https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=22992 Marcel de Rooy <m.de.rooy@rijksmuseum.nl> changed: What |Removed |Added ---------------------------------------------------------------------------- Status|Signed Off |Failed QA --- Comment #6 from Marcel de Rooy <m.de.rooy@rijksmuseum.nl> --- + %shelf = ( + private => $input->param("shelf_private"), + name => $input->param("shelfname"), + number => $input->param("shelfnumber") + ); Axel, Thanks for your patch! I would recommend to pass only the shelfnumber via a CGI parameter in the URL. And get the Koha object for it in the script. This allows you to better check what you receive. The other parameters could be misused when mangling URLs. -- You are receiving this mail because: You are watching all bug changes.