Bug 41599 - reports/acquisitions_stats.pl calls output_error incorrectly
Summary: reports/acquisitions_stats.pl calls output_error incorrectly
Status: Signed Off
Alias: None
Product: Koha
Classification: Unclassified
Component: Architecture, internals, and plumbing (show other bugs)
Version: Main
Hardware: All All
: P5 - low minor
Assignee: David Cook
QA Contact: Testopia
URL:
Keywords:
Depends on: 30803
Blocks:
  Show dependency treegraph
 
Reported: 2026-01-13 00:12 UTC by David Cook
Modified: 2026-01-13 09:17 UTC (History)
0 users

See Also:
GIT URL:
Initiative type: ---
Sponsorship status: ---
Comma delimited list of Sponsors:
Crowdfunding goal: 0
Patch complexity: ---
Documentation contact:
Documentation submission:
Text to go in the release notes:
Version(s) released in:
Circulation function:


Attachments
Bug 41599: Fix output_error in acquisitions_stats.pl (1.28 KB, patch)
2026-01-13 02:15 UTC, David Cook
Details | Diff | Splinter Review
Bug 41599: Fix output_error in acquisitions_stats.pl (1.35 KB, patch)
2026-01-13 09:17 UTC, Jonathan Druart
Details | Diff | Splinter Review

Note You need to log in before you can comment on or make changes to this bug.
Description David Cook 2026-01-13 00:12:36 UTC
Typically, output_error should look like this:

output_error( $cgi, '404' );

But reports/acquisitions_stats.pl calls it like this:

C4::Output::output_error( $input, 'Possible SQL injection' );

'Possible SQL injection' is not a valid errorno.
Comment 1 David Cook 2026-01-13 02:15:21 UTC
Created attachment 191333 [details] [review]
Bug 41599: Fix output_error in acquisitions_stats.pl

This patch changes the incorrect usage of output_error
in acquisitions_stats.pl so that it uses a HTTP status
code instead of an arbitrary string.

Test plan:
0. Apply the patch and koha-plack --restart kohadev
1. Go to http://localhost:8081/cgi-bin/koha/reports/acquisitions_stats.pl
2. Use your F12 HTML inspector to find the "Line" radio buttons that you've
selected and remove the values for those elements
3. Click "Submit" at the bottom of the screen
4. Note that you get a 403 error (if bug 30803 applied - otherwise it's a 404 error)
Comment 2 Jonathan Druart 2026-01-13 09:17:53 UTC
Created attachment 191342 [details] [review]
Bug 41599: Fix output_error in acquisitions_stats.pl

This patch changes the incorrect usage of output_error
in acquisitions_stats.pl so that it uses a HTTP status
code instead of an arbitrary string.

Test plan:
0. Apply the patch and koha-plack --restart kohadev
1. Go to http://localhost:8081/cgi-bin/koha/reports/acquisitions_stats.pl
2. Use your F12 HTML inspector to find the "Line" radio buttons that you've
selected and remove the values for those elements
3. Click "Submit" at the bottom of the screen
4. Note that you get a 403 error (if bug 30803 applied - otherwise it's a 404 error)

Signed-off-by: Jonathan Druart <jonathan.druart@bugs.koha-community.org>