Attachment 167029 Details for Bug 36875 – Bug 36875: Do not pass unsanitized language to $page->translated_content

[patch] Bug 36875: Do not pass unsanitized language to $page->translated_content

Bug-36875-Do-not-pass-unsanitized-language-to-page.patch (text/plain), 1.74 KB, created by Martin Renvoize (ashimema) on 2024-05-22 12:54:37 UTC

(hide)

Description:

Filename:

MIME Type:

Creator: Martin Renvoize (ashimema)

Created: 2024-05-22 12:54:37 UTC

Size: 1.74 KB

patch

obsolete

>From 3641627ae10e291e8f3123ca0a059101a9c642a7 Mon Sep 17 00:00:00 2001
>From: Marcel de Rooy <m.de.rooy@rijksmuseum.nl>
>Date: Thu, 16 May 2024 07:19:30 +0000
>Subject: [PATCH] Bug 36875: Do not pass unsanitized language to
> $page->translated_content
>
>Test plan:
>Try to access opac-page.pl with a language not in OPACLanguages.
>Verify that this 'language' was not passed to sql. Simplest perhaps
>by debugging AdditionalContent.pm. Something like:
> sub translated_content {
>     my ( $self, $lang ) = @_;
>+warn "L137: $lang";
>Now have a public additional_contents page and hit it:
>    /cgi-bin/koha/opac-page.pl?page_id=5&language=badsql
>Check your log and find:
>[2024/05/16 07:25:53] [WARN] L137: en at [etc] line 137.
>So badsql was caught.
>
>Signed-off-by: Marcel de Rooy <m.de.rooy@rijksmuseum.nl>
>Signed-off-by: Victor Grousset/tuxayo <victor@tuxayo.net>
>Signed-off-by: Martin Renvoize <martin.renvoize@ptfs-europe.com>
>---
> opac/opac-page.pl | 4 ++--
> 1 file changed, 2 insertions(+), 2 deletions(-)
>
>diff --git a/opac/opac-page.pl b/opac/opac-page.pl
>index 5854160dbba..0a35c21433c 100755
>--- a/opac/opac-page.pl
>+++ b/opac/opac-page.pl
>@@ -35,7 +35,6 @@ my ( $template, $borrowernumber, $cookie ) = get_template_and_user(
> );
> 
> my $page_id = $query->param('page_id');
>-my $lang = $query->param('language');
> 
> my $homebranch = $ENV{OPAC_BRANCH_DEFAULT};
> if (C4::Context->userenv) {
>@@ -49,7 +48,8 @@ if ( !$page || $page->category ne 'pages' || $page->branchcode && $page->branchc
>     exit;
> }
> 
>-my $content = $page->translated_content( $lang || C4::Languages::getlanguage($query) );
>+# Sanitize $query->param('language') via getlanguage
>+my $content = $page->translated_content( C4::Languages::getlanguage($query) );
> 
> $template->param( page => $content );
> 
>-- 
>2.45.1

Actions: View | Diff | Splinter Review

Attachments on bug 36875: 166804 | 166805 | 166806 | 166832 | 166833 | 166872 | 166873 | 166874 | 166875 | 166918 | 166919 | 166920 | 166921 | 167029 | 167030 | 167031 | 167032