[Bug 41599] New: reports/acquisitions_stats.pl calls output_error incorrectly
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=41599 Bug ID: 41599 Summary: reports/acquisitions_stats.pl calls output_error incorrectly Initiative type: --- Sponsorship --- status: Product: Koha Version: Main Hardware: All OS: All Status: NEW Severity: minor Priority: P5 - low Component: Architecture, internals, and plumbing Assignee: koha-bugs@lists.koha-community.org Reporter: dcook@prosentient.com.au QA Contact: testopia@bugs.koha-community.org Typically, output_error should look like this: output_error( $cgi, '404' ); But reports/acquisitions_stats.pl calls it like this: C4::Output::output_error( $input, 'Possible SQL injection' ); 'Possible SQL injection' is not a valid errorno. -- You are receiving this mail because: You are the assignee for the bug. You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=41599 David Cook <dcook@prosentient.com.au> changed: What |Removed |Added ---------------------------------------------------------------------------- See Also| |https://bugs.koha-community | |.org/bugzilla3/show_bug.cgi | |?id=30803 -- You are receiving this mail because: You are watching all bug changes. You are the assignee for the bug.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=41599 David Cook <dcook@prosentient.com.au> changed: What |Removed |Added ---------------------------------------------------------------------------- Blocks| |30803 Referenced Bugs: https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=30803 [Bug 30803] output_error should not assume a 404 status -- You are receiving this mail because: You are the assignee for the bug. You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=41599 David Cook <dcook@prosentient.com.au> changed: What |Removed |Added ---------------------------------------------------------------------------- Blocks|30803 | Depends on| |30803 Referenced Bugs: https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=30803 [Bug 30803] output_error should not assume a 404 status -- You are receiving this mail because: You are the assignee for the bug. You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=41599 David Cook <dcook@prosentient.com.au> changed: What |Removed |Added ---------------------------------------------------------------------------- Assignee|koha-bugs@lists.koha-commun |dcook@prosentient.com.au |ity.org | -- You are receiving this mail because: You are the assignee for the bug. You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=41599 David Cook <dcook@prosentient.com.au> changed: What |Removed |Added ---------------------------------------------------------------------------- Status|NEW |Needs Signoff -- You are receiving this mail because: You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=41599 --- Comment #1 from David Cook <dcook@prosentient.com.au> --- Created attachment 191333 --> https://bugs.koha-community.org/bugzilla3/attachment.cgi?id=191333&action=edit Bug 41599: Fix output_error in acquisitions_stats.pl This patch changes the incorrect usage of output_error in acquisitions_stats.pl so that it uses a HTTP status code instead of an arbitrary string. Test plan: 0. Apply the patch and koha-plack --restart kohadev 1. Go to http://localhost:8081/cgi-bin/koha/reports/acquisitions_stats.pl 2. Use your F12 HTML inspector to find the "Line" radio buttons that you've selected and remove the values for those elements 3. Click "Submit" at the bottom of the screen 4. Note that you get a 403 error (if bug 30803 applied - otherwise it's a 404 error) -- You are receiving this mail because: You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=41599 Jonathan Druart <jonathan.druart@gmail.com> changed: What |Removed |Added ---------------------------------------------------------------------------- Status|Needs Signoff |Signed Off -- You are receiving this mail because: You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=41599 Jonathan Druart <jonathan.druart@gmail.com> changed: What |Removed |Added ---------------------------------------------------------------------------- Attachment #191333|0 |1 is obsolete| | -- You are receiving this mail because: You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=41599 --- Comment #2 from Jonathan Druart <jonathan.druart@gmail.com> --- Created attachment 191342 --> https://bugs.koha-community.org/bugzilla3/attachment.cgi?id=191342&action=edit Bug 41599: Fix output_error in acquisitions_stats.pl This patch changes the incorrect usage of output_error in acquisitions_stats.pl so that it uses a HTTP status code instead of an arbitrary string. Test plan: 0. Apply the patch and koha-plack --restart kohadev 1. Go to http://localhost:8081/cgi-bin/koha/reports/acquisitions_stats.pl 2. Use your F12 HTML inspector to find the "Line" radio buttons that you've selected and remove the values for those elements 3. Click "Submit" at the bottom of the screen 4. Note that you get a 403 error (if bug 30803 applied - otherwise it's a 404 error) Signed-off-by: Jonathan Druart <jonathan.druart@bugs.koha-community.org> -- You are receiving this mail because: You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=41599 Martin Renvoize (ashimema) <martin.renvoize@openfifth.co.uk> changed: What |Removed |Added ---------------------------------------------------------------------------- QA Contact|testopia@bugs.koha-communit |martin.renvoize@openfifth.c |y.org |o.uk Patch complexity|--- |Trivial patch Status|Signed Off |Passed QA -- You are receiving this mail because: You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=41599 Martin Renvoize (ashimema) <martin.renvoize@openfifth.co.uk> changed: What |Removed |Added ---------------------------------------------------------------------------- Attachment #191342|0 |1 is obsolete| | -- You are receiving this mail because: You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=41599 --- Comment #3 from Martin Renvoize (ashimema) <martin.renvoize@openfifth.co.uk> --- Created attachment 193614 --> https://bugs.koha-community.org/bugzilla3/attachment.cgi?id=193614&action=edit Bug 41599: Fix output_error in acquisitions_stats.pl This patch changes the incorrect usage of output_error in acquisitions_stats.pl so that it uses a HTTP status code instead of an arbitrary string. Test plan: 0. Apply the patch and koha-plack --restart kohadev 1. Go to http://localhost:8081/cgi-bin/koha/reports/acquisitions_stats.pl 2. Use your F12 HTML inspector to find the "Line" radio buttons that you've selected and remove the values for those elements 3. Click "Submit" at the bottom of the screen 4. Note that you get a 403 error (if bug 30803 applied - otherwise it's a 404 error) Signed-off-by: Jonathan Druart <jonathan.druart@bugs.koha-community.org> Signed-off-by: Martin Renvoize <martin.renvoize@openfifth.co.uk> -- You are receiving this mail because: You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=41599 Lucas Gass (lukeg) <lucas@bywatersolutions.com> changed: What |Removed |Added ---------------------------------------------------------------------------- Status|Passed QA |Pushed to main Version(s)| |26.05.00 released in| | -- You are receiving this mail because: You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=41599 --- Comment #4 from Lucas Gass (lukeg) <lucas@bywatersolutions.com> --- Nice work everyone! Pushed to main for 26.05 -- You are receiving this mail because: You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=41599 David Cook <dcook@prosentient.com.au> changed: What |Removed |Added ---------------------------------------------------------------------------- Text to go in the| |Fixes acquisitions_stats.pl release notes| |so it returns a 403 code if | |a user tries to send a | |malicious payload. -- You are receiving this mail because: You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=41599 Jacob O'Mara <jacob.omara@openfifth.co.uk> changed: What |Removed |Added ---------------------------------------------------------------------------- Version(s)|26.05.00 |26.05.00,25.11.04 released in| | Status|Pushed to main |Pushed to stable -- You are receiving this mail because: You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=41599 --- Comment #5 from Jacob O'Mara <jacob.omara@openfifth.co.uk> --- Thanks all, pushed to 25.11.x -- You are receiving this mail because: You are watching all bug changes.
participants (1)
-
bugzilla-daemon＠bugs.koha-community.org