From 4ad43b435532f1e217bb99259bc3107d784d0370 Mon Sep 17 00:00:00 2001 From: Pedro Amorim Date: Tue, 9 Dec 2025 13:22:44 +0000 Subject: [PATCH] Bug 40980: [ALTERNATIVE] Sanitize operators param Content-Type: text/plain; charset=utf-8 Ensure it does not contain 'cud-login' Test plan, k-t-d with elastic search: 1) Make sure you're logged out 2) Access a search results page directly e.g.: http://localhost:8081/cgi-bin/koha/catalogue/search.pl?q=music 3) You're prompted to login, login. 4) You're shown the search results directly, click a facet result (any facet) 5) You get a Error 403: Programming error - op 'cud-login' must not start with 'cud-' for GET 6) Apply patch, restart plack, repeat Signed-off-by: Marcel de Rooy --- catalogue/search.pl | 7 ++++--- 1 file changed, 4 insertions(+), 3 deletions(-) diff --git a/catalogue/search.pl b/catalogue/search.pl index b723855d06..762d952ae7 100755 --- a/catalogue/search.pl +++ b/catalogue/search.pl @@ -263,7 +263,8 @@ $template->param( advancedsearchesloop => $advancedsearchesloop ); $template->param( searchid => scalar $cgi->param('searchid'), ); -my $default_sort_by = C4::Context->default_catalog_sort_by; +my $default_sort_by = C4::Context->default_catalog_sort_by; +my @sanitized_operators = grep { $_ ne 'cud-login' } $cgi->multi_param('op'); # The following should only be loaded if we're bringing up the advanced search template if ( $template_type eq 'advsearch' ) { @@ -274,7 +275,7 @@ if ( $template_type eq 'advsearch' ) { my $expanded = $cgi->param('expanded_options'); if ( $cgi->param('edit_search') ) { @operands = $cgi->multi_param('q'); - @operators = $cgi->multi_param('op'); + @operators = @sanitized_operators; @indexes = $cgi->multi_param('idx'); $template->param( sort => scalar $cgi->param('sort_by'), @@ -370,7 +371,7 @@ $template->param( 'sort_by' => $sort_by[0] ); # operators include boolean and proximity operators and are used # to evaluate multiple operands -my @operators = map uri_unescape($_), $cgi->multi_param('op'); +my @operators = map uri_unescape($_), @sanitized_operators; # indexes are query qualifiers, like 'title', 'author', etc. They # can be single or multiple parameters separated by comma: kw,right-Truncation -- 2.39.5