Bugzilla – Attachment 108632 Details for
Bug 25903
Sending a SIP patron information request with a summary field flag in indexes 6-9 will crash server
Home
|
New
|
Browse
|
Search
|
[?]
|
Reports
|
Help
|
New Account
|
Log In
[x]
|
Forgot Password
Login:
[x]
[patch]
Bug 25903: Sending a SIP patron information request with a summary field flag in indexes 6-9 will crash server
Bug-25903-Sending-a-SIP-patron-information-request.patch (text/plain), 2.66 KB, created by
Martin Renvoize (ashimema)
on 2020-08-19 13:28:06 UTC
(
hide
)
Description:
Bug 25903: Sending a SIP patron information request with a summary field flag in indexes 6-9 will crash server
Filename:
MIME Type:
Creator:
Martin Renvoize (ashimema)
Created:
2020-08-19 13:28:06 UTC
Size:
2.66 KB
patch
obsolete
>From 34b7214f01e14dddc65e24d28bcf985014e5bf21 Mon Sep 17 00:00:00 2001 >From: Kyle M Hall <kyle@bywatersolutions.com> >Date: Tue, 30 Jun 2020 14:37:21 -0400 >Subject: [PATCH] Bug 25903: Sending a SIP patron information request with a > summary field flag in indexes 6-9 will crash server > >The 'summary' field in the patron information request specifies if detail information should be send for holds, >overdues, fines, etc. The field is 10 characters in length (0-9). However, the SIP2 spec only defines indexes 0 >though 5, leave 6 though 9 undefined. Some ILSs specify behavior for these undefined indexes. Apparently the >7th field is often used to request 'Fees', as opposed to 'Fines' in some ILS. Some software that integrate via >SIP try both the 5th and 7th indexes to ensure they get all fines and fees. > >The problem is that Koha's SIP server crashes if any 'summary' index beyond 5 is flagged. We should simply >ignore flags beyond 5 and act as if no flags were sent. > >Test Plan: >1) Enable SIP for your instance >2) Send a patron information request with a summary flag in any index beyond 5. > i.e.: 6300120200617 124846 Y AOMIDAY|AA21030050054321 >3) Note the SIP server just closes the connection without a response >4) Apply this patch >5) Restart the SIP server >6) Send the same request >7) Note you get back the patron information response! > >Signed-off-by: Kyle M Hall <kyle@bywatersolutions.com> >Signed-off-by: Jeff Gaines <jgaine@arlingtonva.us> >Signed-off-by: Martin Renvoize <martin.renvoize@ptfs-europe.com> >--- > C4/SIP/Sip/MsgType.pm | 8 ++++---- > 1 file changed, 4 insertions(+), 4 deletions(-) > >diff --git a/C4/SIP/Sip/MsgType.pm b/C4/SIP/Sip/MsgType.pm >index c35c901edf..a365107c8a 100644 >--- a/C4/SIP/Sip/MsgType.pm >+++ b/C4/SIP/Sip/MsgType.pm >@@ -911,7 +911,6 @@ sub handle_login { > sub summary_info { > my ( $ils, $patron, $summary, $start, $end, $server ) = @_; > my $resp = ''; >- my $summary_type; > > # > # Map from offsets in the "summary" field of the Patron Information >@@ -926,9 +925,10 @@ sub summary_info { > { func => $patron->can("unavail_holds"), fid => FID_UNAVAILABLE_HOLD_ITEMS }, > ); > >- if ( ( $summary_type = index( $summary, 'Y' ) ) == -1 ) { >- return ''; # No detailed information required >- } >+ my $summary_type = index( $summary, 'Y' ); >+ return q{} if $summary_type == -1; # No detailed information required. >+ return q{} if $summary_type > 5; # Positions 6-9 are not defined in the sip spec, >+ # and we have no extensions to handle them. > > siplog( "LOG_DEBUG", "Summary_info: index == '%d', field '%s'", $summary_type, $summary_map[$summary_type]->{fid} ); > >-- >2.20.1
You cannot view the attachment while viewing its details because your browser does not support IFRAMEs.
View the attachment on a separate page
.
View Attachment As Diff
View Attachment As Raw
Actions:
View
|
Diff
|
Splinter Review
Attachments on
bug 25903
:
106443
|
106452
| 108632 |
108734