From cd8608ab4e01fda66f119f7a93b8623e471005c6 Mon Sep 17 00:00:00 2001
From: David Cook <dcook@prosentient.com.au>
Date: Fri, 22 May 2026 04:05:16 +0000
Subject: [PATCH] Bug 42360: Also validate sep param

Signed-off-by: Sanjar Tulkinov Anvar o'g'li <sanjarbiy11@gmail.com>

Signed-off-by: Jonathan Druart <jonathan.druart@bugs.koha-community.org>
Signed-off-by: Lucas Gass <lucas@bywatersolutions.com>
---
 reports/acquisitions_stats.pl | 9 ++++++++-
 1 file changed, 8 insertions(+), 1 deletion(-)

diff --git a/reports/acquisitions_stats.pl b/reports/acquisitions_stats.pl
index c04bc95757..067ff11016 100755
--- a/reports/acquisitions_stats.pl
+++ b/reports/acquisitions_stats.pl
@@ -119,7 +119,14 @@ if ($basename_input) {
 #NOTE: Ideally it would be nice to validate the Filter parameter,
 #but that would take a fair bit of work...
 
-our $sep = C4::Context->csv_delimiter( scalar $input->param("sep") );
+#NOTE: Validate sep parameter
+our $sep = C4::Context->csv_delimiter();
+my $sep_input         = scalar $input->param("sep");
+my $delimiter_choices = GetDelimiterChoices();
+my %allowed_seps      = map { $_ => 1 } @{ $delimiter_choices->{values} };
+if ( $sep_input && $allowed_seps{$sep_input} ) {
+    $sep = $sep_input;
+}
 
 $template->param(
     do_it => $do_it,