[Koha-bugs] [Bug 8015] Add MARC Modifications Templates
bugzilla-daemon at bugs.koha-community.org
bugzilla-daemon at bugs.koha-community.org
Wed Sep 25 19:23:45 CEST 2013
http://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=8015
Galen Charlton <gmcharlt at gmail.com> changed:
What |Removed |Added
----------------------------------------------------------------------------
CC| |gmcharlt at gmail.com
--- Comment #131 from Galen Charlton <gmcharlt at gmail.com> ---
(In reply to Paul Poulain from comment #129)
> I hadn't checked what the eval was related to, I assumed it was safe.
> I agree with your point : failed QA, this could probably be exploited.
>
> Jared, would you be pleased if the parameters where sanitized, even if the
> eval is still here ?
I think it would be better to drop the notion of using a string eval at all and
just rewrite ModifyRecordWithTemplate to become a dispatcher that calls the
modification subroutines directly. I say "just rewrite" because, for once, I
think the work can be confined to a single routine.
Also, the patchset currently includes no tests that run
ModifyRecordWithTemplate directly -- rather a lack, IMO. Resolving that can go
hand-in-hand with removing the eval.
--
You are receiving this mail because:
You are watching all bug changes.
More information about the Koha-bugs
mailing list