Attachment 158762 Details for Bug 35290 – Bug 35290: Sanitize field input on cataloguing/ysearch.pl

[patch] Bug 35290: Sanitize field input on cataloguing/ysearch.pl

Bug-35290-Sanitize-field-input-on-cataloguingysear.patch (text/plain), 1.54 KB, created by Owen Leonard on 2023-11-09 19:49:54 UTC

(hide)

Description:

Filename:

MIME Type:

Creator: Owen Leonard

Created: 2023-11-09 19:49:54 UTC

Size: 1.54 KB

patch

obsolete

>From af65d1406cd0daa2426e2b53ea360140e34f4a64 Mon Sep 17 00:00:00 2001
>From: David Cook <dcook@prosentient.com.au>
>Date: Wed, 8 Nov 2023 23:39:45 +0000
>Subject: [PATCH] Bug 35290: Sanitize field input on cataloguing/ysearch.pl
>
>This change sanitizies the field input on cataloguing/ysearch.pl
>
>Test plan:
>0. Apply the patch and restart/reload Koha
>1a. "Add marc21_field_260b.pl plugin to 260$b in the Default framework"
>1b. Go to http://localhost:8081/cgi-bin/koha/admin/marc_subfields_structure.pl?
>op=add_form&tagfield=260&frameworkcode=#subbfield
>1c. Choose "marc21_field_260b.pl" from the dropdown next to "Plugin"
>1d. Click "Save changes"
>2a. "Add new record"
>2b. Go to http://localhost:8081/cgi-bin/koha/cataloguing/addbiblio.pl?frameworkcode=
>3. Click on tab "2" and scroll down to 260 "b"
>4. Type in "Ori" into 260 subfield b
>5. Some autocomplete suggestions should appear
>
>Signed-off-by: Owen Leonard <oleonard@myacpl.org>
>---
> cataloguing/ysearch.pl | 3 ++-
> 1 file changed, 2 insertions(+), 1 deletion(-)
>
>diff --git a/cataloguing/ysearch.pl b/cataloguing/ysearch.pl
>index 7216d559b0..609f4cb0b1 100755
>--- a/cataloguing/ysearch.pl
>+++ b/cataloguing/ysearch.pl
>@@ -37,7 +37,8 @@ my $table = $input->param('table');
> my $field = $input->param('field');
> 
> # Prevent from disclosing data
>-die() unless ($table eq "biblioitems"); 
>+die() unless ($table eq "biblioitems");
>+die() unless ($field eq 'publishercode' || $field eq 'collectiontitle');
> 
> binmode STDOUT, ":encoding(UTF-8)";
> print $input->header( -type => 'text/plain', -charset => 'UTF-8' );
>-- 
>2.30.2

Actions: View | Diff | Splinter Review

Attachments on bug 35290: 158682 | 158762 | 158763 | 158764 | 158765