https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=41932
--- Comment #54 from Marcel de Rooy <[email protected]> --- (In reply to David Cook from comment #40) > Upon review... the code is not very easy to read at all and I think it might > not validate/sanitize the inputs enough, although I haven't done a practical > check yet. We want to be careful when it comes to regex inputs. I wish we > hadn't added regex to other parts of Koha because it's a nightmare to secure. I removed the regex feature. Altough I think that matching only should not be a nightmare.. > While the code is concise, it's very difficult to read. It's Perlish for > sure but it makes code review and maintenance much harder. Might be worth > breaking the zeropad function into a few different functions and unit > testing them... > > Upon review, it seems that $filter isn't sufficiently validated. > > That said, it looks like we validate some things here but maybe that's the > pairs? Yes, it was too compact. I moved a part to _parse_format and rearranged it. Since format is no regex anymore, it can be validated easier (both filter and pairs list). -- You are receiving this mail because: You are watching all bug changes. _______________________________________________ Koha-bugs mailing list -- [email protected] To unsubscribe send an email to [email protected] website : http://www.koha-community.org/ git : http://git.koha-community.org/ bugs : http://bugs.koha-community.org/
