Bugzilla – Attachment 190351 Details for
Bug 40980
Clicking a search facet without logging in may trigger a cud-login error
Home
|
New
|
Browse
|
Search
|
[?]
|
Reports
|
Help
|
New Account
|
Log In
[x]
|
Forgot Password
Login:
[x]
[patch]
Bug 40980: [ALTERNATIVE] Sanitize operators param
Bug-40980-ALTERNATIVE-Sanitize-operators-param.patch (text/plain), 2.32 KB, created by
Marcel de Rooy
on 2025-12-09 15:13:50 UTC
(
hide
)
Description:
Bug 40980: [ALTERNATIVE] Sanitize operators param
Filename:
MIME Type:
Creator:
Marcel de Rooy
Created:
2025-12-09 15:13:50 UTC
Size:
2.32 KB
patch
obsolete
>From 4ad43b435532f1e217bb99259bc3107d784d0370 Mon Sep 17 00:00:00 2001 >From: Pedro Amorim <pedro.amorim@openfifth.co.uk> >Date: Tue, 9 Dec 2025 13:22:44 +0000 >Subject: [PATCH] Bug 40980: [ALTERNATIVE] Sanitize operators param >Content-Type: text/plain; charset=utf-8 > >Ensure it does not contain 'cud-login' > >Test plan, k-t-d with elastic search: >1) Make sure you're logged out >2) Access a search results page directly e.g.: >http://localhost:8081/cgi-bin/koha/catalogue/search.pl?q=music >3) You're prompted to login, login. >4) You're shown the search results directly, click a facet result (any facet) >5) You get a Error 403: >Programming error - op 'cud-login' must not start with 'cud-' for GET >6) Apply patch, restart plack, repeat > >Signed-off-by: Marcel de Rooy <m.de.rooy@rijksmuseum.nl> >--- > catalogue/search.pl | 7 ++++--- > 1 file changed, 4 insertions(+), 3 deletions(-) > >diff --git a/catalogue/search.pl b/catalogue/search.pl >index b723855d06..762d952ae7 100755 >--- a/catalogue/search.pl >+++ b/catalogue/search.pl >@@ -263,7 +263,8 @@ $template->param( advancedsearchesloop => $advancedsearchesloop ); > > $template->param( searchid => scalar $cgi->param('searchid'), ); > >-my $default_sort_by = C4::Context->default_catalog_sort_by; >+my $default_sort_by = C4::Context->default_catalog_sort_by; >+my @sanitized_operators = grep { $_ ne 'cud-login' } $cgi->multi_param('op'); > > # The following should only be loaded if we're bringing up the advanced search template > if ( $template_type eq 'advsearch' ) { >@@ -274,7 +275,7 @@ if ( $template_type eq 'advsearch' ) { > my $expanded = $cgi->param('expanded_options'); > if ( $cgi->param('edit_search') ) { > @operands = $cgi->multi_param('q'); >- @operators = $cgi->multi_param('op'); >+ @operators = @sanitized_operators; > @indexes = $cgi->multi_param('idx'); > $template->param( > sort => scalar $cgi->param('sort_by'), >@@ -370,7 +371,7 @@ $template->param( 'sort_by' => $sort_by[0] ); > > # operators include boolean and proximity operators and are used > # to evaluate multiple operands >-my @operators = map uri_unescape($_), $cgi->multi_param('op'); >+my @operators = map uri_unescape($_), @sanitized_operators; > > # indexes are query qualifiers, like 'title', 'author', etc. They > # can be single or multiple parameters separated by comma: kw,right-Truncation >-- >2.39.5
You cannot view the attachment while viewing its details because your browser does not support IFRAMEs.
View the attachment on a separate page
.
View Attachment As Diff
View Attachment As Raw
Actions:
View
|
Diff
|
Splinter Review
Attachments on
bug 40980
:
187634
|
189384
|
189766
|
190350
| 190351