[Bug 23093] New: Error during upgrade of OpacNavRight preference to Koha news
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=23093 Bug ID: 23093 Summary: Error during upgrade of OpacNavRight preference to Koha news Change sponsored?: --- Product: Koha Version: master Hardware: All OS: All Status: NEW Severity: major Priority: P5 - low Component: Tools Assignee: koha-bugs@lists.koha-community.org Reporter: oleonard@myacpl.org QA Contact: testopia@bugs.koha-community.org CC: testopia@bugs.koha-community.org Depends on: 22318 Target Milestone: --- Copied from Bug 22318: Moving the contents of OpacNavRight to opac_news fails due to improper (no?) escaping: DBD::mysql::db do failed: You have an error in your SQL syntax; check the manual that corresponds to your MariaDB server version for the right syntax to use near 'http':'https';if(!d.getElementById(id)){js=d.createElement(s);js.id=id;js.src=p+' at line 1 [for Statement "INSERT INTO opac_news (branchcode, lang, title, content ) VALUES (NULL, 'OpacNavRight_en', '', ' <a class="twitter-timeline" href="https://twitter.com/ETFLibrary" data-widget-id="702160486524186624">Tweets by @ETFLibrary</a> <script>!function(d,s,id){var js,fjs=d.getElementsByTagName(s)[0],p=/^http:/.test(d.location)?'http':'https';if(!d.getElementById(id)){js=d.createElement(s);js.id=id;js.src=p+"://platform.twitter.com/widgets.js";fjs.parentNode.insertBefore(js,fjs);}}(document,"script","twitter-wjs");</script> ')"] at /usr/share/koha/intranet/cgi-bin/installer/data/mysql/updatedatabase.pl line 18220. In this example, OpacNavRight contains a script to embed a Twitter timeline. Referenced Bugs: https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=22318 [Bug 22318] Extend Koha news feature to include other content areas -- You are receiving this mail because: You are watching all bug changes. You are the assignee for the bug.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=23093 Bug 23093 depends on bug 22318, which changed state. Bug 22318 Summary: Extend Koha news feature to include other content areas https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=22318 What |Removed |Added ---------------------------------------------------------------------------- Status|REOPENED |RESOLVED Resolution|--- |FIXED -- You are receiving this mail because: You are watching all bug changes. You are the assignee for the bug.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=23093 Jonathan Druart <jonathan.druart@bugs.koha-community.org> changed: What |Removed |Added ---------------------------------------------------------------------------- Assignee|koha-bugs@lists.koha-commun |jonathan.druart@bugs.koha-c |ity.org |ommunity.org CC| |jonathan.druart@bugs.koha-c | |ommunity.org Status|NEW |ASSIGNED -- You are receiving this mail because: You are watching all bug changes. You are the assignee for the bug.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=23093 Jonathan Druart <jonathan.druart@bugs.koha-community.org> changed: What |Removed |Added ---------------------------------------------------------------------------- Status|ASSIGNED |Needs Signoff -- You are receiving this mail because: You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=23093 --- Comment #1 from Jonathan Druart <jonathan.druart@bugs.koha-community.org> --- Created attachment 90494 --> https://bugs.koha-community.org/bugzilla3/attachment.cgi?id=90494&action=edit Bug 23093: (bug 22318 follow-up) Use placeholders in query moving OpacNavRight Placeholders must be used (!) in all SQL queries. Test plan: 1/ % git checkout 0c95e22afe13349b60d134217fce6718bfa9727f # commit before bug 22318 2/ Edit the pref OpacNavRight with something with " just a " and more ' 3/ git checkout master 4/ restart_all 5/ run updatedatabase.pl => Boom and the content of the pref has been lost 6/ Repeat 1 to 3 7/ Apply this patch 8/ run updatedatabase.pl => The pref has been correctly moved to opac_news -- You are receiving this mail because: You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=23093 Jonathan Druart <jonathan.druart@bugs.koha-community.org> changed: What |Removed |Added ---------------------------------------------------------------------------- Severity|major |critical -- You are receiving this mail because: You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=23093 M. Tompsett <mtompset@hotmail.com> changed: What |Removed |Added ---------------------------------------------------------------------------- Status|Needs Signoff |Signed Off -- You are receiving this