From ccef1fa0ab2f81f006a8132b0d6214e5f0a44a59 Mon Sep 17 00:00:00 2001 From: David Cook Date: Wed, 6 May 2020 10:13:42 +1000 Subject: [PATCH] Bug 25382: validate email addresses for opac-sendbasket.pl and opac-sendshelf.pl This patch adds email validation to these two OPAC scripts using Email::Valid Test plan: 0) Don't apply patch yet 1) Send a cart to "blah@blah.blah blah@blah.blah" 2) Note the cart says it has sent to both email addresses 3) Apply patch 4) Send a cart to "blah@blah.blah blah@blah.blah" 5) Note the cart says it has an error 6) Send a cart to "blah@blah.blah" 7) Note the cart says email was sent successfully 8) Repeat above process for OPAC List functionality Signed-off-by: David Roberts --- opac/opac-sendbasket.pl | 9 +++++++++ opac/opac-sendshelf.pl | 7 +++++++ 2 files changed, 16 insertions(+) diff --git a/opac/opac-sendbasket.pl b/opac/opac-sendbasket.pl index d5e6c7fdfd..da73f2b90d 100755 --- a/opac/opac-sendbasket.pl +++ b/opac/opac-sendbasket.pl @@ -57,6 +57,15 @@ if ( $email_add ) { session_id => scalar $query->cookie('CGISESSID'), token => scalar $query->param('csrf_token'), }); + + if ( ! Email::Valid->address($email_add) ){ + carp "email address invalid"; + $template->param( email_add => $email_add ); #param needed to trigger error template + $template->param( error => 1 ); + output_html_with_http_headers $query, $cookie, $template->output, undef, { force_no_caching => 1 }; + exit; + } + my $email = Koha::Email->new(); my $patron = Koha::Patrons->find( $borrowernumber ); my $borcat = $patron ? $patron->categorycode : q{}; diff --git a/opac/opac-sendshelf.pl b/opac/opac-sendshelf.pl index acbc27e6d2..5b0045eed6 100755 --- a/opac/opac-sendshelf.pl +++ b/opac/opac-sendshelf.pl @@ -61,6 +61,13 @@ my $shelf = Koha::Virtualshelves->find( $shelfid ); if ( $shelf and $shelf->can_be_viewed( $borrowernumber ) ) { if ( $email ) { + if ( ! Email::Valid->address($email) ){ + carp "email address invalid"; + $template->param( email => $email ); #param needed to trigger error template + $template->param( error => 1 ); + output_html_with_http_headers $query, $cookie, $template->output, undef, { force_no_caching => 1 }; + exit; + } my $message = Koha::Email->new(); my $comment = $query->param('comment'); -- 2.11.0