Chris Cormack ed1c3b53b0 Bug 36520: Sanitize input in opac-sendbasket.pl ... To test 1/ Add some items to your cart in the opac 2/ Choose send cart 3/ Open firefox developer tools and switch to the network tab 4/ Send cart 5/ In the network tab, find the post request and choose copy as curl 6/ Edit the curl command to add )+AND+(SELECT+1+FROM+(SELECT(SLEEP(6)))x)--+- to the bib_list parameter 7/ Run the curl notice it takes a long time to respond, if you want to check run the curl without the above part added 8/ Apply the patch and restart plack 9/ Run the modified curl and notice no longer the slow down 10/ Test in browser and make sure the basket is still sent Signed-off-by: Amit Gupta <amit.gupta@informaticsglobal.com> Signed-off-by: Martin Renvoize <martin.renvoize@ptfs-europe.com> Signed-off-by: Victor Grousset/tuxayo <victor@tuxayo.net> Signed-off-by: Marcel de Rooy <m.de.rooy@rijksmuseum.nl> Signed-off-by: Wainui Witika-Park <wainuiwitikapark@catalyst.net.nz>		2024-05-31 03:05:15 +00:00
..
clubs	Bug 35941: (QA follow-up) Tidy clubs-tab.pl	2024-02-21 23:52:25 +00:00
errors	Bug 29420: HTTP status code incorrect when calling error pages directly under Plack/PSGI	2022-04-20 09:03:39 -10:00
external/overdrive	…
sci	…
sco	Bug 27342: Remove dbh from C4::Auth	2024-01-24 20:49:27 +00:00
svc	Bug 35942: OPAC user can enroll several times to the same club [23.05.x]	2024-02-27 01:49:06 +00:00
ilsdi.pl	Bug 30944: Undo change to ILS-DI documentation	2022-12-05 16:21:28 +00:00
maintenance.pl	…
oai.pl	…
opac-ISBDdetail.pl	Bug 29180: Rename syspref RequestOnOpac with OPACHoldRequests	2021-11-05 12:13:25 +01:00
opac-MARCdetail.pl	Bug 29180: Rename syspref RequestOnOpac with OPACHoldRequests	2021-11-05 12:13:25 +01:00
opac-account-pay-return.pl	…
opac-account-pay.pl	…
opac-account.pl	Bug 29844: Fix ->search occurrences	2022-02-09 15:36:23 -10:00
opac-addbybiblionumber.pl	Bug 26346: Add option to make public lists editable by all staff	2022-04-12 17:13:02 +02:00
opac-alert-subscribe.pl	…
opac-article-request-cancel.pl	…
opac-authorities-home.pl	…
opac-authoritiesdetail.pl	Bug 29435: include missing subroutine from C4::AuthoritiesMarc	2021-11-15 12:38:39 +01:00
opac-basket.pl	Bug 29871: Remove marcflavour param in Koha::Biblio->get_marc_notes	2022-07-12 15:54:27 +00:00
opac-blocked.pl	…
opac-browse.pl	…
opac-browser.pl	…
opac-changelanguage.pl	…
opac-course-details.pl	Bug 19532: (RM follow-up) More use of system preference	2022-03-14 23:11:12 -10:00
opac-course-reserves.pl	…
opac-detail.pl	Bug 30918: Allow passing filtered record to get_marc_notes	2022-07-29 17:19:15 +00:00
opac-discharge.pl	…
opac-downloadcart.pl	Bug 29859: Use iterator instead of as_list	2022-02-09 15:36:23 -10:00
opac-downloadshelf.pl	Bug 29859: Use iterator instead of as_list	2022-02-09 15:36:23 -10:00
opac-export.pl	…
opac-holdshistory.pl	…
opac-ics.pl	…
opac-idref.pl	…
opac-illrequests.pl	Bug 33702: (QA follow-up) Do not crash on borrowernumber	2023-05-22 15:41:24 +00:00
opac-image.pl	…
opac-imageviewer.pl	…
opac-issue-note.pl	Bug 29544: (QA follow-up) Simplify code	2022-02-02 21:05:29 -10:00
