Bug 13806 - No input sanitization where creating Reports subgroup
Summary: No input sanitization where creating Reports subgroup
Status: RESOLVED FIXED
Alias: None
Product: Koha
Classification: Unclassified
Component: Reports (show other bugs)
Version: master
Hardware: All All
: P5 - low minor (vote)
Assignee: Owen Leonard
QA Contact: Testopia
URL:
Keywords:
Depends on:
Blocks:
 
Reported: 2015-03-06 14:56 UTC by Pablo AB
Modified: 2020-06-04 20:37 UTC (History)
3 users (show)

See Also:
Change sponsored?: ---
Patch complexity: Small patch
Who signed the patch off:
Text to go in the release notes:
Version(s) released in:
20.05.00, 19.11.01, 19.05.07, 18.11.13


Attachments
Bug 13806: No input sanitization where creating Reports subgroup (9.11 KB, patch)
2019-11-22 17:45 UTC, Owen Leonard
Details | Diff | Splinter Review
Bug 13806: No input sanitization where creating Reports subgroup (9.25 KB, patch)
2019-11-26 10:46 UTC, Séverine Queune
Details | Diff | Splinter Review
Bug 13806: No input sanitization where creating Reports subgroup (9.33 KB, patch)
2019-12-05 11:13 UTC, Jonathan Druart
Details | Diff | Splinter Review
Bug 13806: Sanitize inputs where creating Reports subgroup (9.32 KB, patch)
2019-12-05 11:47 UTC, Jonathan Druart
Details | Diff | Splinter Review

Note You need to log in before you can comment on or make changes to this bug.
Description Pablo AB 2015-03-06 14:56:26 UTC
Since Bug 7993 there is a way to put Reports on subgroups. Koha let you create a new subgroup just typing a "code" (authorised_value), but without "name" (lib field on authorised_values table). That makes an empty entry on select drop-down that should be deleted (if there is no reports in it) from authorised_values table.
Both code and name should be mandatory fields while creating report subgroups.
Comment 1 Owen Leonard 2019-11-22 17:45:36 UTC
Created attachment 95733 [details] [review]
Bug 13806: No input sanitization where creating Reports subgroup

This patch adds validation of report group and subgroup inputs so that
the user can't enter data into only one half of the group code/name
pair.

To test, apply the patch and go to Reports -> Use saved.

  - Create or edit a report which doesn't have a group or subgroup
    assigned.

  - Under "Report group," select the "or create" radio button.

  - Click the "Update SQL" button to submit the form without entering a
    group code or name. The form should require taht you enter data into
    both fields.

  - Enter data into the report group code and name fields. Add data to
    either the code or data field under "Report subgroup." You should
    not be able to submit the form without populating both.

  - Start over editing a report which doesn't have a group or subgroup
    assigned.

    - Select an existing group under "Report group."

    - Under "Report subgroup," select the "or create" option.

      - You should not be able to submit the form without adding data in
        both the code and name fields for the report subgroup.
Comment 2 Séverine Queune 2019-11-26 10:46:35 UTC
Created attachment 95817 [details] [review]
Bug 13806: No input sanitization where creating Reports subgroup

This patch adds validation of report group and subgroup inputs so that
the user can't enter data into only one half of the group code/name
pair.

To test, apply the patch and go to Reports -> Use saved.

  - Create or edit a report which doesn't have a group or subgroup
    assigned.

  - Under "Report group," select the "or create" radio button.

  - Click the "Update SQL" button to submit the form without entering a
    group code or name. The form should require taht you enter data into
    both fields.

  - Enter data into the report group code and name fields. Add data to
    either the code or data field under "Report subgroup." You should
    not be able to submit the form without populating both.

  - Start over editing a report which doesn't have a group or subgroup
    assigned.

    - Select an existing group under "Report group."

    - Under "Report subgroup," select the "or create" option.

      - You should not be able to submit the form without adding data in
        both the code and name fields for the report subgroup.

Signed-off-by: Séverine QUEUNE <severine.queune@bulac.fr>
Comment 3 Jonathan Druart 2019-12-05 11:13:41 UTC
Created attachment 96010 [details] [review]
Bug 13806: No input sanitization where creating Reports subgroup

This patch adds validation of report group and subgroup inputs so that
the user can't enter data into only one half of the group code/name
pair.

To test, apply the patch and go to Reports -> Use saved.

  - Create or edit a report which doesn't have a group or subgroup
    assigned.

  - Under "Report group," select the "or create" radio button.

  - Click the "Update SQL" button to submit the form without entering a
    group code or name. The form should require taht you enter data into
    both fields.

  - Enter data into the report group code and name fields. Add data to
    either the code or data field under "Report subgroup." You should
    not be able to submit the form without populating both.

  - Start over editing a report which doesn't have a group or subgroup
    assigned.

    - Select an existing group under "Report group."

    - Under "Report subgroup," select the "or create" option.

      - You should not be able to submit the form without adding data in
        both the code and name fields for the report subgroup.

Signed-off-by: Séverine QUEUNE <severine.queune@bulac.fr>

Signed-off-by: Jonathan Druart <jonathan.druart@bugs.koha-community.org>
Comment 4 Jonathan Druart 2019-12-05 11:47:11 UTC
Created attachment 96014 [details] [review]
Bug 13806: Sanitize inputs where creating Reports subgroup

This patch adds validation of report group and subgroup inputs so that
the user can't enter data into only one half of the group code/name
pair.

To test, apply the patch and go to Reports -> Use saved.

  - Create or edit a report which doesn't have a group or subgroup
    assigned.

  - Under "Report group," select the "or create" radio button.

  - Click the "Update SQL" button to submit the form without entering a
    group code or name. The form should require taht you enter data into
    both fields.

  - Enter data into the report group code and name fields. Add data to
    either the code or data field under "Report subgroup." You should
    not be able to submit the form without populating both.

  - Start over editing a report which doesn't have a group or subgroup
    assigned.

    - Select an existing group under "Report group."

    - Under "Report subgroup," select the "or create" option.

      - You should not be able to submit the form without adding data in
        both the code and name fields for the report subgroup.

Signed-off-by: Séverine QUEUNE <severine.queune@bulac.fr>

Signed-off-by: Jonathan Druart <jonathan.druart@bugs.koha-community.org>
Comment 5 Martin Renvoize 2019-12-13 15:31:46 UTC
Nice work everyone!

Pushed to master for 20.05
Comment 6 Joy Nelson 2019-12-20 17:02:13 UTC
Pushed to 19.11.01
Comment 7 Lucas Gass 2020-01-06 22:39:49 UTC
backported to 19.05.x for 19.05.07
Comment 8 Hayley Mapley 2020-01-10 00:19:25 UTC
Backported to 18.11.x for 18.11.13