Bugzilla – Attachment 23249 Details for
Bug 11322
Suggestion "notes" field should be sanitized or escaped
Home
|
New
|
Browse
|
Search
|
[?]
|
Reports
|
Help
|
New Account
|
Log In
[x]
|
Forgot Password
Login:
[x]
[patch]
[PASSED QA] Bug 11322 : XSS - Scrub bad data before storing suggestions in the db
PASSED-QA-Bug-11322--XSS---Scrub-bad-data-before-s.patch (text/plain), 1.63 KB, created by
Katrin Fischer
on 2013-12-02 23:51:10 UTC
(
hide
)
Description:
[PASSED QA] Bug 11322 : XSS - Scrub bad data before storing suggestions in the db
Filename:
MIME Type:
Creator:
Katrin Fischer
Created:
2013-12-02 23:51:10 UTC
Size:
1.63 KB
patch
obsolete
>From b4fb9101e8d42701c7e3b49fb1f1357cfed52952 Mon Sep 17 00:00:00 2001 >From: Chris Cormack <chrisc@catalyst.net.nz> >Date: Tue, 3 Dec 2013 12:01:23 +1300 >Subject: [PATCH] [PASSED QA] Bug 11322 : XSS - Scrub bad data before storing > suggestions in the db > >1/ In the public interface, add a suggestion containing html >2/ Save, notice the html is rendered (or if you have the other patches >is displayed) >3/ Apply this paget >4/ Add another suggestion >5/ Notice the html is stripped > >Signed-off-by: David Cook <dcook@prosentient.com.au> > >Works as described. > >Signed-off-by: Katrin Fischer <Katrin.Fischer.83@web.de> >--- > opac/opac-suggestions.pl | 6 ++++++ > 1 file changed, 6 insertions(+) > >diff --git a/opac/opac-suggestions.pl b/opac/opac-suggestions.pl >index 32b5c3d..72383eb 100755 >--- a/opac/opac-suggestions.pl >+++ b/opac/opac-suggestions.pl >@@ -27,6 +27,7 @@ use C4::Output; > use C4::Suggestions; > use C4::Koha; > use C4::Dates; >+use C4::Scrubber; > > my $input = new CGI; > my $allsuggestions = $input->param('showall'); >@@ -77,8 +78,13 @@ if ( $op eq "add_confirm" ) { > #some suggestion are answering the request Donot Add > } > else { >+ my $scrubber = C4::Scrubber->new(); >+ foreach my $suggest (keys %$suggestion){ >+ $suggestion->{$suggest} = $scrubber->scrub($suggestion->{$suggest}); >+ } > $$suggestion{'suggesteddate'}=C4::Dates->today; > $$suggestion{'branchcode'}= $input->param('branch') || C4::Context->userenv->{"branch"}; >+ > &NewSuggestion($suggestion); > # empty fields, to avoid filter in "SearchSuggestion" > $$suggestion{$_}='' foreach qw<title author publishercode copyrightdate place collectiontitle isbn STATUS>; >-- >1.8.3.2
You cannot view the attachment while viewing its details because your browser does not support IFRAMEs.
View the attachment on a separate page
.
View Attachment As Diff
View Attachment As Raw
Actions:
View
|
Diff
|
Splinter Review
Attachments on
bug 11322
:
23241
|
23242
|
23243
|
23244
|
23245
|
23246
|
23247
|
23248
| 23249