From f5066cb4e94fdb7b09c31c8432d40b72bebdb01c Mon Sep 17 00:00:00 2001 From: Jacob O'Mara Date: Mon, 30 Jun 2025 13:42:43 +0100 Subject: [PATCH] Bug 4858: Add validation enhancements to print notice charging - Add input validation in add_print_notice_charge method --- misc/cronjobs/gather_print_notices.pl | 26 +++++++++++++++++++++----- 1 file changed, 21 insertions(+), 5 deletions(-) diff --git a/misc/cronjobs/gather_print_notices.pl b/misc/cronjobs/gather_print_notices.pl index 7f6eea133ec..cb5dd1a361f 100755 --- a/misc/cronjobs/gather_print_notices.pl +++ b/misc/cronjobs/gather_print_notices.pl @@ -368,13 +368,25 @@ sub apply_print_notice_charge { return; } - # Check for borrowernumber - unless ($message->{borrowernumber}) { - warn "No borrowernumber in message for print notice charge"; + # Validate borrowernumber is numeric to prevent injection + unless ($message->{borrowernumber} && $message->{borrowernumber} =~ /^\d+$/) { + warn "Invalid or missing borrowernumber in message for print notice charge"; return; } - # Skip if patron not found + # Validate branchcode format if present + if (defined $message->{branchcode} && $message->{branchcode} !~ /^[A-Za-z0-9_-]*$/) { + warn "Invalid branchcode format in message: " . $message->{branchcode}; + return; + } + + # Validate letter_code format if present + if (defined $message->{letter_code} && $message->{letter_code} !~ /^[A-Za-z0-9_-]*$/) { + warn "Invalid letter_code format in message: " . $message->{letter_code}; + return; + } + + # Skip if patron not found (using validated borrowernumber) my $patron = Koha::Patrons->find($message->{borrowernumber}); unless ($patron) { warn "Patron " . $message->{borrowernumber} . " not found for print notice charge"; @@ -387,11 +399,15 @@ sub apply_print_notice_charge { library_id => $message->{branchcode}, }); + # Log successful charge application + if ($result) { cronlogaction({ action => 'Print notice charge', info => "Applied charge for patron " . $message->{borrowernumber} . - " notice " . ($message->{letter_code} || 'unknown') + " notice " . ($message->{letter_code} || 'unknown') . + " (charge ID: " . $result->id . ")" }); + } }; if ($@) { -- 2.39.5