https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=43292
Bug ID: 43292
Summary: Patron screen_msg can contain unescaped CR/LF,
corrupting SIP2 message framing
Initiative type: ---
Sponsorship ---
status:
Product: Koha
Version: Main
Hardware: All
OS: All
Status: NEW
Severity: normal
Priority: P5 - low
Component: SIP2
Assignee: [email protected]
Reporter: [email protected]
QA Contact: [email protected]
Target Milestone: ---
Koha::Patron::Message already has a message_without_newlines method
specifically to protect SIP2 patron-message screen_msg composition
from embedded newlines, but two other sources that feed into a
patron's screen_msg - the OPAC note (opacnote) and a restriction's
debarredcomment, both composed in C4::SIP::ILS::Patron - are not
sanitized before being sent as a SIP2 FID_SCREEN_MSG field.
Since SIP2 messages are CR-terminated on the wire, a literal CR or LF
inside a patron's OPAC note or restriction comment (both plain text
fields editable via the staff interface / OPAC) can prematurely
terminate the message and desync the self-check client's parser.
This patch sanitizes the patron screen_msg immediately after reading
it in build_patron_status and handle_patron_info, matching the exact
CR/LF-stripping approach already used by
Koha::Patron::Message->message_without_newlines.
Test plan:
1. Add an OPAC note (or a restriction comment) containing an embedded
newline to a patron, e.g. via the staff client's patron notes field
2. Send a SIP2 Patron Status Request (or Patron Information request)
for that patron
3. Before this patch: the FID_SCREEN_MSG field in the raw response
contains an embedded CR/LF, corrupting the message framing
4. Apply the patch and repeat step 2
5. The screen message is present but any CR/LF has been collapsed to
a space, and the response is well-formed
--
You are receiving this mail because:
You are the assignee for the bug.
You are watching all bug changes.
_______________________________________________
Koha-bugs mailing list -- [email protected]
To unsubscribe send an email to [email protected]
website : http://www.koha-community.org/
git : http://git.koha-community.org/
bugs : http://bugs.koha-community.org/
