From 737318d28b3fa227a1b27c5f431917d760ba6731 Mon Sep 17 00:00:00 2001 From: Pedro Amorim Date: Thu, 9 Oct 2025 08:27:57 +0000 Subject: [PATCH] Bug 40980: Only consider AND|OR|NOT/i operators Test plan, k-t-d with elastic search: 1) Make sure you're logged out 2) Access a search results page directly e.g.: http://localhost:8081/cgi-bin/koha/catalogue/search.pl?q=music 3) You're prompted to login, login. 4) You're shown the search results directly, click a facet result (any facet) 5) You get a Error 403: Programming error - op 'cud-login' must not start with 'cud-' for GET 6) Apply patch, restart plack, repeat --- Koha/SearchEngine/Elasticsearch/QueryBuilder.pm | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/Koha/SearchEngine/Elasticsearch/QueryBuilder.pm b/Koha/SearchEngine/Elasticsearch/QueryBuilder.pm index 8ee830c6498..50c5425fa32 100644 --- a/Koha/SearchEngine/Elasticsearch/QueryBuilder.pm +++ b/Koha/SearchEngine/Elasticsearch/QueryBuilder.pm @@ -350,7 +350,7 @@ sub build_query_compat { while ( my ( $oand, $otor, $index ) = $ea->() ) { $query_cgi .= '&' if $query_cgi; $query_cgi .= 'idx=' . uri_escape_utf8( $index // '' ) . '&q=' . uri_escape_utf8($oand); - $query_cgi .= '&op=' . uri_escape_utf8($otor) if $otor; + $query_cgi .= '&op=' . uri_escape_utf8($otor) if $otor =~ /^(AND|OR|NOT)$/i; } $query_cgi .= '&scan=1' if ($scan); -- 2.39.5