Bugzilla – Attachment 102385 Details for
Bug 4461
Add a context-sensitive report a problem process
Home
|
New
|
Browse
|
Search
|
[?]
|
Reports
|
Help
|
New Account
|
Log In
[x]
|
Forgot Password
Login:
[x]
[patch]
Bug 4461: Correctly deal with encoding/escaping chars
Bug-4461-Correctly-deal-with-encodingescaping-char.patch (text/plain), 5.58 KB, created by
Jonathan Druart
on 2020-04-03 13:14:14 UTC
(
hide
)
Description:
Bug 4461: Correctly deal with encoding/escaping chars
Filename:
MIME Type:
Creator:
Jonathan Druart
Created:
2020-04-03 13:14:14 UTC
Size:
5.58 KB
patch
obsolete
>From 00fd52d5ac6f73d5d5a8271ad2256dfc6ff6fc1b Mon Sep 17 00:00:00 2001 >From: Jonathan Druart <jonathan.druart@bugs.koha-community.org> >Date: Fri, 3 Apr 2020 13:52:12 +0200 >Subject: [PATCH] Bug 4461: Correctly deal with encoding/escaping chars >MIME-Version: 1.0 >Content-Type: text/plain; charset=UTF-8 >Content-Transfer-Encoding: 8bit > >This patch deals (hopefully) correctly with encoding and escaping chars. >It also remove OPACBaseURL from the url stored in DB, and readd is on >display, to avoid possible attacks. > >Test plan: >Go to the authority search >fill term with something hacky ><script>alert('booh!')</script>And Åâ¥m⬠Eâtrâ³ >Search >Click the "Report a problem" link >Fill the form and make sure the url is displayed correctly >submit >Check problem_reports.problempage in DB => Should be correctly displayed >Go to staff interface, "OPAC problem reports" >=> Confirm the link is correctly display >Click it >=> Confirm that you are at the OPAC, and the URL is correct > >Signed-off-by: Jonathan Druart <jonathan.druart@bugs.koha-community.org> >--- > .../prog/en/modules/admin/problem-reports.tt | 4 ++-- > .../opac-tmpl/bootstrap/en/modules/opac-reportproblem.tt | 6 +++--- > opac/opac-reportproblem.pl | 8 ++++++-- > 3 files changed, 11 insertions(+), 7 deletions(-) > >diff --git a/koha-tmpl/intranet-tmpl/prog/en/modules/admin/problem-reports.tt b/koha-tmpl/intranet-tmpl/prog/en/modules/admin/problem-reports.tt >index 6c7080f3ff..b2e0ea5a08 100644 >--- a/koha-tmpl/intranet-tmpl/prog/en/modules/admin/problem-reports.tt >+++ b/koha-tmpl/intranet-tmpl/prog/en/modules/admin/problem-reports.tt >@@ -79,8 +79,8 @@ > <b>[% report.title | html %]</b><br> > [% report.content | html %] > </td> >- <td><a href="[% report.problempage | url %]">[% report.problempage | html %]</a></td> >- <td>[% report.recipient %]</td> >+ <td><a href="[% OPACBaseURL | url %][% report.problempage | url %]">[% OPACBaseURL | url %][% report.problempage | html %]</a></td> >+ <td>[% report.recipient | html %]</td> > <td><span title="[% report.created_on | html %]">[% report.created_on | $KohaDates with_hours => 1 %]</span></td> > <td>[% INCLUDE 'patron-title.inc' patron => report.patron hide_patron_infos_if_needed=1 %]</td> > <td class="status[% report.status | html %]" name="status"><span id="status_[% report.reportid | html %]">[% report.status | html %]</span></td> >diff --git a/koha-tmpl/opac-tmpl/bootstrap/en/modules/opac-reportproblem.tt b/koha-tmpl/opac-tmpl/bootstrap/en/modules/opac-reportproblem.tt >index b866967a90..efae1019a2 100644 >--- a/koha-tmpl/opac-tmpl/bootstrap/en/modules/opac-reportproblem.tt >+++ b/koha-tmpl/opac-tmpl/bootstrap/en/modules/opac-reportproblem.tt >@@ -37,7 +37,7 @@ > [% ELSE %] > Your problem report has been sent to the library. > [% END %] >- [% CASE 'error_on_send' %][#% We really should avoid reaching