From b500eb9eb67f782e178ee06863d97541e21ff3aa Mon Sep 17 00:00:00 2001 From: Martin Persson Date: Wed, 5 Aug 2015 16:16:50 +0200 Subject: [PATCH] Bug 14764: OPAC news selector - URL parameter This patch adds an URL-based override for the homebranch variable in opac-main.pl. Allows viewing of arbitrary branches. Possible security issue: The user changes branch parameter to perform SQL or XSS injection. This would not be possible via the database, as the foreign key constraint would block arbitrary code. However, the News retrieval function is using prepared statements which are immune to this. --- opac/opac-main.pl | 3 +++ 1 file changed, 3 insertions(+) diff --git a/opac/opac-main.pl b/opac/opac-main.pl index b0904c5..02d4de2 100755 --- a/opac/opac-main.pl +++ b/opac/opac-main.pl @@ -51,6 +51,9 @@ my $homebranch; if (C4::Context->userenv) { $homebranch = C4::Context->userenv->{'branch'}; } +if (defined $input->param('branch')) { + $homebranch = $input->param('branch'); +} my $all_koha_news = &GetNewsToDisplay($news_lang,$homebranch); my $koha_news_count = scalar @$all_koha_news; -- 2.1.4