Attachment #169541 for bug #37464

View | Details | Raw Unified | Return to bug 37464
Collapse All | Expand All





=cut

my %type_mapping = (
    Code39         => 1,
    UPCE           => 1,
    UPCA           => 1,
    QRcode         => 1,
    NW7            => 1,
    Matrix2of5     => 1,
    ITF            => 1,
    Industrial2of5 => 1,
    IATA2of5       => 1,
    EAN8           => 1,
    EAN13          => 1,
    COOP2of5       => 1,
);

my $input = CGI->new;

my ( $auth_status ) = check_cookie_auth( $input->cookie('CGISESSID'), { catalogue => '*' } );


binmode(STDOUT);

my $type = $input->param('type') || '';
my $barcode = $input->param('barcode');
my $notext = $input->param('notext') ? 1 : 0;
my $height = $input->param('height') || 50;
my $qrcode_modulesize = $input->param('modulesize') || "5"; # 1+
my $image;

# Validate the barcode type. Default to Code39 if no type or unsupported type sent.
if ( !$type_mapping{$type} ) {
    $type = 'Code39';
}

if ( $type eq 'Code39' ) {
    $barcode = '*' . $barcode unless $barcode =~ /^\*/;
    $barcode = $barcode . '*' unless $barcode =~ /\*$/;

    if( $type eq "QRcode" ){
        $image = GD::Barcode->new('QRcode', $barcode, { Ecc => "M", ModuleSize => $qrcode_modulesize } )->plot->png();
    } else {
        # BZ 37464 - $type must be validated as GD::Barcode unsafely passes this argument directly to an eval{} block
        $image = GD::Barcode->new( $type, $barcode )->plot( NoText => $notext, Height => $height )->png();
    }
};
- 

Return to bug 37464

Lines 89-94 below the scannable barcode. Link Here

(-)a/svc/barcode (-2 / +22 lines)
89		89
90	=cut	90	=cut
91		91
		92	my %type_mapping = (
		93	Code39 => 1,
		94	UPCE => 1,
		95	UPCA => 1,
		96	QRcode => 1,
		97	NW7 => 1,
		98	Matrix2of5 => 1,
		99	ITF => 1,
		100	Industrial2of5 => 1,
		101	IATA2of5 => 1,
		102	EAN8 => 1,
		103	EAN13 => 1,
		104	COOP2of5 => 1,
		105	);
		106
92	my $input = CGI->new;	107	my $input = CGI->new;
93		108
94	my ( $auth_status ) = check_cookie_auth( $input->cookie('CGISESSID'), { catalogue => '*' } );	109	my ( $auth_status ) = check_cookie_auth( $input->cookie('CGISESSID'), { catalogue => '*' } );
Lines 99-111 if ( $auth_status ne "ok" ) { Link Here
99		114
100	binmode(STDOUT);	115	binmode(STDOUT);
101		116
102	my $type = $input->param('type') \|\| 'Code39';	117	my $type = $input->param('type') \|\| '';
103	my $barcode = $input->param('barcode');	118	my $barcode = $input->param('barcode');
104	my $notext = $input->param('notext') ? 1 : 0;	119	my $notext = $input->param('notext') ? 1 : 0;
105	my $height = $input->param('height') \|\| 50;	120	my $height = $input->param('height') \|\| 50;
106	my $qrcode_modulesize = $input->param('modulesize') \|\| "5"; # 1+	121	my $qrcode_modulesize = $input->param('modulesize') \|\| "5"; # 1+
107	my $image;	122	my $image;
108		123
		124	# Validate the barcode type. Default to Code39 if no type or unsupported type sent.
		125	if ( !$type_mapping{$type} ) {
		126	$type = 'Code39';
		127	}
		128
109	if ( $type eq 'Code39' ) {	129	if ( $type eq 'Code39' ) {
110	$barcode = '' . $barcode unless $barcode =~ /^\/;	130	$barcode = '' . $barcode unless $barcode =~ /^\/;
111	$barcode = $barcode . '' unless $barcode =~ /\$/;	131	$barcode = $barcode . '' unless $barcode =~ /\$/;
Lines 115-120 eval { Link Here
115	if( $type eq "QRcode" ){	135	if( $type eq "QRcode" ){
116	$image = GD::Barcode->new('QRcode', $barcode, { Ecc => "M", ModuleSize => $qrcode_modulesize } )->plot->png();	136	$image = GD::Barcode->new('QRcode', $barcode, { Ecc => "M", ModuleSize => $qrcode_modulesize } )->plot->png();
117	} else {	137	} else {
		138	# BZ 37464 - $type must be validated as GD::Barcode unsafely passes this argument directly to an eval{} block
118	$image = GD::Barcode->new( $type, $barcode )->plot( NoText => $notext, Height => $height )->png();	139	$image = GD::Barcode->new( $type, $barcode )->plot( NoText => $notext, Height => $height )->png();
119	}	140	}
120	};	141	};
121	-