Bugzilla – Attachment 186498 Details for
Bug 4858
Ability to Charge for Print Notices
Home
|
New
|
Browse
|
Search
|
[?]
|
Reports
|
Help
|
New Account
|
Log In
[x]
|
Forgot Password
Login:
[x]
[patch]
Bug 4858: Add validation enhancements to print notice charging
Bug-4858-Add-validation-enhancements-to-print-noti.patch (text/plain), 2.46 KB, created by
Jacob O'Mara
on 2025-09-16 17:01:58 UTC
(
hide
)
Description:
Bug 4858: Add validation enhancements to print notice charging
Filename:
MIME Type:
Creator:
Jacob O'Mara
Created:
2025-09-16 17:01:58 UTC
Size:
2.46 KB
patch
obsolete
>From f5066cb4e94fdb7b09c31c8432d40b72bebdb01c Mon Sep 17 00:00:00 2001 >From: Jacob O'Mara <jacob.omara@openfifth.co.uk> >Date: Mon, 30 Jun 2025 13:42:43 +0100 >Subject: [PATCH] Bug 4858: Add validation enhancements to print notice > charging > >- Add input validation in add_print_notice_charge method >--- > misc/cronjobs/gather_print_notices.pl | 26 +++++++++++++++++++++----- > 1 file changed, 21 insertions(+), 5 deletions(-) > >diff --git a/misc/cronjobs/gather_print_notices.pl b/misc/cronjobs/gather_print_notices.pl >index 7f6eea133ec..cb5dd1a361f 100755 >--- a/misc/cronjobs/gather_print_notices.pl >+++ b/misc/cronjobs/gather_print_notices.pl >@@ -368,13 +368,25 @@ sub apply_print_notice_charge { > return; > } > >- # Check for borrowernumber >- unless ($message->{borrowernumber}) { >- warn "No borrowernumber in message for print notice charge"; >+ # Validate borrowernumber is numeric to prevent injection >+ unless ($message->{borrowernumber} && $message->{borrowernumber} =~ /^\d+$/) { >+ warn "Invalid or missing borrowernumber in message for print notice charge"; > return; > } > >- # Skip if patron not found >+ # Validate branchcode format if present >+ if (defined $message->{branchcode} && $message->{branchcode} !~ /^[A-Za-z0-9_-]*$/) { >+ warn "Invalid branchcode format in message: " . $message->{branchcode}; >+ return; >+ } >+ >+ # Validate letter_code format if present >+ if (defined $message->{letter_code} && $message->{letter_code} !~ /^[A-Za-z0-9_-]*$/) { >+ warn "Invalid letter_code format in message: " . $message->{letter_code}; >+ return; >+ } >+ >+ # Skip if patron not found (using validated borrowernumber) > my $patron = Koha::Patrons->find($message->{borrowernumber}); > unless ($patron) { > warn "Patron " . $message->{borrowernumber} . " not found for print notice charge"; >@@ -387,11 +399,15 @@ sub apply_print_notice_charge { > library_id => $message->{branchcode}, > }); > >+ # Log successful charge application >+ if ($result) { > cronlogaction({ > action => 'Print notice charge', > info => "Applied charge for patron " . $message->{borrowernumber} . >- " notice " . ($message->{letter_code} || 'unknown') >+ " notice " . ($message->{letter_code} || 'unknown') . >+ " (charge ID: " . $result->id . ")" > }); >+ } > }; > > if ($@) { >-- >2.39.5
You cannot view the attachment while viewing its details because your browser does not support IFRAMEs.
View the attachment on a separate page
.
View Attachment As Diff
View Attachment As Raw
Actions:
View
|
Diff
|
Splinter Review
Attachments on
bug 4858
:
186491
|
186492
|
186493
|
186494
|
186495
|
186496
|
186497
| 186498 |
186499
|
186500
|
186501
|
186502