Bugzilla – Attachment 194264 Details for
Bug 4858
Ability to Charge for Print Notices
Home
|
New
|
Browse
|
Search
|
[?]
|
Reports
|
Help
|
New Account
|
Log In
[x]
|
Forgot Password
Login:
[x]
[patch]
Bug 4858: Add validation enhancements to print notice charging
8b3949c.patch (text/plain), 2.57 KB, created by
Martin Renvoize (ashimema)
on 2026-03-02 09:27:50 UTC
(
hide
)
Description:
Bug 4858: Add validation enhancements to print notice charging
Filename:
MIME Type:
Creator:
Martin Renvoize (ashimema)
Created:
2026-03-02 09:27:50 UTC
Size:
2.57 KB
patch
obsolete
>From 8b3949c7e4c9ca2dd33487ba2276c224d7cf7ac3 Mon Sep 17 00:00:00 2001 >From: Jacob O'Mara <jacob.omara@openfifth.co.uk> >Date: Mon, 30 Jun 2025 13:42:43 +0100 >Subject: [PATCH] Bug 4858: Add validation enhancements to print notice > charging > >- Add input validation in add_print_notice_charge method > >Sponsored-by: OpenFifth <https://openfifth.co.uk\> >Signed-off-by: Jackie Usher <jackie.usher@westsussex.gov.uk> >--- > misc/cronjobs/gather_print_notices.pl | 26 +++++++++++++++++++++----- > 1 file changed, 21 insertions(+), 5 deletions(-) > >diff --git a/misc/cronjobs/gather_print_notices.pl b/misc/cronjobs/gather_print_notices.pl >index 853f0ebb056..4e7b16e4add 100755 >--- a/misc/cronjobs/gather_print_notices.pl >+++ b/misc/cronjobs/gather_print_notices.pl >@@ -368,13 +368,25 @@ sub apply_print_notice_charge { > return; > } > >- # Check for borrowernumber >- unless ($message->{borrowernumber}) { >- warn "No borrowernumber in message for print notice charge"; >+ # Validate borrowernumber is numeric to prevent injection >+ unless ($message->{borrowernumber} && $message->{borrowernumber} =~ /^\d+$/) { >+ warn "Invalid or missing borrowernumber in message for print notice charge"; > return; > } > >- # Skip if patron not found >+ # Validate branchcode format if present >+ if (defined $message->{branchcode} && $message->{branchcode} !~ /^[A-Za-z0-9_-]*$/) { >+ warn "Invalid branchcode format in message: " . $message->{branchcode}; >+ return; >+ } >+ >+ # Validate letter_code format if present >+ if (defined $message->{letter_code} && $message->{letter_code} !~ /^[A-Za-z0-9_-]*$/) { >+ warn "Invalid letter_code format in message: " . $message->{letter_code}; >+ return; >+ } >+ >+ # Skip if patron not found (using validated borrowernumber) > my $patron = Koha::Patrons->find($message->{borrowernumber}); > unless ($patron) { > warn "Patron " . $message->{borrowernumber} . " not found for print notice charge"; >@@ -387,11 +399,15 @@ sub apply_print_notice_charge { > library_id => $message->{branchcode}, > }); > >+ # Log successful charge application >+ if ($result) { > cronlogaction({ > action => 'Print notice charge', > info => "Applied charge for patron " . $message->{borrowernumber} . >- " notice " . ($message->{letter_code} || 'unknown') >+ " notice " . ($message->{letter_code} || 'unknown') . >+ " (charge ID: " . $result->id . ")" > }); >+ } > }; > > if ($@) { >-- >2.53.0 >
You cannot view the attachment while viewing its details because your browser does not support IFRAMEs.
View the attachment on a separate page
.
View Attachment As Diff
View Attachment As Raw
Actions:
View
|
Diff
|
Splinter Review
Attachments on
bug 4858
:
186491
|
186492
|
186493
|
186494
|
186495
|
186496
|
186497
|
186498
|
186499
|
186500
|
186501
|
186502
|
194257
|
194258
|
194259
|
194260
|
194261
|
194262
|
194263
| 194264 |
194265
|
194266
|
194267
|
194268
|
194269
|
194270
|
194271
|
194272