Bug 17393

Summary: selfreg - Patron's info are not correctly inserted if contain non-Latin characters
Product: Koha Reporter: Jonathan Druart <jonathan.druart>
Component: OPACAssignee: Jonathan Druart <jonathan.druart>
Status: CLOSED FIXED QA Contact: Testopia <testopia>
Severity: major    
Priority: P5 - low CC: f.demians, julian.maurice, kyle, veron
Version: unspecified   
Hardware: All   
OS: All   
Change sponsored?: --- Patch complexity: ---
Documentation contact: Documentation submission:
Text to go in the release notes:
Version(s) released in:
Attachments: Bug 17393: Fix non-Latin chars handling in self reg
Bug 17393: Fix non-Latin chars handling in self reg
[PASSED QA] Bug 17393: Fix non-Latin chars handling in self reg

Description Jonathan Druart 2016-10-04 07:24:21 UTC
If you fill the patron self reg with non-latin characters, they will be encoded with HTML entities (&eacute;)
This bug leads to generate a userid with weird behaviors:
é => eacute
ł => x
Comment 1 Jonathan Druart 2016-10-04 07:38:01 UTC
Created attachment 56006 [details] [review]
Bug 17393: Fix non-Latin chars handling in self reg

If you fill the patron self reg with non-latin characters, they will be
encoded with HTML entities (&eacute;)
This bug leads to generate a userid with weird behaviors:
é => eacute
ł => x

Test plan:
0/ Do not apply the patch
1/ Set up the Self reg feature
2/ fill surname, fistname with something like "Michał pouéàç"
3/ Save
4/ See the bad encoding/replacement on the screen and look at the data
The accentued chars are replaced with their html representation and the
non-Latin chars with a 'x'
in the DB
5/ Apply this patch
6/ Repeat steps 2, 3
7/ Everything should be ok
8/ Try to make sure this HTML::Entities escape was not useful:
fill surname with "surname <script>alert("xss?")</script>"
Save and look at the data
Comment 2 Marc Véron 2016-10-04 08:16:45 UTC
Created attachment 56007 [details] [review]
Bug 17393: Fix non-Latin chars handling in self reg

If you fill the patron self reg with non-latin characters, they will be
encoded with HTML entities (&eacute;)
This bug leads to generate a userid with weird behaviors:
é => eacute
ł => x

Test plan:
0/ Do not apply the patch
1/ Set up the Self reg feature
2/ fill surname, fistname with something like "Michał pouéàç"
3/ Save
4/ See the bad encoding/replacement on the screen and look at the data
The accentued chars are replaced with their html representation and the
non-Latin chars with a 'x'
in the DB
5/ Apply this patch
6/ Repeat steps 2, 3
7/ Everything should be ok
8/ Try to make sure this HTML::Entities escape was not useful:
fill surname with "surname <script>alert("xss?")</script>"
Save and look at the data

Followed test plan, works as expected.
Signed-off-by: Marc Véron <veron@veron.ch>
Comment 3 Katrin Fischer 2016-10-11 09:24:34 UTC
Created attachment 56149 [details] [review]
[PASSED QA] Bug 17393: Fix non-Latin chars handling in self reg

If you fill the patron self reg with non-latin characters, they will be
encoded with HTML entities (&eacute;)
This bug leads to generate a userid with weird behaviors:
é => eacute
ł => x

Test plan:
0/ Do not apply the patch
1/ Set up the Self reg feature
2/ fill surname, fistname with something like "Michał pouéàç"
3/ Save
4/ See the bad encoding/replacement on the screen and look at the data
The accentued chars are replaced with their html representation and the
non-Latin chars with a 'x'
in the DB
5/ Apply this patch
6/ Repeat steps 2, 3
7/ Everything should be ok
8/ Try to make sure this HTML::Entities escape was not useful:
fill surname with "surname <script>alert("xss?")</script>"
Save and look at the data

Followed test plan, works as expected.
Signed-off-by: Marc Véron <veron@veron.ch>

Signed-off-by: Katrin Fischer  <katrin.fischer@bsz-bw.de>
Comment 4 Kyle M Hall 2016-10-21 14:22:11 UTC
Pushed to master for 16.11, thanks Jonathan!
Comment 5 Frédéric Demians 2016-10-22 13:00:23 UTC
Pushed in 16.05. Will be in 16.05.05.
Comment 6 Julian Maurice 2016-10-24 10:40:23 UTC
Pushed in 3.22.x, will be in 3.22.12