a parameter 2 - Enter a parameter containing '%' 3 - Attempt to download report, note link is misconstructed 4 - Apply patch 5 - Reload 6 - Note URL is now correct Signed-off-by: Katrin Fischer <katrin.fischer.83@web.de> Signed-off-by: Martin Renvoize <martin.renvoize@ptfs-europe.com>
Trivial fix that works as expected, Passed QA :)
Any good reasons to not escape param_name as well?
Created attachment 76587 [details] [review] Bug 20945: (RM follow-up) Escape param_name too
Awesome work all! Pushed to master for 18.11
Pushed to 18.05.x for 18.05.02
Pushed to 17.11.x for 17.11.08. Follow-up not needed, it depends on Bug 9634 not in 17.11.x
Depends on Bug 18497 not in 17.05.x