Bug 11535: sanitize input from patron self-registration form
authorGalen Charlton <gmc@esilibrary.com>
Mon, 13 Jan 2014 21:51:56 +0000 (21:51 +0000)
committerGalen Charlton <gmc@esilibrary.com>
Tue, 14 Jan 2014 16:28:14 +0000 (16:28 +0000)
commit5c3f36279b93e13be4773c7b88df39c99f8b2aca
tree1947cdb87cbcf32320d38c00bf84655309170d00
parent8fbf21da1c540d19cc19fe75c0a5cb83a8fbe849
Bug 11535: sanitize input from patron self-registration form

This patch adds the use of C4::Scrubber to the processing of input
from the patron self-registration form, thereby closing off one
avenue for Javascript injection.

To test:

[1] Use the OPAC self-registration form to enter a new patron,
    and set its address to something like:

    <span style="color: red;">BAD</span>

[2] In the staff interface, bring up the new patron record.  The
    address will show up in red, indicating a successful HTML
    injection.
[3] Apply the patch and use self-registration to enter a new
    patron with a similar case of unwanted HTML coding.
[4] Bring up the second patron in the staff interface.  This time,
    the undesirable HTML tag should not be present.

Signed-off-by: Galen Charlton <gmc@esilibrary.com>
Signed-off-by: Liz Rea <liz@catalyst.net.nz>
Tags are not present on testing.

Signed-off-by: Katrin Fischer <Katrin.Fischer.83@web.de>
Confirmed bug and that the patch fixes it.
Passes all tests and QA script.

Signed-off-by: Galen Charlton <gmc@esilibrary.com>
opac/opac-memberentry.pl