https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=43292 Bug ID: 43292 Summary: Patron screen_msg can contain unescaped CR/LF, corrupting SIP2 message framing Initiative type: --- Sponsorship --- status: Product: Koha Version: Main Hardware: All OS: All Status: NEW Severity: normal Priority: P5 - low Component: SIP2 Assignee: koha-bugs@lists.koha-community.org Reporter: martin.renvoize@openfifth.co.uk QA Contact: testopia@bugs.koha-community.org Target Milestone: --- Koha::Patron::Message already has a message_without_newlines method specifically to protect SIP2 patron-message screen_msg composition from embedded newlines, but two other sources that feed into a patron's screen_msg - the OPAC note (opacnote) and a restriction's debarredcomment, both composed in C4::SIP::ILS::Patron - are not sanitized before being sent as a SIP2 FID_SCREEN_MSG field. Since SIP2 messages are CR-terminated on the wire, a literal CR or LF inside a patron's OPAC note or restriction comment (both plain text fields editable via the staff interface / OPAC) can prematurely terminate the message and desync the self-check client's parser. This patch sanitizes the patron screen_msg immediately after reading it in build_patron_status and handle_patron_info, matching the exact CR/LF-stripping approach already used by Koha::Patron::Message->message_without_newlines. Test plan: 1. Add an OPAC note (or a restriction comment) containing an embedded newline to a patron, e.g. via the staff client's patron notes field 2. Send a SIP2 Patron Status Request (or Patron Information request) for that patron 3. Before this patch: the FID_SCREEN_MSG field in the raw response contains an embedded CR/LF, corrupting the message framing 4. Apply the patch and repeat step 2 5. The screen message is present but any CR/LF has been collapsed to a space, and the response is well-formed -- You are receiving this mail because: You are the assignee for the bug. You are watching all bug changes.