Koha/tools
David Cook dcd698a4b4
Bug 34349: Validate/escape inputs for task scheduler
This change validates and escapes inputs for task scheduler.

Test plan:
0. Apply patch
1. koha-plack --reload kohadev
2. Go to http://localhost:8081/cgi-bin/koha/tools/scheduler.pl
3. Input a time a minute in the future and leave the date blank
4. Choose an existing report and output format
5. Type a malicious string which is also a valid email address
into the Email field
6. Click "Save"
7. Note that the job is added but the Email is wrapped in single
quotes
8. Try using a non-malicious email address with a single quote.
9. Note that the single quote is escaped, so that it will still
be used by runreport.pl

JD amended patch: tidy

Signed-off-by: Jonathan Druart <jonathan.druart@bugs.koha-community.org>

Signed-off-by: Marcel de Rooy <m.de.rooy@rijksmuseum.nl>
[EDIT] Removed pars for $email =~ regex, removed old commented lines.
Signed-off-by: Tomas Cohen Arazi <tomascohen@theke.io>
2023-09-25 18:18:38 -03:00
..
csv-profiles
access_files.pl
additional-contents.pl Bug 34368: Add CSRF token to Content Management pages 2023-08-07 21:00:00 -03:00
ajax-inventory.pl
automatic_item_modification_by_age.pl
batch_delete_records.pl
batch_extend_due_dates.pl
batch_record_modification.pl
batch_records_ajax.pl
batchMod.pl Bug 34257: (QA follow-up): tidy up code 2023-09-12 09:45:05 -03:00
cleanborrowers.pl Bug 34441: Fixed Typo "Paramater" 2023-09-01 11:23:21 -03:00
copy-holidays.pl
csv-profiles.pl
exceptionHolidays.pl Bug 33667: Allow copying holidays to all libraries when editing 2023-07-06 10:08:45 -03:00
export.pl
holidays.pl
import_borrowers.pl
inventory.pl Bug 22135: Display 'shelved out of order' error in inventory CSV export 2023-09-05 14:35:38 -03:00
letter.pl
manage-marc-import.pl
marc_modification_templates.pl
modborrowers.pl Bug 34818: (bug 21083 follow-up) Fix batch patron modification tool 2023-09-19 16:34:15 -03:00
newHolidays.pl
overduerules.pl
page.pl
picture-upload.pl
problem-reports.pl
quotes-upload.pl
quotes.pl
scheduler.pl Bug 34349: Validate/escape inputs for task scheduler 2023-09-25 18:18:38 -03:00
showdiffmarc.pl
stage-marc-import.pl Bug 33755: Set profile_id and add missing import 2023-08-15 12:16:59 +03:00
stockrotation.pl
tools-home.pl
upload-cover-image.pl
upload-file.pl
upload.pl
viewlog.pl