From 863938f16c6e9840c194a05717da1831c9054266 Mon Sep 17 00:00:00 2001 From: Srdjan Jankovic Date: Wed, 24 Feb 2010 13:41:24 +1300 Subject: [PATCH] Escape input that goes in HTML; Reworked search history insert SQL Signed-off-by: Chris Cormack Signed-off-by: Galen Charlton --- C4/Auth.pm | 46 ++++++++----------- .../intranet-tmpl/prog/en/modules/auth.tmpl | 2 +- .../prog/en/modules/catalogue/results.tmpl | 8 ++-- .../prog/en/modules/catalogue/subject.tmpl | 4 +- .../prog/en/modules/installer/auth.tmpl | 2 +- .../opac-tmpl/prog/en/modules/opac-auth.tmpl | 2 +- .../prog/en/modules/opac-results-grouped.tmpl | 4 +- .../prog/en/modules/opac-results.tmpl | 4 +- .../prog/en/modules/sco/sco-main.tmpl | 2 +- 9 files changed, 34 insertions(+), 40 deletions(-) diff --git a/C4/Auth.pm b/C4/Auth.pm index 0ac74a9f1d..2ed737096b 100755 --- a/C4/Auth.pm +++ b/C4/Auth.pm @@ -121,6 +121,10 @@ C4::Auth - Authenticates Koha users =cut +my $SERCH_HISTORY_INSERT_SQL =<{'query'}->cookie('KohaOpacRecentSearches'); if ($searchcookie){ $searchcookie = uri_unescape($searchcookie); - if (thaw($searchcookie)) { - @recentSearches = @{thaw($searchcookie)}; - } - - if (@recentSearches > 0) { - my $query = "INSERT INTO search_history(userid, sessionid, query_desc, query_cgi, total, time) VALUES"; - my $icount = 1; - foreach my $asearch (@recentSearches) { - $query .= "("; - $query .= $borrowernumber . ", "; - $query .= '"' . $in->{'query'}->cookie("CGISESSID") . "\", "; - $query .= '"' . $asearch->{'query_desc'} . "\", "; - $query .= '"' . $asearch->{'query_cgi'} . "\", "; - $query .= $asearch->{'total'} . ", "; - $query .= 'FROM_UNIXTIME(' . $asearch->{'time'} . "))"; - if ($icount < @recentSearches) { $query .= ", ";} - $icount++; - } - - my $sth = $dbh->prepare($query); - $sth->execute; + my @recentSearches = @{thaw($searchcookie) || []}; + if (@recentSearches) { + my $sth = $dbh->prepare($SERCH_HISTORY_INSERT_SQL); + $sth->execute( $borrowernumber, + $in->{'query'}->cookie("CGISESSID"), + $_->{'query_desc'}, + $_->{'query_cgi'}, + $_->{'total'}, + $_->{'time'}, + ) foreach @recentSearches; # And then, delete the cookie's content my $newsearchcookie = $in->{'query'}->cookie( @@ -314,11 +306,13 @@ sub get_template_and_user { } # Anonymous opac search history # If opac search history is enabled and at least one search has already been performed - if (C4::Context->preference('EnableOpacSearchHistory') && $in->{'query'}->cookie('KohaOpacRecentSearches')) { + if (C4::Context->preference('EnableOpacSearchHistory')) { + my $searchcookie = $in->{'query'}->cookie('KohaOpacRecentSearches'); + if ($searchcookie){ + $searchcookie = uri_unescape($searchcookie); + my @recentSearches = @{thaw($searchcookie) || []}; # We show the link in opac - if (thaw(uri_unescape($in->{'query'}->cookie('KohaOpacRecentSearches')))) { - my @recentSearches = @{thaw(uri_unescape($in->{'query'}->cookie('KohaOpacRecentSearches')))}; - if (@recentSearches > 0) { + if (@recentSearches) { $template->param(ShowOpacRecentSearchLink => 1); } } diff --git a/koha-tmpl/intranet-tmpl/prog/en/modules/auth.tmpl b/koha-tmpl/intranet-tmpl/prog/en/modules/auth.tmpl index b3d1f4ca26..5867f6daad 100644 --- a/koha-tmpl/intranet-tmpl/prog/en/modules/auth.tmpl +++ b/koha-tmpl/intranet-tmpl/prog/en/modules/auth.tmpl @@ -39,7 +39,7 @@
" method="post" name="loginform" id="loginform"> - " value="" /> + " value="" />

