Bug 41599

Summary: reports/acquisitions_stats.pl calls output_error incorrectly
Product: Koha Reporter: David Cook <dcook>
Component: Architecture, internals, and plumbingAssignee: David Cook <dcook>
Status: Signed Off --- QA Contact: Testopia <testopia>
Severity: minor    
Priority: P5 - low    
Version: Main   
Hardware: All   
OS: All   
See Also: https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=30803
GIT URL: Initiative type: ---
Sponsorship status: --- Comma delimited list of Sponsors:
Crowdfunding goal: 0 Patch complexity: ---
Documentation contact: Documentation submission:
Text to go in the release notes:
Version(s) released in:
Circulation function:
Bug Depends on: 30803    
Bug Blocks:    
Attachments: Bug 41599: Fix output_error in acquisitions_stats.pl
Bug 41599: Fix output_error in acquisitions_stats.pl

Description David Cook 2026-01-13 00:12:36 UTC
Typically, output_error should look like this:

output_error( $cgi, '404' );

But reports/acquisitions_stats.pl calls it like this:

C4::Output::output_error( $input, 'Possible SQL injection' );

'Possible SQL injection' is not a valid errorno.
Comment 1 David Cook 2026-01-13 02:15:21 UTC
Created attachment 191333 [details] [review]
Bug 41599: Fix output_error in acquisitions_stats.pl

This patch changes the incorrect usage of output_error
in acquisitions_stats.pl so that it uses a HTTP status
code instead of an arbitrary string.

Test plan:
0. Apply the patch and koha-plack --restart kohadev
1. Go to http://localhost:8081/cgi-bin/koha/reports/acquisitions_stats.pl
2. Use your F12 HTML inspector to find the "Line" radio buttons that you've
selected and remove the values for those elements
3. Click "Submit" at the bottom of the screen
4. Note that you get a 403 error (if bug 30803 applied - otherwise it's a 404 error)
Comment 2 Jonathan Druart 2026-01-13 09:17:53 UTC
Created attachment 191342 [details] [review]
Bug 41599: Fix output_error in acquisitions_stats.pl

This patch changes the incorrect usage of output_error
in acquisitions_stats.pl so that it uses a HTTP status
code instead of an arbitrary string.

Test plan:
0. Apply the patch and koha-plack --restart kohadev
1. Go to http://localhost:8081/cgi-bin/koha/reports/acquisitions_stats.pl
2. Use your F12 HTML inspector to find the "Line" radio buttons that you've
selected and remove the values for those elements
3. Click "Submit" at the bottom of the screen
4. Note that you get a 403 error (if bug 30803 applied - otherwise it's a 404 error)

Signed-off-by: Jonathan Druart <jonathan.druart@bugs.koha-community.org>