Copied from Bug 22318: Moving the contents of OpacNavRight to opac_news fails due to improper (no?) escaping: DBD::mysql::db do failed: You have an error in your SQL syntax; check the manual that corresponds to your MariaDB server version for the right syntax to use near 'http':'https';if(!d.getElementById(id)){js=d.createElement(s);js.id=id;js.src=p+' at line 1 [for Statement "INSERT INTO opac_news (branchcode, lang, title, content ) VALUES (NULL, 'OpacNavRight_en', '', ' <a class="twitter-timeline" href="https://twitter.com/ETFLibrary" data-widget-id="702160486524186624">Tweets by @ETFLibrary</a> <script>!function(d,s,id){var js,fjs=d.getElementsByTagName(s)[0],p=/^http:/.test(d.location)?'http':'https';if(!d.getElementById(id)){js=d.createElement(s);js.id=id;js.src=p+"://platform.twitter.com/widgets.js";fjs.parentNode.insertBefore(js,fjs);}}(document,"script","twitter-wjs");</script> ')"] at /usr/share/koha/intranet/cgi-bin/installer/data/mysql/updatedatabase.pl line 18220. In this example, OpacNavRight contains a script to embed a Twitter timeline.
Created attachment 90494 [details] [review] Bug 23093: (bug 22318 follow-up) Use placeholders in query moving OpacNavRight Placeholders must be used (!) in all SQL queries. Test plan: 1/ % git checkout 0c95e22afe13349b60d134217fce6718bfa9727f # commit before bug 22318 2/ Edit the pref OpacNavRight with something with " just a " and more ' 3/ git checkout master 4/ restart_all 5/ run updatedatabase.pl => Boom and the content of the pref has been lost 6/ Repeat 1 to 3 7/ Apply this patch 8/ run updatedatabase.pl => The pref has been correctly moved to opac_news
Created attachment 90500 [details] [review] Bug 23093: (bug 22318 follow-up) Use placeholders in query moving OpacNavRight Placeholders must be used (!) in all SQL queries. Test plan: 1/ % git checkout 0c95e22afe13349b60d134217fce6718bfa9727f # commit before bug 22318 2/ Edit the pref OpacNavRight with something with " just a " and more ' 3/ git checkout master 4/ restart_all 5/ run updatedatabase.pl => Boom and the content of the pref has been lost 6/ Repeat 1 to 3 7/ Apply this patch 8/ run updatedatabase.pl => The pref has been correctly moved to opac_news Signed-off-by: Mark Tompsett <mtompset@hotmail.com>
Created attachment 90531 [details] [review] Bug 23093: (bug 22318 follow-up) Use placeholders in query moving OpacNavRight Placeholders must be used (!) in all SQL queries. Test plan: 1/ % git checkout 0c95e22afe13349b60d134217fce6718bfa9727f # commit before bug 22318 2/ Edit the pref OpacNavRight with something with " just a " and more ' 3/ git checkout master 4/ restart_all 5/ run updatedatabase.pl => Boom and the content of the pref has been lost 6/ Repeat 1 to 3 7/ Apply this patch 8/ run updatedatabase.pl => The pref has been correctly moved to opac_news Signed-off-by: Mark Tompsett <mtompset@hotmail.com> Signed-off-by: Nick Clemens <nick@bywatersolutions.com>
Nice work! Pushed to master for 19.11.00
Pushed to 19.05.x for 19.05.01