Typically, output_error should look like this: output_error( $cgi, '404' ); But reports/acquisitions_stats.pl calls it like this: C4::Output::output_error( $input, 'Possible SQL injection' ); 'Possible SQL injection' is not a valid errorno.
Created attachment 191333 [details] [review] Bug 41599: Fix output_error in acquisitions_stats.pl This patch changes the incorrect usage of output_error in acquisitions_stats.pl so that it uses a HTTP status code instead of an arbitrary string. Test plan: 0. Apply the patch and koha-plack --restart kohadev 1. Go to http://localhost:8081/cgi-bin/koha/reports/acquisitions_stats.pl 2. Use your F12 HTML inspector to find the "Line" radio buttons that you've selected and remove the values for those elements 3. Click "Submit" at the bottom of the screen 4. Note that you get a 403 error (if bug 30803 applied - otherwise it's a 404 error)
Created attachment 191342 [details] [review] Bug 41599: Fix output_error in acquisitions_stats.pl This patch changes the incorrect usage of output_error in acquisitions_stats.pl so that it uses a HTTP status code instead of an arbitrary string. Test plan: 0. Apply the patch and koha-plack --restart kohadev 1. Go to http://localhost:8081/cgi-bin/koha/reports/acquisitions_stats.pl 2. Use your F12 HTML inspector to find the "Line" radio buttons that you've selected and remove the values for those elements 3. Click "Submit" at the bottom of the screen 4. Note that you get a 403 error (if bug 30803 applied - otherwise it's a 404 error) Signed-off-by: Jonathan Druart <jonathan.druart@bugs.koha-community.org>