https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=37054
--- Comment #87 from David Cook <[email protected]> --- Comment on attachment 202240 --> https://bugs.koha-community.org/bugzilla3/attachment.cgi?id=202240 Bug 37054: Implement with configurations table Review of attachment 202240: --> (https://bugs.koha-community.org/bugzilla3/page.cgi?id=splinter.html&bug=37054&attachment=202240) ----------------------------------------------------------------- ::: admin/branches.pl @@ +165,5 @@ > > + my $color = $input->param('staff_header_color'); > + if ( defined $color && length $color ) { > + Koha::Exceptions::BadParameter->throw( parameter => > 'staff_header_color' ) > + unless $color =~ /^#[0-9A-Fa-f]{6}$/; Nicely done here. I was looking through the code and thinking how it would be possible to inject some naughty CSS, based on some of the inputs and outputs but this sanitising would prevent that. That said, this looks like it would limit you to hex colours and colour names, so you wouldn't able to use rgb()/rgba()/hsl(), which are valid and very valuable ways of expressing color in CSS. -- You are receiving this mail because: You are watching all bug changes. _______________________________________________ Koha-bugs mailing list -- [email protected] To unsubscribe send an email to [email protected] website : http://www.koha-community.org/ git : http://git.koha-community.org/ bugs : http://bugs.koha-community.org/
