https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=43292
--- Comment #1 from Martin Renvoize (ashimema) <[email protected]> --- Created attachment 203595 --> https://bugs.koha-community.org/bugzilla3/attachment.cgi?id=203595&action=edit Bug 43292: Strip CR/LF from patron screen_msg before adding to SIP2 responses Koha::Patron::Message already has a message_without_newlines method specifically to protect SIP2 patron-message screen_msg composition from embedded newlines, but two other sources that feed into a patron's screen_msg - the OPAC note (opacnote) and a restriction's debarredcomment, both composed in C4::SIP::ILS::Patron - are not sanitized before being sent as a SIP2 FID_SCREEN_MSG field. Since SIP2 messages are CR-terminated on the wire, a literal CR or LF inside a patron's OPAC note or restriction comment (both plain text fields editable via the staff interface / OPAC) can prematurely terminate the message and desync the self-check client's parser. Sanitize the patron screen_msg immediately after reading it in build_patron_status and handle_patron_info, matching the exact CR/LF-stripping approach already used by Koha::Patron::Message->message_without_newlines. Test plan: 1) Add an OPAC note (or a restriction comment) containing an embedded newline to a patron, e.g. via the staff client's patron notes field 2) Send a SIP2 Patron Status Request (or Patron Information request) for that patron 3) Before this patch: the FID_SCREEN_MSG field in the raw response contains an embedded CR/LF, corrupting the message framing 4) Apply the patch and repeat step 2 5) The screen message is present but any CR/LF has been collapsed to a space, and the response is well-formed -- You are receiving this mail because: You are watching all bug changes. You are the assignee for the bug. _______________________________________________ Koha-bugs mailing list -- [email protected] To unsubscribe send an email to [email protected] website : http://www.koha-community.org/ git : http://git.koha-community.org/ bugs : http://bugs.koha-community.org/
