[Bug 22781] New: Fields on patron search results should be html/json filtered
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=22781 Bug ID: 22781 Summary: Fields on patron search results should be html/json filtered Change sponsored?: --- Product: Koha Version: master Hardware: All OS: All Status: NEW Severity: normal Priority: P5 - low Component: Patrons Assignee: koha-bugs@lists.koha-community.org Reporter: nick@bywatersolutions.com QA Contact: testopia@bugs.koha-community.org CC: gmcharlt@gmail.com, kyle.m.hall@gmail.com Target Milestone: --- On bug 22715 we added a filter for circulation notes - this should probably be applied to all the fields on the page for consistency/safety -- You are receiving this mail because: You are the assignee for the bug. You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=22781 Nick Clemens <nick@bywatersolutions.com> changed: What |Removed |Added ---------------------------------------------------------------------------- Depends on| |22715 Referenced Bugs: https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=22715 [Bug 22715] Searching for patrons with "" in the circulation note hangs patron search -- You are receiving this mail because: You are watching all bug changes. You are the assignee for the bug.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=22781 Jonathan Druart <jonathan.druart@bugs.koha-community.org> changed: What |Removed |Added ---------------------------------------------------------------------------- See Also| |https://bugs.koha-community | |.org/bugzilla3/show_bug.cgi | |?id=22484 -- You are receiving this mail because: You are watching all bug changes. You are the assignee for the bug.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=22781 Josef Moravec <josef.moravec@gmail.com> changed: What |Removed |Added ---------------------------------------------------------------------------- CC| |josef.moravec@gmail.com -- You are receiving this mail because: You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=22781 Jonathan Druart <jonathan.druart@bugs.koha-community.org> changed: What |Removed |Added ---------------------------------------------------------------------------- CC| |jonathan.druart@bugs.koha-c | |ommunity.org Status|NEW |ASSIGNED Assignee|koha-bugs@lists.koha-commun |jonathan.druart@bugs.koha-c |ity.org |ommunity.org -- You are receiving this mail because: You are the assignee for the bug. You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=22781 Jonathan Druart <jonathan.druart@bugs.koha-community.org> changed: What |Removed |Added ---------------------------------------------------------------------------- CC| |martin.renvoize@ptfs-europe | |.com --- Comment #1 from Jonathan Druart <jonathan.druart@bugs.koha-community.org> --- *** Bug 22484 has been marked as a duplicate of this bug. *** -- You are receiving this mail because: You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=22781 Jonathan Druart <jonathan.druart@bugs.koha-community.org> changed: What |Removed |Added ---------------------------------------------------------------------------- See Also|https://bugs.koha-community | |.org/bugzilla3/show_bug.cgi | |?id=22484 | -- You are receiving this mail because: You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=22781 Jonathan Druart <jonathan.druart@bugs.koha-community.org> changed: What |Removed |Added ---------------------------------------------------------------------------- Status|ASSIGNED |Needs Signoff -- You are receiving this mail because: You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=22781 --- Comment #2 from Jonathan Druart <jonathan.druart@bugs.koha-community.org> --- Created attachment 89267 --> https://bugs.koha-community.org/bugzilla3/attachment.cgi?id=89267&action=edit Bug 22781: Add tests Test plan: Apply only this patch => The tests will fail, the library's name is not correctly escaped. Note: This applies for the whole patchset, when the tests fail you will need to remove the patrons added by the tests with the following SQL query: delete from borrowers where surname like "test_patron_%"; We are expecting END to be called even if something goes wrong, but DESTROY must be used instead. This will be fixed separately, on its own bug report. -- You are receiving this mail because: You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=22781 --- Comment #3 from Jonathan Druart <jonathan.druart@bugs.koha-community.org> --- Created