gitea
/
Koha-clms
1
0
Fork 0
Code Issues Pull Requests Packages Projects Releases Wiki Activity

Bug 6629 : Sanitizing input from language cookie 

I dont think we can use only 2 digits, some languages is much longer
zh-hans-TW for example

But the regex should stop it bening able handle nasty chars,
whitelisting safe ones instead

Signed-off-by: Katrin Fischer <Katrin.Fischer.83@web.de>
I checked the patch doesn't break language switching and language selection.

Signed-off-by: Paul Poulain <paul.poulain@biblibre.com>
I confirm the bug security issue was not here for master, but this fix improve the behaviour, so pushing it
(cherry picked from commit 9a4e9e54f2)

Signed-off-by: Chris Nighswonger <chris.nighswonger@gmail.com>
This commit is contained in:
Chris Cormack 2011-11-25 19:07:28 +13:00 committed by Chris Nighswonger
parent 16189ed8c3
commit da171ec31c
1 changed files with 2 additions and 4 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

6
C4/Templates.pm
View File

@ -277,8 +277,7 @@ sub themelanguage {
my @languages = split(",", C4::Context->preference(
$is_intranet ? 'language' : 'opaclanguages'));
my $lang;
$lang = $query->cookie('KohaOpacLanguage')
if defined $query and $query->cookie('KohaOpacLanguage');
$lang = getlanguagecookie($query);
unless ($lang) {
my $http_accept_language = $ENV{ HTTP_ACCEPT_LANGUAGE };
$lang = accept_language( $http_accept_language,
@ -327,8 +326,7 @@ sub getlanguagecookie {
$lang = $ENV{HTTP_ACCEPT_LANGUAGE};
}
$lang = substr($lang, 0, 2);
$lang =~ s/[^a-zA-Z_-]*//; #sanitzie
return $lang;
}