opac-library.pl	Bug 27360: Prevent crash if branchcode does not exist	2021-11-03 15:40:52 +01:00
opac-main.pl	Bug 28955: Impact News as well	2022-02-24 14:35:36 -10:00
opac-memberentry.pl	Bug 31531: Remove unnecessary use directives on opac-memberentry.pl	2022-10-31 22:05:44 +00:00
opac-messaging.pl	Bug 20439: Sort SMS providers in alphabetical order by DB field	2022-08-23 19:24:52 +00:00
opac-modrequest-suspend.pl	…
opac-modrequest.pl	…
opac-mymessages.pl	…
opac-news-rss.pl	…
opac-overdrive-search.pl	Bug 29318: Tidy the code	2021-10-26 16:46:03 +02:00
opac-passwd.pl	…
opac-password-recovery.pl	Bug 31739: Password recovery from staff fails if previous expired reset-entry exists.	2022-12-05 22:38:12 +00:00
opac-patron-consent.pl	…
opac-patron-image.pl	Bug 29931: (follow-up) Similar thing in opac-patron-image.pl	2022-03-15 22:30:50 -10:00
opac-privacy.pl	Bug 29843: Use in opac/opac-privacy.pl	2022-02-10 14:44:23 -10:00
opac-ratings-ajax.pl	Bug 28785: Adjust check_cookie_auth calls	2021-10-18 11:28:41 +02:00
opac-ratings.pl	…
opac-readingrecord.pl	Bug 28768: (QA follow-up) Remove unused variable	2021-11-05 12:17:08 +01:00
opac-recall.pl	Bug 30291: Changes to OPAC files	2022-05-05 11:17:36 -10:00
opac-recalls.pl	Bug 30291: Changes to OPAC files	2022-05-05 11:17:36 -10:00
opac-recordedbooks-search.pl	…
opac-registration-verify.pl	Bug 30237: Replace AutoEmailOpacUser with AutoEmailNewUser	2022-04-20 09:03:39 -10:00
opac-renew.pl	…
opac-reportproblem.pl	…
opac-request-article.pl	Bug 36072: opac-request-article should check syspref	2024-02-21 23:07:44 +00:00
opac-reserve.pl	Bug 33302: Send and display errors when a hold cannot be placed on the OPAC	2023-06-15 16:56:27 +00:00
opac-reset-password.pl	Bug 29925: Add a password reset page for expired passwords	2022-05-06 10:33:09 -10:00
opac-restrictedpage.pl	…
opac-retrieve-file.pl	…
opac-review.pl	…
opac-routing-lists.pl	…
opac-search-history.pl	Bug 30377: Fix two CGI::param called in list context-warnings	2022-04-04 16:23:46 +02:00
opac-search.pl	Bug 34023: Prevent HTML injection in "back to results" link from search page	2023-08-03 16:40:02 -03:00
opac-sendbasket.pl	Bug 36520: Sanitize input in opac-sendbasket.pl	2024-05-31 03:05:15 +00:00
opac-sendshelf.pl	Bug 27266: (QA follow-up) Remove GetBiblioData from sendshelf too	2021-12-15 12:16:10 -10:00
opac-serial-issues.pl	…
opac-shareshelf.pl	Bug 28959: Fix other cases	2021-10-28 17:47:38 +02:00
opac-shelves.pl	Bug 26346: Add option to make public lists editable by all staff	2022-04-12 17:13:02 +02:00
opac-showmarc.pl	…
opac-showreviews.pl	…
opac-suggestions.pl	Bug 29311: (QA follow-up) Fix an existing spelling typo	2023-05-05 21:49:27 +00:00
opac-tags.pl	Bug 29669: fix uninitialized value warnings when XSLTParse4Display is called	2021-12-16 12:13:51 -10:00
opac-tags_subject.pl	…
opac-topissues.pl	Bug 17018: Split AdvancedSearchTypes for staff and OPAC	2022-04-12 17:13:02 +02:00
opac-user.pl	Bug 30291: Changes to OPAC files	2022-05-05 11:17:36 -10:00
tracklinks.pl	Bug 30262: Trim whitespace off tracklinks.pl URLs	2022-10-31 17:57:09 +00:00
unapi	Bug 17600: Fix opac/unapi	2021-11-22 11:04:51 +01:00