]> git.koha-community.org Git - koha.git/commit
Bug 37464: Validate "type" sent to barcode/svc
authorDavid Cook <dcook@prosentient.com.au>
Thu, 25 Jul 2024 06:56:18 +0000 (06:56 +0000)
committerTomas Cohen Arazi <tomascohen@theke.io>
Tue, 13 Aug 2024 14:05:31 +0000 (11:05 -0300)
commitff7d9c255a40d38e2690efd9bd25c28e1af32840
tree8ac26da1193060775db51f1bd37838db66e28bdc
parent5dc4b625cbbd755bf68f336235cfd0d51b73cef2
Bug 37464: Validate "type" sent to barcode/svc

This change validates the "type" sent to the barcode/svc. Without this
change, we pass the user input directly to GD::Barcode, which passes
the input into an eval{} block without any validation of its own.

Test plan:
0. Apply the patch
1. koha-plack --reload kohadev
2. Go to http://localhost:8081/cgi-bin/koha/svc/barcode?type=bad&barcode=123456
3. Note that a Code39 barcode is provided for an invalid type
4. Go to http://localhost:8081/cgi-bin/koha/svc/barcode?type=Code39&barcode=123456
5. Note that a Code39 barcode is provided
6. Go to http://localhost:8081/cgi-bin/koha/svc/barcode?type=UPCE&barcode=123456
7. Note that a non-Code39 barcode is provided (presumably UPCE)

Signed-off-by: Victor Grousset/tuxayo <victor@tuxayo.net>
Signed-off-by: Aleisha Amohia <aleishaamohia@hotmail.com>
Signed-off-by: Tomas Cohen Arazi <tomascohen@theke.io>
svc/barcode