[Koha-bugs] [Bug 13127] New: SQL report creation mangles HTML if using non-existent auth value

[bugzilla-daemon at bugs.koha-community.org]

http://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=13127

            Bug ID: 13127
           Summary: SQL report creation mangles HTML if using non-existent
                    auth value
 Change sponsored?: ---
           Product: Koha
           Version: unspecified
          Hardware: All
                OS: All
            Status: NEW
          Severity: enhancement
          Priority: P5 - low
         Component: Reports
          Assignee: gmcharlt at gmail.com
          Reporter: pasi.kallinen at pttk.fi
        QA Contact: testopia at bugs.koha-community.org

Create a new report from SQL, enter the following as the SQL:

select * from items where itemnumber = '<<whatever|NON_EXISTENT_AUTHVAL>>'

Save the report, and Koha complains "whatever: The authorized value category
(NON_EXISTENT_AUTHVAL) you selected does not exist.", with some random garbage
characters on the screen. The garbage happens because part of the page HTML
looks like this:

<input type='hidden' name='sql' value='select * from items where itemnumber =
'<<whatever|NON_EXISTENT_AUTHVAL>>'
' />


This is obviously wrong, the sql in there should be html encoded.

-- 
You are receiving this mail because:
You are watching all bug changes.