]> git.koha-community.org Git - koha.git/commit
Bug 36875: Do not pass unsanitized language to $page->translated_content
authorMarcel de Rooy <m.de.rooy@rijksmuseum.nl>
Thu, 16 May 2024 07:19:30 +0000 (07:19 +0000)
committerFridolin Somers <fridolin.somers@biblibre.com>
Thu, 6 Jun 2024 08:49:20 +0000 (10:49 +0200)
commit2e54e781c5f4a09603f77cca1816511d4eec7407
tree381c3d926a4325a6ff3840051f89b6caaf7ad628
parentcbb2fd5c010da180b3439f6ad978514d66cadc63
Bug 36875: Do not pass unsanitized language to $page->translated_content

Test plan:
Try to access opac-page.pl with a language not in OPACLanguages.
Verify that this 'language' was not passed to sql. Simplest perhaps
by debugging AdditionalContent.pm. Something like:
 sub translated_content {
     my ( $self, $lang ) = @_;
+warn "L137: $lang";
Now have a public additional_contents page and hit it:
    /cgi-bin/koha/opac-page.pl?page_id=5&language=badsql
Check your log and find:
[2024/05/16 07:25:53] [WARN] L137: en at [etc] line 137.
So badsql was caught.

Signed-off-by: Marcel de Rooy <m.de.rooy@rijksmuseum.nl>
Signed-off-by: Victor Grousset/tuxayo <victor@tuxayo.net>
Signed-off-by: Martin Renvoize <martin.renvoize@ptfs-europe.com>
(cherry picked from commit 1a9e3647095eaf9563db59bd8b3a759a0875cc39)
Signed-off-by: Fridolin Somers <fridolin.somers@biblibre.com>
opac/opac-page.pl