attachment 89268 --> https://bugs.koha-community.org/bugzilla3/attachment.cgi?id=89268&action=edit Bug 22781: Escape cardnumber, category's description, library's name and dateexpiry This will fix the previous failure. Note that other fields like borrowernumber, Price escaped values, integers, etc. could be escaped the same way but will be useless (save polar bears). -- You are receiving this mail because: You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=22781 --- Comment #4 from Jonathan Druart <jonathan.druart@bugs.koha-community.org> --- Created attachment 89269 --> https://bugs.koha-community.org/bugzilla3/attachment.cgi?id=89269&action=edit Bug 22781: Test patron's info filtering The patron's data was not correctly escaped actually. Test plan: This is a good value for the whole patchset: <strong>fir's"tname</strong> \123 ❤ use it for a patron's firstname, then do a search -- You are receiving this mail because: You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=22781 --- Comment #5 from Jonathan Druart <jonathan.druart@bugs.koha-community.org> --- Created attachment 89270 --> https://bugs.koha-community.org/bugzilla3/attachment.cgi?id=89270&action=edit Bug 22781: Does not double filter address Ho, a bug! Some fields in the address where double filtered. Test plan: Use the evil strings in the address field and do a search, you will see double html encoded characters without this patch. -- You are receiving this mail because: You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=22781 --- Comment #6 from Jonathan Druart <jonathan.druart@bugs.koha-community.org> --- Created attachment 89271 --> https://bugs.koha-community.org/bugzilla3/attachment.cgi?id=89271&action=edit Bug 22781: Correctly filter the emails Ho, another bug! The email was not correctly filtered. Test plan: Use the evil string for an email, do a search. => Notice that without this patch the results never show up -- You are receiving this mail because: You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=22781 Liz Rea <wizzyrea@gmail.com> changed: What |Removed |Added ---------------------------------------------------------------------------- CC| |wizzyrea@gmail.com --- Comment #7 from Liz Rea <wizzyrea@gmail.com> --- Just to point out, the interface won't actually allow saving the "bad string email," so you've got to force it in there in the DB. It's probably still good to make sure this is escaped though, because who knows what can happen in migration. -- You are receiving this mail because: You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=22781 Liz Rea <wizzyrea@gmail.com> changed: What |Removed |Added ---------------------------------------------------------------------------- Status|Needs Signoff |Signed Off -- You are receiving this mail because: You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=22781 Liz Rea <wizzyrea@gmail.com> changed: What |Removed |Added ---------------------------------------------------------------------------- Attachment #89267|0 |1 is obsolete| | Attachment #89268|0 |1 is obsolete| | Attachment #89269|0 |1 is obsolete| | Attachment #89270|0 |1 is obsolete| | Attachment #89271|0 |1 is obsolete| | --- Comment #8 from Liz Rea <wizzyrea@gmail.com> --- Created attachment 89395 --> https://bugs.koha-community.org/bugzilla3/attachment.cgi?id=89395&action=edit Bug 22781: Add tests Test plan: Apply only this patch => The tests will fail, the library's name is not correctly escaped. Note: This applies for the whole patchset, when the tests fail you will need to remove the patrons added by the tests with the following SQL query: delete from borrowers where surname like "test_patron_%"; We are expecting END to be called even if something goes wrong, but DESTROY must be used instead. This will be fixed separately, on its own bug report. NOTE: I (Liz) did not test this first patch because my selenium was not working, that is why my SO line is not on the patch. If someone could do that quickly I'd be really grateful. -- You are receiving this mail because: You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=22781 --- Comment #9 from Liz Rea <wizzyrea@gmail.com> --- Created attachment 89396 --> https://bugs.koha-community.org/bugzilla3/attachment.cgi?id=89396&action=edit Bug 22781: Escape cardnumber, category's description, library's name and dateexpiry This will fix the previous failure. Note that other fields like borrowernumber, Price