gitea
/
Koha-clms
1
0
Fork 0
Code Issues Pull Requests Packages Projects Releases Wiki Activity

Bug 19613: Scrub borrowers fields: borrowernotes opacnote 

To prevent XSS

Signed-off-by: David Cook <dcook@prosentient.com.au>
Signed-off-by: Nick Clemens <nick@bywatersolutions.com>
(cherry picked from commit 83db8696ca7a83aba224a0ab645f03447a96887b)
Signed-off-by: Fridolin Somers <fridolin.somers@biblibre.com>
(cherry picked from commit 383984a016)
Signed-off-by: Frédéric Demians <f.demians@tamil.fr>
This commit is contained in:
Jonathan Druart 2024-03-15 11:37:43 +01:00 committed by Frédéric Demians
parent 2278d229e8
commit d0915099b0
2 changed files with 41 additions and 1 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

7
Koha/Patron.pm
View File

@ -28,6 +28,7 @@ use Try::Tiny;
use C4::Context;
use C4::Auth qw( checkpw_hash );
use C4::Log qw( logaction );
use C4::Scrubber;
use Koha::Account;
use Koha::ArticleRequests;
use C4::Letters qw( GetPreparedLetter EnqueueLetter SendQueuedMessages );
@ -222,6 +223,12 @@ sub store {
if defined $self->relationship
and $self->relationship eq "";
for my $note_field ( qw( borrowernotes opacnote ) ) {
if ( !$self->in_storage || $self->_result->is_column_changed($note_field) ) {
$self->$note_field(C4::Scrubber->new('comment')->scrub($self->$note_field));
}
}
unless ( $self->in_storage ) { #AddMember
# Generate a valid userid/login if needed

35
t/db_dependent/Koha/Patron.t
View File

@ -19,7 +19,7 @@
use Modern::Perl;
use Test::More tests => 21;
use Test::More tests => 22;
use Test::Exception;
use Test::Warn;
@ -1673,3 +1673,36 @@ subtest 'update privacy tests' => sub {
$schema->storage->txn_rollback;
};
subtest 'Scrub the note fields' => sub {
plan tests => 4;
$schema->storage->txn_begin;
my $bad_message = '<script>alert("booh!")</script><span>all</span><b>good</b>now';
my $cleaned_message = '<span>all</span><b>good</b>now';
my $tmp_patron = $builder->build_object( { class => 'Koha::Patrons' } );
my $patron_data = $tmp_patron->unblessed;
$tmp_patron->delete;
delete $tmp_patron->{borrowernumber};
my $patron = Koha::Patron->new(
{
%$patron_data,
borrowernotes => $bad_message, opacnote => $bad_message,
}
)->store;
is( $patron->get_from_storage->borrowernotes, $cleaned_message );
is( $patron->get_from_storage->opacnote, $cleaned_message );
$patron->borrowernotes($bad_message)->store;
$patron->opacnote($bad_message)->store;
is( $patron->get_from_storage->borrowernotes, $cleaned_message );
is( $patron->get_from_storage->opacnote, $cleaned_message );
$schema->storage->txn_rollback;
};