]> git.koha-community.org Git - koha.git/commit
Bug 37464: Validate "type" sent to barcode/svc
authorDavid Cook <dcook@prosentient.com.au>
Thu, 25 Jul 2024 06:56:18 +0000 (06:56 +0000)
committerTomas Cohen Arazi <tomascohen@theke.io>
Mon, 12 Aug 2024 18:35:10 +0000 (15:35 -0300)
commit1401959db423615034516ea6ad504680c14bad76
tree1e829f0f06c1b0160add3819bd2ead7b80f345c1
parent838de7c597ed06e333817add4eae9fc8b9a7d27b
Bug 37464: Validate "type" sent to barcode/svc

This change validates the "type" sent to the barcode/svc. Without this
change, we pass the user input directly to GD::Barcode, which passes
the input into an eval{} block without any validation of its own.

Test plan:
0. Apply the patch
1. koha-plack --reload kohadev
2. Go to http://localhost:8081/cgi-bin/koha/svc/barcode?type=bad&barcode=123456
3. Note that a Code39 barcode is provided for an invalid type
4. Go to http://localhost:8081/cgi-bin/koha/svc/barcode?type=Code39&barcode=123456
5. Note that a Code39 barcode is provided
6. Go to http://localhost:8081/cgi-bin/koha/svc/barcode?type=UPCE&barcode=123456
7. Note that a non-Code39 barcode is provided (presumably UPCE)

Signed-off-by: Victor Grousset/tuxayo <victor@tuxayo.net>
Signed-off-by: Aleisha Amohia <aleishaamohia@hotmail.com>
Signed-off-by: Tomas Cohen Arazi <tomascohen@theke.io>
(cherry picked from commit 73b0c3cf621250008845f22f7a36f90a48e00b06)
Signed-off-by: Tomas Cohen Arazi <tomascohen@theke.io>
svc/barcode