escaped values, integers, etc. could be escaped the same way but will be useless (save polar bears). Signed-off-by: Liz Rea <wizzyrea@gmail.com> -- You are receiving this mail because: You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=22781 --- Comment #10 from Liz Rea <wizzyrea@gmail.com> --- Created attachment 89397 --> https://bugs.koha-community.org/bugzilla3/attachment.cgi?id=89397&action=edit Bug 22781: Test patron's info filtering The patron's data was not correctly escaped actually. Test plan: This is a good value for the whole patchset: <strong>fir's"tname</strong> \123 ❤ use it for a patron's firstname, then do a search Signed-off-by: Liz Rea <wizzyrea@gmail.com> -- You are receiving this mail because: You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=22781 --- Comment #11 from Liz Rea <wizzyrea@gmail.com> --- Created attachment 89398 --> https://bugs.koha-community.org/bugzilla3/attachment.cgi?id=89398&action=edit Bug 22781: Does not double filter address Ho, a bug! Some fields in the address where double filtered. Test plan: Use the evil strings in the address field and do a search, you will see double html encoded characters without this patch. Signed-off-by: Liz Rea <wizzyrea@gmail.com> -- You are receiving this mail because: You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=22781 --- Comment #12 from Liz Rea <wizzyrea@gmail.com> --- Created attachment 89399 --> https://bugs.koha-community.org/bugzilla3/attachment.cgi?id=89399&action=edit Bug 22781: Correctly filter the emails Ho, another bug! The email was not correctly filtered. Test plan: Use the evil string for an email, do a search. => Notice that without this patch the results never show up Signed-off-by: Liz Rea <wizzyrea@gmail.com> -- You are receiving this mail because: You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=22781 Katrin Fischer <katrin.fischer@bsz-bw.de> changed: What |Removed |Added ---------------------------------------------------------------------------- Patch complexity|--- |Small patch Status|Signed Off |Passed QA -- You are receiving this mail because: You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=22781 Katrin Fischer <katrin.fischer@bsz-bw.de> changed: What |Removed |Added ---------------------------------------------------------------------------- Attachment #89395|0 |1 is obsolete| | --- Comment #13 from Katrin Fischer <katrin.fischer@bsz-bw.de> --- Created attachment 89582 --> https://bugs.koha-community.org/bugzilla3/attachment.cgi?id=89582&action=edit Bug 22781: Add tests Test plan: Apply only this patch => The tests will fail, the library's name is not correctly escaped. Note: This applies for the whole patchset, when the tests fail you will need to remove the patrons added by the tests with the following SQL query: delete from borrowers where surname like "test_patron_%"; We are expecting END to be called even if something goes wrong, but DESTROY must be used instead. This will be fixed separately, on its own bug report. Signed-off-by: Katrin Fischer <katrin.fischer.83@web.de> -- You are receiving this mail because: You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=22781 Katrin Fischer <katrin.fischer@bsz-bw.de> changed: What |Removed |Added ---------------------------------------------------------------------------- Attachment #89396|0 |1 is obsolete| | --- Comment #14 from Katrin Fischer <katrin.fischer@bsz-bw.de> --- Created attachment 89583 --> https://bugs.koha-community.org/bugzilla3/attachment.cgi?id=89583&action=edit Bug 22781: Escape cardnumber, category's description, library's name and dateexpiry This will fix the previous failure. Note that other fields like borrowernumber, Price escaped values, integers, etc. could be escaped the same way but will be useless (save polar bears). Signed-off-by: Liz Rea <wizzyrea@gmail.com> Signed-off-by: Katrin Fischer <katrin.fischer.83@web.de> -- You are receiving this mail because: You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=22781 Katrin Fischer <katrin.fischer@bsz-bw.de> changed: What |Removed |Added ---------------------------------------------------------------------------- Attachment #89397|0 |1 is obsolete| | --- Comment #15 from Katrin Fischer <katrin.fischer@bsz-bw.de> --- Created attachment 89584 --> https://bugs.koha-community.org/bugzilla3/attachment.cgi?id=89584&action=edit Bug 22781: Test patron's info filtering The patron's data was not correctly escaped