Attachment 56007 Details for Bug 17393 – Bug 17393: Fix non-Latin chars handling in self reg

[patch] Bug 17393: Fix non-Latin chars handling in self reg

Bug-17393-Fix-non-Latin-chars-handling-in-self-reg.patch (text/plain), 1.90 KB, created by Marc Véron on 2016-10-04 08:16:45 UTC

(hide)

Description:

Filename:

MIME Type:

Creator: Marc Véron

Created: 2016-10-04 08:16:45 UTC

Size: 1.90 KB

patch

obsolete

>From 03d0c6b7c121ec9e2698aeff4e4ea23b1b965ab6 Mon Sep 17 00:00:00 2001
>From: Jonathan Druart <jonathan.druart@bugs.koha-community.org>
>Date: Tue, 4 Oct 2016 08:29:30 +0100
>Subject: [PATCH] Bug 17393: Fix non-Latin chars handling in self reg
>MIME-Version: 1.0
>Content-Type: text/plain; charset=UTF-8
>Content-Transfer-Encoding: 8bit
>
>If you fill the patron self reg with non-latin characters, they will be
>encoded with HTML entities (&eacute;)
>This bug leads to generate a userid with weird behaviors:
>Ã© => eacute
>Å => x
>
>Test plan:
>0/ Do not apply the patch
>1/ Set up the Self reg feature
>2/ fill surname, fistname with something like "MichaÅ pouÃ©Ã Ã§"
>3/ Save
>4/ See the bad encoding/replacement on the screen and look at the data
>The accentued chars are replaced with their html representation and the
>non-Latin chars with a 'x'
>in the DB
>5/ Apply this patch
>6/ Repeat steps 2, 3
>7/ Everything should be ok
>8/ Try to make sure this HTML::Entities escape was not useful:
>fill surname with "surname <script>alert("xss?")</script>"
>Save and look at the data
>
>Followed test plan, works as expected.
>Signed-off-by: Marc VÃ©ron <veron@veron.ch>
>---
> opac/opac-memberentry.pl | 3 +--
> 1 file changed, 1 insertion(+), 2 deletions(-)
>
>diff --git a/opac/opac-memberentry.pl b/opac/opac-memberentry.pl
>index 3fd4c1f..685d1ca 100755
>--- a/opac/opac-memberentry.pl
>+++ b/opac/opac-memberentry.pl
>@@ -20,7 +20,6 @@ use Modern::Perl;
> use CGI qw ( -utf8 );
> use Digest::MD5 qw( md5_base64 md5_hex );
> use String::Random qw( random_string );
>-use HTML::Entities;
> 
> use C4::Auth;
> use C4::Output;
>@@ -403,7 +402,7 @@ sub ParseCgiForBorrower {
>     foreach ( $cgi->param ) {
>         if ( $_ =~ '^borrower_' ) {
>             my ($key) = substr( $_, 9 );
>-            $borrower{$key} = HTML::Entities::encode( $scrubber->scrub( scalar $cgi->param($_) ) );
>+            $borrower{$key} = $scrubber->scrub( scalar $cgi->param($_) );
>         }
>     }
> 
>-- 
>2.1.4

Actions: View | Diff | Splinter Review

Attachments on bug 17393: 56006 | 56007 | 56149