[otrs-cvs] ITSMConfigurationManagement/Kernel/Modules AgentITSMConfigItemSearch.pm, 1.27, 1.27.2.1

Comments:
Update of /home/cvs/ITSMConfigurationManagement/Kernel/Modules
In directory lancelot:/tmp/cvs-serv21507/Kernel/Modules

Modified Files:
      Tag: rel-3_0
	AgentITSMConfigItemSearch.pm 
Log Message:
Fixed bug# 9547 - XSS and SQL injection vulnerability in module AgentITSMConfigItemSearch on parameter ClassID.

Author: ub

Index: AgentITSMConfigItemSearch.pm
===================================================================
RCS file: /home/cvs/ITSMConfigurationManagement/Kernel/Modules/AgentITSMConfigItemSearch.pm,v
retrieving revision 1.27
retrieving revision 1.27.2.1
diff -2 -u -d -r1.27 -r1.27.2.1
--- AgentITSMConfigItemSearch.pm	12 May 2011 17:21:19 -0000	1.27
+++ AgentITSMConfigItemSearch.pm	28 Jun 2013 11:14:52 -0000	1.27.2.1
@@ -1,5 +1,5 @@
 # --
-# Kernel/Modules/AgentITSMConfigItemSearch.pm - the OTRS::ITSM config item search module
-# Copyright (C) 2001-2011 OTRS AG, http://otrs.org/
+# Kernel/Modules/AgentITSMConfigItemSearch.pm - the OTRS ITSM config item search module
+# Copyright (C) 2001-2013 OTRS AG, http://otrs.org/
 # --
 # $Id$
@@ -55,5 +55,5 @@
     # get config data
     $Self->{StartHit} = int( $Self->{ParamObject}->GetParam( Param => 'StartHit' ) || 1 );
-    $Self->{SearchLimit} = $Self->{Config}->{SearchLimit} || 500;
+    $Self->{SearchLimit} = $Self->{Config}->{SearchLimit} || 10000;
     $Self->{SortBy} = $Self->{ParamObject}->GetParam( Param => 'SortBy' )
         || $Self->{Config}->{'SortBy::Default'}
@@ -86,4 +86,12 @@
     my $ClassID = $Self->{ParamObject}->GetParam( Param => 'ClassID' );
 
+    # check if class id is valid
+    if ( $ClassID && !$ClassList->{$ClassID} ) {
+        return $Self->{LayoutObject}->ErrorScreen(
+            Message => 'Invalid ClassID!',
+            Comment => 'Please contact the admin.',
+        );
+    }
+
     # get single params
     my %GetParam;
@@ -163,5 +171,5 @@
 
     # ------------------------------------------------------------ #
-    # set sesarch fields for selected class
+    # set search fields for selected class
     # ------------------------------------------------------------ #
     elsif ( $Self->{Subaction} eq 'AJAXUpdate' ) {
@@ -372,5 +380,5 @@
                 active              => $AutoCompleteConfig->{Active},
                 minQueryLength      => $AutoCompleteConfig->{MinQueryLength} || 2,
-                queryDelay          => $AutoCompleteConfig->{QueryDelay} || 0.1,
+                queryDelay          => $AutoCompleteConfig->{QueryDelay} || 100,
                 typeAhead           => $AutoCompleteConfig->{TypeAhead} || 'false',
                 maxResultsDisplayed => $AutoCompleteConfig->{MaxResultsDisplayed} || 20,
@@ -399,8 +407,9 @@
         }
 
-        # store last queue screen
+        # store last overview screen
         my $URL
             = "Action=AgentITSMConfigItemSearch;Profile=$Self->{Profile};"
-            . "TakeLastSearch=1;StartHit=$Self->{StartHit}";
+            . "TakeLastSearch=1;StartHit=$Self->{StartHit};Subaction=Search;"
+            . "OrderBy=$Self->{OrderBy};SortBy=$Self->{SortBy}";
 
         if ($ClassID) {
@@ -495,5 +504,5 @@
 
         # remember last search values only if search is called from a search dialog
-        # not from resuts page
+        # not from results page
         if ( $Self->{SaveProfile} && $Self->{Profile} && $SearchDialog ) {
 
@@ -887,7 +896,9 @@
             my $ClassName = $ClassList->{$ClassID};
             my $Title
-                = $Self->{LayoutObject}->{LanguageObject}->Get('Config Item Search Result: Class')
+                = $Self->{LayoutObject}->{LanguageObject}->Get('Config Item Search Results')
                 . ' '
-                . $ClassName;
+                . $Self->{LayoutObject}->{LanguageObject}->Get('Class')
+                . ' '
+                . $Self->{LayoutObject}->{LanguageObject}->Get($ClassName);
 
             $Output .= $Self->{LayoutObject}->ITSMConfigItemListShow(
---------------------------------------------------------------------
OTRS mailing list: cvs-log - Webpage: http://otrs.org/
Archive: http://lists.otrs.org/pipermail/cvs-log
To unsubscribe: http://lists.otrs.org/cgi-bin/listinfo/cvs-log