Bugzilla – Attachment 6424 Details for
Bug 6629
[security] insecure use of Cookie for language selection
Home
|
New
|
Browse
|
Search
|
[?]
|
Reports
|
Help
|
New Account
|
Log In
[x]
|
Forgot Password
Login:
[x]
[patch]
[SIGNED-OFF] Bug 6629 : Follow up to trap vuln in webinstaller and fixing the error
SIGNED-OFF-Bug-6629--Follow-up-to-trap-vuln-in-web.patch (text/plain), 2.05 KB, created by
Katrin Fischer
on 2011-11-27 08:28:25 UTC
(
hide
)
Description:
[SIGNED-OFF] Bug 6629 : Follow up to trap vuln in webinstaller and fixing the error
Filename:
MIME Type:
Creator:
Katrin Fischer
Created:
2011-11-27 08:28:25 UTC
Size:
2.05 KB
patch
obsolete
>From a079935c3fccec92a1c4a568759de1af2a55cacc Mon Sep 17 00:00:00 2001 >From: Chris Cormack <chrisc@catalyst.net.nz> >Date: Sun, 27 Nov 2011 21:18:29 +1300 >Subject: [PATCH] [SIGNED-OFF] Bug 6629 : Follow up to trap vuln in > webinstaller and fixing the error > >Signed-off-by: Katrin Fischer <Katrin.Fischer.83@web.de> >Patch fixes problem occuring in web installer. >--- > installer/InstallAuth.pm | 18 ++++++++++-------- > 1 files changed, 10 insertions(+), 8 deletions(-) > >diff --git a/installer/InstallAuth.pm b/installer/InstallAuth.pm >index 2c07bbe..10cbea3 100644 >--- a/installer/InstallAuth.pm >+++ b/installer/InstallAuth.pm >@@ -117,7 +117,7 @@ sub get_template_and_user { > $tmplbase=~ s/\.tmpl$/.tt/; > my $filename = "$path/modules/" . $tmplbase; > my $interface = 'intranet'; >- my $template = C4::Templates->new( $interface, $filename, $tmplbase); >+ my $template = C4::Templates->new( $interface, $filename, $tmplbase, $query); > > my ( $user, $cookie, $sessionID, $flags ) = checkauth( > $in->{'query'}, >@@ -158,12 +158,14 @@ sub get_template_and_user { > } > > sub _get_template_language { >- #verify if opac language exists in staff (bug 5660) >- #conditions are 1) dir exists and 2) enabled in prefs >- my ($opaclang)= @_; >- return 'en' unless $opaclang; >- my $path= C4::Context->config('intrahtdocs')."/prog/$opaclang"; >- -d $path ? $opaclang : 'en'; >+ >+ #verify if opac language exists in staff (bug 5660) >+ #conditions are 1) dir exists and 2) enabled in prefs >+ my ($opaclang) = @_; >+ return 'en' unless $opaclang; >+ $opaclang =~ s/[^a-zA-Z_-]*//g; >+ my $path = C4::Context->config('intrahtdocs') . "/prog/$opaclang"; >+ -d $path ? $opaclang : 'en'; > } > > =item checkauth >@@ -365,7 +367,7 @@ sub checkauth { > my $filename = "$path/modules/$template_name"; > $filename =~ s/\.tmpl$/.tt/; > my $interface = 'intranet'; >- my $template = C4::Templates->new( $interface, $filename); >+ my $template = C4::Templates->new( $interface, $filename, '', $query); > $template->param( > INPUTS => \@inputs, > >-- >1.7.5.4
You cannot view the attachment while viewing its details because your browser does not support IFRAMEs.
View the attachment on a separate page
.
View Attachment As Diff
View Attachment As Raw
Actions:
View
|
Diff
|
Splinter Review
Attachments on
bug 6629
:
6398
|
6399
|
6400
|
6401
|
6402
|
6403
|
6404
|
6405
|
6406
|
6411
|
6412
|
6422
|
6423
| 6424 |
6427
|
6428
|
6432