Bugzilla – Attachment 19646 Details for
Bug 10590
in opac-topissues limit param is not protected
Home
|
New
|
Browse
|
Search
|
[?]
|
Reports
|
Help
|
New Account
|
Log In
[x]
|
Forgot Password
Login:
[x]
[patch]
Proposed patch
0001-Bug-10590-in-opac-topissues-limit-param-is-not-prote.patch (text/plain), 1.72 KB, created by
Fridolin Somers
on 2013-07-15 11:05:26 UTC
(
hide
)
Description:
Proposed patch
Filename:
MIME Type:
Creator:
Fridolin Somers
Created:
2013-07-15 11:05:26 UTC
Size:
1.72 KB
patch
obsolete
>From ae26d7bf159f12cdacff1f8a9a1b93b4b0456a35 Mon Sep 17 00:00:00 2001 >From: Fridolyn SOMERS <fridolyn.somers@biblibre.com> >Date: Mon, 15 Jul 2013 13:00:18 +0200 >Subject: [PATCH] Bug 10590 - in opac-topissues limit param is not protected > >In opac-topissues page, the limit URL argument is directly added to SQL query. > >This patch adds protections : limit must only contain digits and must be lower than 100. > >Test plan : >- Edit URL to : /cgi-bin/koha/opac-topissues.pl?limit=10&branch=&itemtype=&timeLimit=999&do_it=1 >=> You get the results of 10 most cheched-out of all time >- Edit URL to : /cgi-bin/koha/opac-topissues.pl?limit=&branch=&itemtype=&timeLimit=999&do_it=1 >=> You get the results of 10 most cheched-out of all time >- Edit URL to : /cgi-bin/koha/opac-topissues.pl?limit=9999&branch=&itemtype=&timeLimit=999&do_it=1 >=> You get the results of 100 most cheched-out of all time >- Edit URL to : /cgi-bin/koha/opac-topissues.pl?limit=WHERE&branch=&itemtype=&timeLimit=999&do_it=1 >=> You get the results of 10 most cheched-out of all time >--- > opac/opac-topissues.pl | 4 +++- > 1 file changed, 3 insertions(+), 1 deletion(-) > >diff --git a/opac/opac-topissues.pl b/opac/opac-topissues.pl >index 38c6df0..41d7c84 100755 >--- a/opac/opac-topissues.pl >+++ b/opac/opac-topissues.pl >@@ -52,7 +52,9 @@ my ($template, $borrowernumber, $cookie) > }); > my $dbh = C4::Context->dbh; > # Displaying results >-my $limit = $input->param('limit') || 10; >+my $limit = $input->param('limit'); >+$limit = 10 unless ($limit && $limit =~ /^\d+$/); # control user input for SQL query >+$limit = 100 if $limit > 100; > my $branch = $input->param('branch') || ''; > my $itemtype = $input->param('itemtype') || ''; > my $timeLimit = $input->param('timeLimit') || 3; >-- >1.7.10.4 >
You cannot view the attachment while viewing its details because your browser does not support IFRAMEs.
View the attachment on a separate page
.
View Attachment As Diff
View Attachment As Raw
Actions:
View
|
Diff
|
Splinter Review
Attachments on
bug 10590
:
19646
|
19659
|
19660
|
19661
|
19662
|
19663
|
19664
|
19665
|
19666
|
19667
|
19668
|
19669
|
19670
|
19671