46 my $suggestion = $input->Vars; 181 &NewSuggestion($suggestion); acceptedby, accepteddate, STATUS, etc...
Since... commit 8802bbf5fe6c0b35ad4d6e00293eb102a48b92b4 Date: Tue Aug 25 23:56:16 2009 +0200 Editing C4::Suggestions.pm
Created attachment 124423 [details] [review] Bug 28941: Filter suggestion inputs at the OPAC The following sequence is bad: 46 my $suggestion = $input->Vars; 181 &NewSuggestion($suggestion); All columns can be set when we insert the suggestion into the DB We definitely want to avoid the following fields to be set by the final user: acceptedby, accepteddate, STATUS, etc...
You didnt need the Allow list finally
Created attachment 124429 [details] [review] Bug 28941: Filter suggestion inputs at the OPAC The following sequence is bad: 46 my $suggestion = $input->Vars; 181 &NewSuggestion($suggestion); All columns can be set when we insert the suggestion into the DB We definitely want to avoid the following fields to be set by the final user: acceptedby, accepteddate, STATUS, etc... Signed-off-by: Marcel de Rooy <m.de.rooy@rijksmuseum.nl>
Created attachment 124729 [details] [review] Bug 28941: Filter suggestion inputs at the OPAC The following sequence is bad: 46 my $suggestion = $input->Vars; 181 &NewSuggestion($suggestion); All columns can be set when we insert the suggestion into the DB We definitely want to avoid the following fields to be set by the final user: acceptedby, accepteddate, STATUS, etc... Signed-off-by: Marcel de Rooy <m.de.rooy@rijksmuseum.nl> Signed-off-by: Julian Maurice <julian.maurice@biblibre.com>
IMO this is much better like this than with the allowlists implemented in the other bugs. It's a clean and simple solution.
Related: OPACSuggestionUnwantedFields only hides HTML inputs. It is possible to manipulate the DOM to submit data for unwanted fields
(In reply to Julian Maurice from comment #7) > Related: OPACSuggestionUnwantedFields only hides HTML inputs. It is possible > to manipulate the DOM to submit data for unwanted fields Good catch. And so this is where the AllowList module could be useful as we could have reused the "additional deny list" method :)
(In reply to Jonathan Druart from comment #8) > (In reply to Julian Maurice from comment #7) > > Related: OPACSuggestionUnwantedFields only hides HTML inputs. It is possible > > to manipulate the DOM to submit data for unwanted fields > > Good catch. > > And so this is where the AllowList module could be useful as we could have > reused the "additional deny list" method :) $allowlist->remove( unwantedfields );
Created attachment 124745 [details] [review] Bug 28941: Deal with OPACSuggestionUnwantedFields Remove fields from OPACSuggestionUnwantedFields before creating the suggestion
Marcel or Julian, can I get another stamp on this follow-up please?
(In reply to Jonathan Druart from comment #11) > Marcel or Julian, can I get another stamp on this follow-up please? Sure
Created attachment 124747 [details] [review] Bug 28941: Deal with OPACSuggestionUnwantedFields Remove fields from OPACSuggestionUnwantedFields before creating the suggestion Signed-off-by: Marcel de Rooy <m.de.rooy@rijksmuseum.nl>
Comment on attachment 124747 [details] [review] Bug 28941: Deal with OPACSuggestionUnwantedFields Review of attachment 124747 [details] [review]: ----------------------------------------------------------------- ::: opac/opac-suggestions.pl @@ +177,4 @@ > } > } > else { > + for my $f (sort split(/\s*\,\s*/, C4::Context->preference("OPACSuggestionUnwantedFields") ) ) { why `sort` ?
(In reply to Julian Maurice from comment #14) > why `sort` ? Because I am lazy and copy/pasted the existing statement.
Created attachment 124775 [details] [review] Bug 28941: Deal with OPACSuggestionUnwantedFields Remove fields from OPACSuggestionUnwantedFields before creating the suggestion Signed-off-by: Marcel de Rooy <m.de.rooy@rijksmuseum.nl> JD amended patch: remove useless sort
Backported: Pushed to 20.05.x security branch for 20.05.16
== testing notes == 1. log into the OPAC and go to the suggestion form 2. add the following HTML in the form <input type="text" name="STATUS" value="ACCEPTED"> <input type="text" name="reason" value="we will buy it"> 3. submit 4. confirm the in the staff interface that it's indeed accepted 5. apply patch 6. attack doesn't work anymore
Backported to 21.05.04, 20.11.10, 20.05.16, 19.11.22
Pushed to master for 21.11, thanks to everybody involved!