From 562e7ad9066e3443d92c632898ded308bc55cb51 Mon Sep 17 00:00:00 2001 From: David Cook Date: Fri, 1 May 2020 15:13:05 +1000 Subject: [PATCH] Bug 25339: Validate biblionumber on opac-basket.pl and opac-review.pl This patch runs biblionumber through the int() function before using it in the application. Test Plan: 1) Apply patch 2) Go to /cgi-bin/koha/opac-basket.pl?bib_list=1/abcdefghi'-alert(1)-'j&verbose=1 3) Note that you can't find abcdefghi in the HTML. You only see biblionumber 1. 4) Go to /cgi-bin/koha/opac-review.pl?biblionumber=1'-alert(1)-'abcdefghi&reviewid=1&review= 5) Note that you can't find abcdefghi in the HTML. You only see biblionumber 1. Signed-off-by: David Roberts --- opac/opac-basket.pl | 1 + opac/opac-review.pl | 1 + 2 files changed, 2 insertions(+) diff --git a/opac/opac-basket.pl b/opac/opac-basket.pl index 6a454bedf0..ae2238927a 100755 --- a/opac/opac-basket.pl +++ b/opac/opac-basket.pl @@ -66,6 +66,7 @@ if ( C4::Context->preference('OpacHiddenItemsExceptions') ) { my $record_processor = Koha::RecordProcessor->new({ filters => 'ViewPolicy' }); foreach my $biblionumber ( @bibs ) { + $biblionumber = int($biblionumber); $template->param( biblionumber => $biblionumber ); my $dat = &GetBiblioData($biblionumber); diff --git a/opac/opac-review.pl b/opac/opac-review.pl index 6c0ac3e688..9d2a3ccb39 100755 --- a/opac/opac-review.pl +++ b/opac/opac-review.pl @@ -33,6 +33,7 @@ use Koha::Reviews; my $query = new CGI; my $biblionumber = $query->param('biblionumber'); +$biblionumber = int($biblionumber); my $review = $query->param('review'); my $reviewid = $query->param('reviewid'); my ( $template, $borrowernumber, $cookie ) = get_template_and_user( -- 2.11.0