this! %] >+ [% CASE 'error_on_send' #We really should avoid reaching this! %] > Something wrong happened when sending the report. Please contact your library. > [% END %] > </div> >@@ -62,8 +62,8 @@ > </li> > <li> > <label for="problempage">Problem found on page: </label> >- <input type="hidden" name="problempage" id="problempage" value="[% problempage | html %]"> >- [% problempage | html %] >+ <input type="hidden" name="problempage" id="problempage" value="[% problempage | url %]"> >+ [% problempage | html %]<br/> > </li> > <li> > <label for="user">Username: </label> >diff --git a/opac/opac-reportproblem.pl b/opac/opac-reportproblem.pl >index 7e62f75c65..2abce15c1f 100755 >--- a/opac/opac-reportproblem.pl >+++ b/opac/opac-reportproblem.pl >@@ -28,6 +28,8 @@ use Koha::ProblemReport; > use Koha::Libraries; > use Koha::Patrons; > use Koha::Util::Navigation; >+use URI::Escape; >+use Encode; > > my $input = new CGI; > >@@ -46,7 +48,8 @@ if ( !C4::Context->preference('OPACReportProblem') > print $input->redirect("/cgi-bin/koha/errors/404.pl"); > } > >-my $problempage = C4::Context->preference('OPACBaseURL') . Koha::Util::Navigation::local_referer($input ); >+my $referer = Koha::Util::Navigation::local_referer($input ); >+$referer = Encode::decode_utf8 uri_unescape $referer, > > my $patron = Koha::Patrons->find($borrowernumber); > my $username = $patron->userid; >@@ -56,7 +59,7 @@ my @messages; > > $template->param( > username => $username, >- problempage => $problempage, >+ problempage => $referer, > library => $library, > ); > >@@ -66,6 +69,7 @@ if ( $op eq 'addreport' ) { > my $subject = $input->param('subject'); > my $message = $input->param('message'); > my $problempage = $input->param('problempage'); >+ $problempage = Encode::decode_utf8 uri_unescape $problempage; > my $recipient = $input->param('recipient') || 'admin'; > > try { >-- >2.20.1
You cannot view the attachment while viewing its details because your browser does not support IFRAMEs.
View the attachment on a separate page
.
View Attachment As Diff
View Attachment As Raw
Actions:
View
|
Diff
|
Splinter Review
Attachments on
bug 4461
:
58887
|
59032
|
61654
|
65871
|
66253
|
66323
|
66324
|
98687
|
98688
|
98689
|
98725
|
99551
|
99599
|
99600
|
99601
|
99602
|
99603
|
99633
|
99635
|
99636
|
99637
|
99638
|
99639
|
99929
|
99930
|
99931
|
99932
|
99933
|
99934
|
99935
|
99936
|
99937
|
99938
|
99939
|
99940
|
99941
|
99942
|
100488
|
100489
|
100490
|
100491
|
100492
|
100493
|
100494
|
100495
|
100496
|
100497
|
100498
|
100499
|
100500
|
100506
|
100507
|
100508
|
100509
|
100510
|
100511
|
100512
|
100513
|
100514
|
100515
|
100516
|
100517
|
100518
|
100519
|
100520
|
100521
|
100522
|
100523
|
100524
|
100619
|
100989
|
100990
|
102188
|
102189
|
102190
|
102191
|
102192
|
102193
|
102194
|
102195
|
102196
|
102198
|
102200
|
102201
|
102202
|
102203
|
102204
|
102205
|
102206
|
102207
|
102208
|
102209
|
102210
|
102211
|
102253
|
102279
|
102281
|
102308
|
102309
|
102310
|
102311
|
102312
|
102313
|
102314
|
102315
|
102316
|
102317
|
102318
|
102319
|
102320
|
102321
|
102322
|
102323
|
102324
|
102325
|
102326
|
102327
|
102328
|
102329
|
102330
|
102331
|
102358
|
102359
|
102360
|
102361
|
102362
|
102363
|
102364
|
102365
|
102366
|
102367
|
102368
|
102369
|
102370
|
102371
|
102372
|
102373
|
102374
|
102375
|
102376
|
102377
|
102378
|
102379
|
102380
|
102381
|
102382
|
102383
|
102384
| 102385 |
102386