Attachment 24267 Details for Bug 11535 – [PASSED QA] Bug 11535: sanitize input from patron self-registration form

[patch] [PASSED QA] Bug 11535: sanitize input from patron self-registration form

PASSED-QA-Bug-11535-sanitize-input-from-patron-sel.patch (text/plain), 2.02 KB, created by Katrin Fischer on 2014-01-14 05:52:03 UTC

(hide)

Description:

Filename:

MIME Type:

Creator: Katrin Fischer

Created: 2014-01-14 05:52:03 UTC

Size: 2.02 KB

patch

obsolete

>From dff6da3a63b17760f900f3e6b55e03f7e0eb3c94 Mon Sep 17 00:00:00 2001
>From: Galen Charlton <gmc@esilibrary.com>
>Date: Mon, 13 Jan 2014 21:51:56 +0000
>Subject: [PATCH] [PASSED QA] Bug 11535: sanitize input from patron
> self-registration form
>
>This patch adds the use of C4::Scrubber to the processing of input
>from the patron self-registration form, thereby closing off one
>avenue for Javascript injection.
>
>To test:
>
>[1] Use the OPAC self-registration form to enter a new patron,
>    and set its address to something like:
>
>    <span style="color: red;">BAD</span>
>
>[2] In the staff interface, bring up the new patron record.  The
>    address will show up in red, indicating a successful HTML
>    injection.
>[3] Apply the patch and use self-registration to enter a new
>    patron with a similar case of unwanted HTML coding.
>[4] Bring up the second patron in the staff interface.  This time,
>    the undesirable HTML tag should not be present.
>
>Signed-off-by: Galen Charlton <gmc@esilibrary.com>
>Signed-off-by: Liz Rea <liz@catalyst.net.nz>
>Tags are not present on testing.
>
>Signed-off-by: Katrin Fischer <Katrin.Fischer.83@web.de>
>Confirmed bug and that the patch fixes it.
>Passes all tests and QA script.
>---
> opac/opac-memberentry.pl | 4 +++-
> 1 file changed, 3 insertions(+), 1 deletion(-)
>
>diff --git a/opac/opac-memberentry.pl b/opac/opac-memberentry.pl
>index c5c84e0..76fd32b 100755
>--- a/opac/opac-memberentry.pl
>+++ b/opac/opac-memberentry.pl
>@@ -26,6 +26,7 @@ use C4::Output;
> use C4::Members;
> use Koha::Borrower::Modifications;
> use C4::Branch qw(GetBranchesLoop);
>+use C4::Scrubber;
> 
> my $cgi = new CGI;
> my $dbh = C4::Context->dbh;
>@@ -276,12 +277,13 @@ sub CheckMandatoryFields {
> sub ParseCgiForBorrower {
>     my ($cgi) = @_;
> 
>+    my $scrubber = C4::Scrubber->new();
>     my %borrower;
> 
>     foreach ( $cgi->param ) {
>         if ( $_ =~ '^borrower_' ) {
>             my ($key) = substr( $_, 9 );
>-            $borrower{$key} = $cgi->param($_);
>+            $borrower{$key} = $scrubber->scrub( $cgi->param($_) );
>         }
>     }
> 
>-- 
>1.8.3.2

Actions: View | Diff | Splinter Review

Attachments on bug 11535: 24242 | 24247 | 24267