Bug 15197 - In Rancor, multiple &/</" characters not escaped on saving
Summary: In Rancor, multiple &/</" characters not escaped on saving
Status: CLOSED FIXED
Alias: None
Product: Koha
Classification: Unclassified
Component: Cataloging (show other bugs)
Version: master
Hardware: All All
: P5 - low critical (vote)
Assignee: Jesse Weaver
QA Contact: Testopia
URL:
Keywords:
Depends on:
Blocks:
 
Reported: 2015-11-16 21:41 UTC by Jesse Weaver
Modified: 2019-06-27 09:24 UTC (History)
2 users (show)

See Also:
Change sponsored?: ---
Patch complexity: Trivial patch
Documentation contact:
Documentation submission:
Text to go in the release notes:
Version(s) released in:


Attachments
Bug 15197: In Rancor, multiple &/</> characters not escaped on saving (943 bytes, patch)
2015-11-16 21:49 UTC, Jesse Weaver
Details | Diff | Splinter Review
Bug 15197: In Rancor, multiple &/</" characters not escaped on saving (943 bytes, patch)
2015-11-16 21:54 UTC, Jesse Weaver
Details | Diff | Splinter Review
Bug 15197: In Rancor, multiple &/</" characters not escaped on saving (1.16 KB, patch)
2015-11-16 21:58 UTC, Jesse Weaver
Details | Diff | Splinter Review
[SIGNED-OFF] Bug 15197: In Rancor, multiple &/</" characters not escaped on saving (1.27 KB, patch)
2015-11-16 22:35 UTC, Bernardo Gonzalez Kriegel
Details | Diff | Splinter Review
[PASSED QA] Bug 15197: In Rancor, multiple &/</" characters not escaped on saving (1.33 KB, patch)
2015-11-17 11:37 UTC, Katrin Fischer
Details | Diff | Splinter Review

Note You need to log in before you can comment on or make changes to this bug.
Description Jesse Weaver 2015-11-16 21:41:58 UTC
Due to a slight regex issue, multiple special characters will not be correctly escaped when saving a record, and data loss may occur.
Comment 1 Jesse Weaver 2015-11-16 21:49:12 UTC Comment hidden (obsolete)
Comment 2 Jesse Weaver 2015-11-16 21:54:10 UTC Comment hidden (obsolete)
Comment 3 Jesse Weaver 2015-11-16 21:54:52 UTC
Test plan:

  1) On current master, create a record in Rancor containing multiple <, > or & characters ("A & B & C", for example).
  2) Try to save the record, it will silently fail.
  3) Apply this patch.
  4) The record should now save correctly.
Comment 4 Jesse Weaver 2015-11-16 21:56:44 UTC
(In reply to Jesse Weaver from comment #3)
> Test plan:
> 
>   1) On current master, create a record in Rancor containing multiple <, >
> or & characters ("A & B & C", for example).
>   2) Try to save the record, it will silently fail.
>   3) Apply this patch.
>   4) The record should now save correctly.

Ugh, I shouldn't comment when tired. The characters in question are <, & and ".
Comment 5 Jesse Weaver 2015-11-16 21:58:35 UTC Comment hidden (obsolete)
Comment 6 Bernardo Gonzalez Kriegel 2015-11-16 22:35:15 UTC Comment hidden (obsolete)
Comment 7 Katrin Fischer 2015-11-17 11:37:20 UTC
Created attachment 44905 [details] [review]
[PASSED QA] Bug 15197: In Rancor, multiple &/</" characters not escaped on saving

Test plan:

  1) On current master, create a record in Rancor containing multiple &, < or " characters ("A & B & C", for example).
  2) Try to save the record, it will silently fail.
  3) Apply this patch.
  4) The record should now save correctly.

Signed-off-by: Bernardo Gonzalez Kriegel <bgkriegel@gmail.com>
Works well, record saved
No errors

Signed-off-by: Katrin Fischer <katrin.fischer.83@web.de>
Comment 8 Tomás Cohen Arazi 2015-11-17 12:56:56 UTC
Patch pushed to master.

Thanks Jonathan!