actually. Test plan: This is a good value for the whole patchset: <strong>fir's"tname</strong> \123 ❤ use it for a patron's firstname, then do a search Signed-off-by: Liz Rea <wizzyrea@gmail.com> Signed-off-by: Katrin Fischer <katrin.fischer.83@web.de> -- You are receiving this mail because: You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=22781 Katrin Fischer <katrin.fischer@bsz-bw.de> changed: What |Removed |Added ---------------------------------------------------------------------------- Attachment #89398|0 |1 is obsolete| | --- Comment #16 from Katrin Fischer <katrin.fischer@bsz-bw.de> --- Created attachment 89585 --> https://bugs.koha-community.org/bugzilla3/attachment.cgi?id=89585&action=edit Bug 22781: Does not double filter address Ho, a bug! Some fields in the address where double filtered. Test plan: Use the evil strings in the address field and do a search, you will see double html encoded characters without this patch. Signed-off-by: Liz Rea <wizzyrea@gmail.com> Signed-off-by: Katrin Fischer <katrin.fischer.83@web.de> -- You are receiving this mail because: You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=22781 Katrin Fischer <katrin.fischer@bsz-bw.de> changed: What |Removed |Added ---------------------------------------------------------------------------- Attachment #89399|0 |1 is obsolete| | --- Comment #17 from Katrin Fischer <katrin.fischer@bsz-bw.de> --- Created attachment 89586 --> https://bugs.koha-community.org/bugzilla3/attachment.cgi?id=89586&action=edit Bug 22781: Correctly filter the emails Ho, another bug! The email was not correctly filtered. Test plan: Use the evil string for an email, do a search. => Notice that without this patch the results never show up Signed-off-by: Liz Rea <wizzyrea@gmail.com> Signed-off-by: Katrin Fischer <katrin.fischer.83@web.de> -- You are receiving this mail because: You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=22781 --- Comment #18 from Katrin Fischer <katrin.fischer@bsz-bw.de> --- NOTE FOR RM: I still have trouble running Selenium tests (server won't start right now). So I couldn't test them :( -- You are receiving this mail because: You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=22781 --- Comment #19 from Martin Renvoize <martin.renvoize@ptfs-europe.com> --- Selenium Tests all pass :), Katrin gave me a heads up on IRC to run them for her. -- You are receiving this mail because: You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=22781 Martin Renvoize <martin.renvoize@ptfs-europe.com> changed: What |Removed |Added ---------------------------------------------------------------------------- Keywords| |rel_19_05_candidate -- You are receiving this mail because: You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=22781 Nick Clemens <nick@bywatersolutions.com> changed: What |Removed |Added ---------------------------------------------------------------------------- Status|Passed QA |Pushed to Master --- Comment #20 from Nick Clemens <nick@bywatersolutions.com> --- Awesome work all! Pushed to master for 19.05 -- You are receiving this mail because: You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=22781 Martin Renvoize <martin.renvoize@ptfs-europe.com> changed: What |Removed |Added ---------------------------------------------------------------------------- Version(s)| |19.05.00, 18.11.06 released in| | Status|Pushed to Master |Pushed to Stable --- Comment #21 from Martin Renvoize <martin.renvoize@ptfs-europe.com> --- Pushed to 18.11.x for 18.11.06 -- You are receiving this mail because: You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=22781 Liz Rea <wizzyrea@gmail.com> changed: What |Removed |Added ---------------------------------------------------------------------------- Status|Pushed to stable |Pushed to oldstable --- Comment #22 from Liz Rea <wizzyrea@gmail.com> --- Pushed to 18.05 for 18.04.14 -- You are receiving this mail because: You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=22781 Jonathan Druart <jonathan.druart@bugs.koha-community.org> changed: What |Removed |Added ---------------------------------------------------------------------------- CC| |mtj@kohaaloha.com --- Comment #23 from Jonathan Druart <jonathan.druart@bugs.koha-community.org> --- *** Bug 18765 has been marked as a duplicate of this bug. *** -- You are receiving this mail because: You are watching all bug changes.
participants (1)
-
bugzilla-daemon＠bugs.koha-community.org