| Summary: | selfreg - Patron's info are not correctly inserted if contain non-Latin characters | ||
|---|---|---|---|
| Product: | Koha | Reporter: | Jonathan Druart <jonathan.druart> |
| Component: | OPAC | Assignee: | Jonathan Druart <jonathan.druart> |
| Status: | CLOSED FIXED | QA Contact: | Testopia <testopia> |
| Severity: | major | ||
| Priority: | P5 - low | CC: | f.demians, julian.maurice, kyle, veron |
| Version: | unspecified | ||
| Hardware: | All | ||
| OS: | All | ||
| Change sponsored?: | --- | Patch complexity: | --- |
| Documentation contact: | Documentation submission: | ||
| Text to go in the release notes: | Version(s) released in: | ||
| Circulation function: | |||
| Attachments: |
Bug 17393: Fix non-Latin chars handling in self reg
Bug 17393: Fix non-Latin chars handling in self reg [PASSED QA] Bug 17393: Fix non-Latin chars handling in self reg |
||
|
Description
Jonathan Druart
2016-10-04 07:24:21 UTC
Created attachment 56006 [details] [review] Bug 17393: Fix non-Latin chars handling in self reg If you fill the patron self reg with non-latin characters, they will be encoded with HTML entities (é) This bug leads to generate a userid with weird behaviors: é => eacute ł => x Test plan: 0/ Do not apply the patch 1/ Set up the Self reg feature 2/ fill surname, fistname with something like "Michał pouéàç" 3/ Save 4/ See the bad encoding/replacement on the screen and look at the data The accentued chars are replaced with their html representation and the non-Latin chars with a 'x' in the DB 5/ Apply this patch 6/ Repeat steps 2, 3 7/ Everything should be ok 8/ Try to make sure this HTML::Entities escape was not useful: fill surname with "surname <script>alert("xss?")</script>" Save and look at the data Created attachment 56007 [details] [review] Bug 17393: Fix non-Latin chars handling in self reg If you fill the patron self reg with non-latin characters, they will be encoded with HTML entities (é) This bug leads to generate a userid with weird behaviors: é => eacute ł => x Test plan: 0/ Do not apply the patch 1/ Set up the Self reg feature 2/ fill surname, fistname with something like "Michał pouéàç" 3/ Save 4/ See the bad encoding/replacement on the screen and look at the data The accentued chars are replaced with their html representation and the non-Latin chars with a 'x' in the DB 5/ Apply this patch 6/ Repeat steps 2, 3 7/ Everything should be ok 8/ Try to make sure this HTML::Entities escape was not useful: fill surname with "surname <script>alert("xss?")</script>" Save and look at the data Followed test plan, works as expected. Signed-off-by: Marc Véron <veron@veron.ch> Created attachment 56149 [details] [review] [PASSED QA] Bug 17393: Fix non-Latin chars handling in self reg If you fill the patron self reg with non-latin characters, they will be encoded with HTML entities (é) This bug leads to generate a userid with weird behaviors: é => eacute ł => x Test plan: 0/ Do not apply the patch 1/ Set up the Self reg feature 2/ fill surname, fistname with something like "Michał pouéàç" 3/ Save 4/ See the bad encoding/replacement on the screen and look at the data The accentued chars are replaced with their html representation and the non-Latin chars with a 'x' in the DB 5/ Apply this patch 6/ Repeat steps 2, 3 7/ Everything should be ok 8/ Try to make sure this HTML::Entities escape was not useful: fill surname with "surname <script>alert("xss?")</script>" Save and look at the data Followed test plan, works as expected. Signed-off-by: Marc Véron <veron@veron.ch> Signed-off-by: Katrin Fischer <katrin.fischer@bsz-bw.de> Pushed to master for 16.11, thanks Jonathan! Pushed in 16.05. Will be in 16.05.05. Pushed in 3.22.x, will be in 3.22.12 |