Bugzilla – Attachment 104850 Details for
Bug 25339
Validate biblionumber on opac-basket.pl and opac-review.pl
Home
|
New
|
Browse
|
Search
|
[?]
|
Reports
|
Help
|
New Account
|
Log In
[x]
|
Forgot Password
Login:
[x]
[patch]
Bug 25339: Validate biblionumber on opac-basket.pl and opac-review.pl
Bug-25339-Validate-biblionumber-on-opac-basketpl-a.patch (text/plain), 1.77 KB, created by
David Roberts
on 2020-05-13 16:36:29 UTC
(
hide
)
Description:
Bug 25339: Validate biblionumber on opac-basket.pl and opac-review.pl
Filename:
MIME Type:
Creator:
David Roberts
Created:
2020-05-13 16:36:29 UTC
Size:
1.77 KB
patch
obsolete
>From 562e7ad9066e3443d92c632898ded308bc55cb51 Mon Sep 17 00:00:00 2001 >From: David Cook <dcook@prosentient.com.au> >Date: Fri, 1 May 2020 15:13:05 +1000 >Subject: [PATCH] Bug 25339: Validate biblionumber on opac-basket.pl and > opac-review.pl > >This patch runs biblionumber through the int() function before >using it in the application. > >Test Plan: >1) Apply patch >2) Go to /cgi-bin/koha/opac-basket.pl?bib_list=1/abcdefghi'-alert(1)-'j&verbose=1 >3) Note that you can't find abcdefghi in the HTML. You only see biblionumber 1. >4) Go to /cgi-bin/koha/opac-review.pl?biblionumber=1'-alert(1)-'abcdefghi&reviewid=1&review= >5) Note that you can't find abcdefghi in the HTML. You only see biblionumber 1. > >Signed-off-by: David Roberts <david@koha-ptfs.co.uk> >--- > opac/opac-basket.pl | 1 + > opac/opac-review.pl | 1 + > 2 files changed, 2 insertions(+) > >diff --git a/opac/opac-basket.pl b/opac/opac-basket.pl >index 6a454bedf0..ae2238927a 100755 >--- a/opac/opac-basket.pl >+++ b/opac/opac-basket.pl >@@ -66,6 +66,7 @@ if ( C4::Context->preference('OpacHiddenItemsExceptions') ) { > > my $record_processor = Koha::RecordProcessor->new({ filters => 'ViewPolicy' }); > foreach my $biblionumber ( @bibs ) { >+ $biblionumber = int($biblionumber); > $template->param( biblionumber => $biblionumber ); > > my $dat = &GetBiblioData($biblionumber); >diff --git a/opac/opac-review.pl b/opac/opac-review.pl >index 6c0ac3e688..9d2a3ccb39 100755 >--- a/opac/opac-review.pl >+++ b/opac/opac-review.pl >@@ -33,6 +33,7 @@ use Koha::Reviews; > > my $query = new CGI; > my $biblionumber = $query->param('biblionumber'); >+$biblionumber = int($biblionumber); > my $review = $query->param('review'); > my $reviewid = $query->param('reviewid'); > my ( $template, $borrowernumber, $cookie ) = get_template_and_user( >-- >2.11.0
You cannot view the attachment while viewing its details because your browser does not support IFRAMEs.
View the attachment on a separate page
.
View Attachment As Diff
View Attachment As Raw
Actions:
View
|
Diff
|
Splinter Review
Attachments on
bug 25339
:
104064
| 104850