https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=39224 --- Comment #167 from Martin Renvoize (ashimema) <martin.renvoize@openfifth.co.uk> --- Created attachment 204715 --> https://bugs.koha-community.org/bugzilla3/attachment.cgi?id=204715&action=edit Bug 39224: (QA follow-up) Escape domain metacharacters and warn on unparsable hostnames get_valid_domain_config() only escaped '.' before interpolating an admin-supplied domain pattern into a live regex, leaving other regex metacharacters (+ * ( ) [ ] { } |) unescaped. A malformed or malicious domain entry could trigger catastrophic backtracking (ReDoS) against every login attempt matched against it. Use quotemeta() to escape the whole literal. Also make the OPACBaseURL/staffClientBaseURL hostname-seeding step in the atomicupdate warn instead of silently skipping when a syspref value doesn't contain a parsable hostname, so a broken migration is visible instead of failing silently. Signed-off-by: Clemens Tubach <clemens.tubach@kit.edu> -- You are receiving this mail because: You are watching all bug changes.