Bugzilla – Attachment 6399 Details for
Bug 6629
[security] insecure use of Cookie for language selection
Home
|
New
|
Browse
|
Search
|
[?]
|
Reports
|
Help
|
New Account
|
Log In
[x]
|
Forgot Password
Login:
[x]
[patch]
Bug 6629 : Sanitizing input from language cookie
Bug-6629--Sanitizing-input-from-language-cookie.patch (text/plain), 1.27 KB, created by
Chris Cormack
on 2011-11-25 06:15:59 UTC
(
hide
)
Description:
Bug 6629 : Sanitizing input from language cookie
Filename:
MIME Type:
Creator:
Chris Cormack
Created:
2011-11-25 06:15:59 UTC
Size:
1.27 KB
patch
obsolete
>From 1d59b156933210c12674213c18859f3000289fe9 Mon Sep 17 00:00:00 2001 >From: Chris Cormack <chrisc@catalyst.net.nz> >Date: Fri, 25 Nov 2011 19:07:28 +1300 >Subject: [PATCH] Bug 6629 : Sanitizing input from language cookie > >I dont think we can use only 2 digits, some languages is much longer >zh-hans-TW for example > >But the regex should stop it bening able handle nasty chars, >whitelisting safe ones instead >--- > C4/Templates.pm | 6 ++---- > 1 files changed, 2 insertions(+), 4 deletions(-) > >diff --git a/C4/Templates.pm b/C4/Templates.pm >index c2a5911..7021b91 100644 >--- a/C4/Templates.pm >+++ b/C4/Templates.pm >@@ -277,8 +277,7 @@ sub themelanguage { > my @languages = split(",", C4::Context->preference( > $is_intranet ? 'language' : 'opaclanguages')); > my $lang; >- $lang = $query->cookie('KohaOpacLanguage') >- if defined $query and $query->cookie('KohaOpacLanguage'); >+ $lang = getlanguagecookie; > unless ($lang) { > my $http_accept_language = $ENV{ HTTP_ACCEPT_LANGUAGE }; > $lang = accept_language( $http_accept_language, >@@ -327,8 +326,7 @@ sub getlanguagecookie { > $lang = $ENV{HTTP_ACCEPT_LANGUAGE}; > > } >- $lang = substr($lang, 0, 2); >- >+ $lang =~ s/[^a-zA-Z_-]*//; #sanitzie > return $lang; > } > >-- >1.7.5.4
You cannot view the attachment while viewing its details because your browser does not support IFRAMEs.
View the attachment on a separate page
.
View Attachment As Diff
View Attachment As Raw
Actions:
View
|
Diff
|
Splinter Review
Attachments on
bug 6629
:
6398
|
6399
|
6400
|
6401
|
6402
|
6403
|
6404
|
6405
|
6406
|
6411
|
6412
|
6422
|
6423
|
6424
|
6427
|
6428
|
6432