]> git.koha-community.org Git - koha.git/commit
Bug 37464: Validate "type" sent to barcode/svc
authorDavid Cook <dcook@prosentient.com.au>
Thu, 25 Jul 2024 06:56:18 +0000 (06:56 +0000)
committerTomas Cohen Arazi <tomascohen@theke.io>
Tue, 13 Aug 2024 14:53:59 +0000 (11:53 -0300)
commitf7d6d8754365da99721622736f18dd59eb3a03d1
treef8f7736de197c50a44805ce62cefe33fccf609eb
parent478c7aae22f7399d48cf1f9019bd83ab8fd7a7be
Bug 37464: Validate "type" sent to barcode/svc

This change validates the "type" sent to the barcode/svc. Without this
change, we pass the user input directly to GD::Barcode, which passes
the input into an eval{} block without any validation of its own.

Test plan:
0. Apply the patch
1. koha-plack --reload kohadev
2. Go to http://localhost:8081/cgi-bin/koha/svc/barcode?type=bad&barcode=123456
3. Note that a Code39 barcode is provided for an invalid type
4. Go to http://localhost:8081/cgi-bin/koha/svc/barcode?type=Code39&barcode=123456
5. Note that a Code39 barcode is provided
6. Go to http://localhost:8081/cgi-bin/koha/svc/barcode?type=UPCE&barcode=123456
7. Note that a non-Code39 barcode is provided (presumably UPCE)

Signed-off-by: Victor Grousset/tuxayo <victor@tuxayo.net>
Signed-off-by: Aleisha Amohia <aleishaamohia@hotmail.com>
Signed-off-by: Tomas Cohen Arazi <tomascohen@theke.io>
svc/barcode