mail because: You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=23093 M. Tompsett <mtompset@hotmail.com> changed: What |Removed |Added ---------------------------------------------------------------------------- Attachment #90494|0 |1 is obsolete| | --- Comment #2 from M. Tompsett <mtompset@hotmail.com> --- Created attachment 90500 --> https://bugs.koha-community.org/bugzilla3/attachment.cgi?id=90500&action=edit Bug 23093: (bug 22318 follow-up) Use placeholders in query moving OpacNavRight Placeholders must be used (!) in all SQL queries. Test plan: 1/ % git checkout 0c95e22afe13349b60d134217fce6718bfa9727f # commit before bug 22318 2/ Edit the pref OpacNavRight with something with " just a " and more ' 3/ git checkout master 4/ restart_all 5/ run updatedatabase.pl => Boom and the content of the pref has been lost 6/ Repeat 1 to 3 7/ Apply this patch 8/ run updatedatabase.pl => The pref has been correctly moved to opac_news Signed-off-by: Mark Tompsett <mtompset@hotmail.com> -- You are receiving this mail because: You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=23093 Nick Clemens <nick@bywatersolutions.com> changed: What |Removed |Added ---------------------------------------------------------------------------- Status|Signed Off |Passed QA -- You are receiving this mail because: You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=23093 Nick Clemens <nick@bywatersolutions.com> changed: What |Removed |Added ---------------------------------------------------------------------------- Attachment #90500|0 |1 is obsolete| | --- Comment #3 from Nick Clemens <nick@bywatersolutions.com> --- Created attachment 90531 --> https://bugs.koha-community.org/bugzilla3/attachment.cgi?id=90531&action=edit Bug 23093: (bug 22318 follow-up) Use placeholders in query moving OpacNavRight Placeholders must be used (!) in all SQL queries. Test plan: 1/ % git checkout 0c95e22afe13349b60d134217fce6718bfa9727f # commit before bug 22318 2/ Edit the pref OpacNavRight with something with " just a " and more ' 3/ git checkout master 4/ restart_all 5/ run updatedatabase.pl => Boom and the content of the pref has been lost 6/ Repeat 1 to 3 7/ Apply this patch 8/ run updatedatabase.pl => The pref has been correctly moved to opac_news Signed-off-by: Mark Tompsett <mtompset@hotmail.com> Signed-off-by: Nick Clemens <nick@bywatersolutions.com> -- You are receiving this mail because: You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=23093 Nick Clemens <nick@bywatersolutions.com> changed: What |Removed |Added ---------------------------------------------------------------------------- CC| |nick@bywatersolutions.com QA Contact|testopia@bugs.koha-communit |nick@bywatersolutions.com |y.org | -- You are receiving this mail because: You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=23093 Martin Renvoize <martin.renvoize@ptfs-europe.com> changed: What |Removed |Added ---------------------------------------------------------------------------- Status|Passed QA |Pushed to Master Version(s)| |19.11.00 released in| | -- You are receiving this mail because: You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=23093 --- Comment #4 from Martin Renvoize <martin.renvoize@ptfs-europe.com> --- Nice work! Pushed to master for 19.11.00 -- You are receiving this mail because: You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=23093 Fridolin SOMERS <fridolin.somers@biblibre.com> changed: What |Removed |Added ---------------------------------------------------------------------------- Status|Pushed to Master |Pushed to Stable CC| |fridolin.somers@biblibre.co | |m Version(s)|19.11.00 |19.11.00,19.05.01 released in| | --- Comment #5 from Fridolin SOMERS <fridolin.somers@biblibre.com> --- Pushed to 19.05.x for 19.05.01 -- You are receiving this mail because: You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=23093 David Cook <dcook@prosentient.com.au> changed: What |Removed |Added ---------------------------------------------------------------------------- CC| |dcook@prosentient.com.au Summary|Error during upgrade of |[CVE-2022-0495] Error |OpacNavRight preference to |during upgrade of |Koha news |OpacNavRight preference to | |Koha news --- Comment #6 from David Cook <dcook@prosentient.com.au> --- CVE-2022-0495 doesn't provide much info but it looks like it could be around the right time although the CVE would have a slightly wrong version number. -- You are receiving this mail because: You are watching all bug changes.
participants (1)
-
bugzilla-daemon＠bugs.koha-community.org