gitea
/
Koha-clms
1
0
Fork 0
Code Issues Pull Requests Packages Projects Releases Wiki Activity

Bug 28409: Comprehensively validate category in opac-shelves.pl 

Default to a category of 1 (ie Private). Only allow input of 1
or 2 (ie Public)

== Test plan ==
1. Go to http://localhost:8080/cgi-bin/koha/opac-shelves.pl?category=function(){window.location.href%20=%20%27https://git.koha-community.org/stats/koha-master/authors.html%27}()
2. Note that you are redirected to another website
3. Go to http://localhost:8080/cgi-bin/koha/opac-shelves.pl?op=add&shelfname=foo&category=9
4. Note that you can't see this list in the Lists (but it has been added to the database)
5. Apply the patch & restart services
6. Go to http://localhost:8080/cgi-bin/koha/opac-shelves.pl?category=function(){window.location.href%20=%20%27https://git.koha-community.org/stats/koha-master/authors.html%27}()
7. Note that you are not redirected to another website
8. Go to http://localhost:8080/cgi-bin/koha/opac-shelves.pl?op=add&shelfname=bar&category=9
9. Note that "bar" has been added as a Private list

Signed-off-by: Victor Grousset/tuxayo <victor@tuxayo.net>

Signed-off-by: Kyle M Hall <kyle@bywatersolutions.com>
Signed-off-by: Victor Grousset/tuxayo <victor@tuxayo.net>
(cherry picked from commit fa3adb5c05535f73666b06acab95518c9267abc1)
Signed-off-by: Wainui Witika-Park <wainuiwitikapark@catalyst.net.nz>
(cherry picked from commit fa3adb5c05535f73666b06acab95518c9267abc1)
This commit is contained in:
David Cook 2021-05-21 06:52:25 +00:00 committed by Wainui Witika-Park
parent 6928a0aaa8
commit 030d306944
1 changed files with 11 additions and 3 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

14
opac/opac-shelves.pl
View File

@ -60,7 +60,15 @@ my ( $template, $loggedinuser, $cookie ) = get_template_and_user({
my $op = $query->param('op') || 'list';
my $referer = $query->param('referer') || $op;
my $category = $query->param('category') || 1;
my $category = 1;
if ( $query->param('category') && (
($query->param('category') == 1) ||
($query->param('category') == 2)
)
){
$category = $query->param('category');
}
my ( $shelf, $shelfnumber, @messages );
if ( $op eq 'add_form' ) {
@ -88,7 +96,7 @@ if ( $op eq 'add_form' ) {
$shelf = Koha::Virtualshelf->new(
{ shelfname => scalar $query->param('shelfname'),
sortfield => scalar $query->param('sortfield'),
category => scalar $query->param('category') || 1,
category => $category || 1,
allow_change_from_owner => $allow_changes_from > 0,
allow_change_from_others => $allow_changes_from == ANYONE,
owner => scalar $loggedinuser,
@ -122,7 +130,7 @@ if ( $op eq 'add_form' ) {
my $allow_changes_from = $query->param('allow_changes_from');
$shelf->allow_change_from_owner( $allow_changes_from > 0 );
$shelf->allow_change_from_others( $allow_changes_from == ANYONE );
$shelf->category( scalar $query->param('category') );
$shelf->category( $category );
eval { $shelf->store };
if ($@) {