gitea
/
Koha-clms
1
0
Fork 0
Code Issues Pull Requests Packages Projects Releases Wiki Activity

Bug 40980: [ALTERNATIVE] Sanitize operators param 

Ensure it does not contain 'cud-login'

Test plan, k-t-d with elastic search:
1) Make sure you're logged out
2) Access a search results page directly e.g.:
http://localhost:8081/cgi-bin/koha/catalogue/search.pl?q=music
3) You're prompted to login, login.
4) You're shown the search results directly, click a facet result (any facet)
5) You get a Error 403:
Programming error - op 'cud-login' must not start with 'cud-' for GET
6) Apply patch, restart plack, repeat

Signed-off-by: Marcel de Rooy <m.de.rooy@rijksmuseum.nl>
Signed-off-by: Lucas Gass <lucas@bywatersolutions.com>
This commit is contained in:
Pedro Amorim 2025-12-09 13:22:44 +00:00 committed by Lucas Gass
parent ed2556e7f3
commit c597046a9e
No known key found for this signature in database
GPG Key ID: 60B447398B0D36CA
1 changed files with 4 additions and 3 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

7
catalogue/search.pl
View File

@ -263,7 +263,8 @@ $template->param( advancedsearchesloop => $advancedsearchesloop );
$template->param( searchid => scalar $cgi->param('searchid'), );
my $default_sort_by = C4::Context->default_catalog_sort_by;
my $default_sort_by = C4::Context->default_catalog_sort_by;
my @sanitized_operators = grep { $_ ne 'cud-login' } $cgi->multi_param('op');
# The following should only be loaded if we're bringing up the advanced search template
if ( $template_type eq 'advsearch' ) {
@ -274,7 +275,7 @@ if ( $template_type eq 'advsearch' ) {
my $expanded = $cgi->param('expanded_options');
if ( $cgi->param('edit_search') ) {
@operands = $cgi->multi_param('q');
@operators = $cgi->multi_param('op');
@operators = @sanitized_operators;
@indexes = $cgi->multi_param('idx');
$template->param(
sort => scalar $cgi->param('sort_by'),
@ -370,7 +371,7 @@ $template->param( 'sort_by' => $sort_by[0] );
# operators include boolean and proximity operators and are used
# to evaluate multiple operands
my @operators = map uri_unescape($_), $cgi->multi_param('op');
my @operators = map uri_unescape($_), @sanitized_operators;
# indexes are query qualifiers, like 'title', 'author', etc. They
# can be single or multiple parameters separated by comma: kw,right-Truncation