]> git.koha-community.org Git - koha.git/commit
Bug 36875: Do not pass unsanitized language to $page->translated_content
authorMarcel de Rooy <m.de.rooy@rijksmuseum.nl>
Thu, 16 May 2024 07:19:30 +0000 (07:19 +0000)
committerFridolin Somers <fridolin.somers@biblibre.com>
Thu, 6 Jun 2024 08:59:48 +0000 (10:59 +0200)
commit6c450b98eaa5ae2a9b487a17ff488bf76fc3fa49
tree327c0abdc7b1703ed7cac24a72c6503115cc5680
parenteab3e9183cc9ee23dc1e028b04d02b0290644ad2
Bug 36875: Do not pass unsanitized language to $page->translated_content

Test plan:
Try to access opac-page.pl with a language not in OPACLanguages.
Verify that this 'language' was not passed to sql. Simplest perhaps
by debugging AdditionalContent.pm. Something like:
 sub translated_content {
     my ( $self, $lang ) = @_;
+warn "L137: $lang";
Now have a public additional_contents page and hit it:
    /cgi-bin/koha/opac-page.pl?page_id=5&language=badsql
Check your log and find:
[2024/05/16 07:25:53] [WARN] L137: en at [etc] line 137.
So badsql was caught.

Signed-off-by: Marcel de Rooy <m.de.rooy@rijksmuseum.nl>
Signed-off-by: Victor Grousset/tuxayo <victor@tuxayo.net>
Signed-off-by: Martin Renvoize <martin.renvoize@ptfs-europe.com>
(cherry picked from commit 1a9e3647095eaf9563db59bd8b3a759a0875cc39)
Signed-off-by: Fridolin Somers <fridolin.somers@biblibre.com>
opac/opac-page.pl