" size="20" tabindex="1" /> diff --git a/koha-tmpl/intranet-tmpl/prog/en/modules/catalogue/results.tmpl b/koha-tmpl/intranet-tmpl/prog/en/modules/catalogue/results.tmpl index 9dbfe4a6fc..b81970a3ba 100644 --- a/koha-tmpl/intranet-tmpl/prog/en/modules/catalogue/results.tmpl +++ b/koha-tmpl/intranet-tmpl/prog/en/modules/catalogue/results.tmpl @@ -207,10 +207,10 @@ function GetZ3950Terms(){ - " value=""/> + " value=""/> - " value=""/> + " value=""/> @@ -363,10 +363,10 @@ function GetZ3950Terms(){ - " value=""/> + " value=""/> - " value=""/> + " value=""/> diff --git a/koha-tmpl/intranet-tmpl/prog/en/modules/catalogue/subject.tmpl b/koha-tmpl/intranet-tmpl/prog/en/modules/catalogue/subject.tmpl index aceb40c03d..6ba5005ecc 100644 --- a/koha-tmpl/intranet-tmpl/prog/en/modules/catalogue/subject.tmpl +++ b/koha-tmpl/intranet-tmpl/prog/en/modules/catalogue/subject.tmpl @@ -33,7 +33,7 @@ -

&startfrom=">Previous Records &startfrom=">Next Records

+

&startfrom=">Previous Records &startfrom=">Next Records

@@ -43,4 +43,4 @@ - \ No newline at end of file + diff --git a/koha-tmpl/intranet-tmpl/prog/en/modules/installer/auth.tmpl b/koha-tmpl/intranet-tmpl/prog/en/modules/installer/auth.tmpl index 0cb8092f8a..5335bec240 100644 --- a/koha-tmpl/intranet-tmpl/prog/en/modules/installer/auth.tmpl +++ b/koha-tmpl/intranet-tmpl/prog/en/modules/installer/auth.tmpl @@ -30,7 +30,7 @@ " method="post" name="mainform" id="mainform"> - " value="" /> + " value="" />

Welcome to the Koha Web Installer

Before we begin, please verify you have the correct credentials to continue. Please log in diff --git a/koha-tmpl/opac-tmpl/prog/en/modules/opac-auth.tmpl b/koha-tmpl/opac-tmpl/prog/en/modules/opac-auth.tmpl index 161b0820af..ec569cd95f 100644 --- a/koha-tmpl/opac-tmpl/prog/en/modules/opac-auth.tmpl +++ b/koha-tmpl/opac-tmpl/prog/en/modules/opac-auth.tmpl @@ -56,7 +56,7 @@ " name="auth" id="auth" method="post">

- " value="" /> + " value="" />
  1. diff --git a/koha-tmpl/opac-tmpl/prog/en/modules/opac-results-grouped.tmpl b/koha-tmpl/opac-tmpl/prog/en/modules/opac-results-grouped.tmpl index 0162ccb2a8..1d5e8f1913 100644 --- a/koha-tmpl/opac-tmpl/prog/en/modules/opac-results-grouped.tmpl +++ b/koha-tmpl/opac-tmpl/prog/en/modules/opac-results-grouped.tmpl @@ -168,10 +168,10 @@ function highlightOn() { - " value=""/> + " value=""/> - " value=""/> + " value=""/> diff --git a/koha-tmpl/opac-tmpl/prog/en/modules/opac-results.tmpl b/koha-tmpl/opac-tmpl/prog/en/modules/opac-results.tmpl index b01ba42b2a..967e79015c 100644 --- a/koha-tmpl/opac-tmpl/prog/en/modules/opac-results.tmpl +++ b/koha-tmpl/opac-tmpl/prog/en/modules/opac-results.tmpl @@ -315,10 +315,10 @@ $(document).ready(function(){ - " value=""/> + " value=""/> - " value=""/> + " value=""/> diff --git a/koha-tmpl/opac-tmpl/prog/en/modules/sco/sco-main.tmpl b/koha-tmpl/opac-tmpl/prog/en/modules/sco/sco-main.tmpl index 0ac11f5f39..64e9dc39f4 100644 --- a/koha-tmpl/opac-tmpl/prog/en/modules/sco/sco-main.tmpl +++ b/koha-tmpl/opac-tmpl/prog/en/modules/sco/sco-main.tmpl @@ -230,7 +230,7 @@ Sorry, This Self-Checkout Station has lost authentication. Please contact the a
    - " value=""> + " value="">
    2. -- 2.39.5