From mboxrd@z Thu Jan  1 00:00:00 1970
From: Bernhard Bitsch <bbitsch@ipfire.org>
To: development@lists.ipfire.org
Subject:
 Re: [PATCH] accounting.cgi: Change some variables to alphanumeric - Bug#12777
Date: Fri, 18 Feb 2022 16:27:54 +0100
Message-ID: <ef7508a5-dc26-da94-d2cd-6cc574026340@ipfire.org>
In-Reply-To: <20220218143352.5927-1-adolf.belka@ipfire.org>
MIME-Version: 1.0
Content-Type: multipart/mixed; boundary="===============7181729178248241140=="
List-Id: <development.lists.ipfire.org>

--===============7181729178248241140==
Content-Type: text/plain; charset="utf-8"
Content-Transfer-Encoding: quoted-printable

Reviewed-by: Bernhard Bitsch <bbitsch(a)ipfire.org>

Am 18.02.2022 um 15:33 schrieb Adolf Belka:
> - The Postcode in the address only allowed numeric postcodes. The Netherlan=
ds and Great
>     Britain are at lease two countries that use alphanumeric postcodes with=
 spaces. Changed
>     the postcode check from numeric to alphanumeric.
> - The Bank Code in the Providers details only allowed numeric Bank Codes. I=
n Great Britain
>     the Bank Code, also known as the Sort Code is made up of three groups o=
f digits separated
>     by a - .
> - Adjusted the regex for the alphanumeric check to include a space and a - =
. The original
>     comment indicated that a - was allowed but it was not included in the r=
egex.
> - Tested on a vm system and confirmed that a postcode from The Netherlands =
and Great Britain
>     and a Sort Code from Breat Britain are now accepted.
>=20
> Fixes: Bug#12777
> Tested-by: Adolf Belka <adolf.belka(a)ipfire.org>
> Signed-off-by: Adolf Belka <adolf.belka(a)ipfire.org>
> ---
>   src/squid-accounting/accounting.cgi | 10 +++++-----
>   1 file changed, 5 insertions(+), 5 deletions(-)
>=20
> diff --git a/src/squid-accounting/accounting.cgi b/src/squid-accounting/acc=
ounting.cgi
> index 751b6e8a5..e1e2346da 100755
> --- a/src/squid-accounting/accounting.cgi
> +++ b/src/squid-accounting/accounting.cgi
> @@ -1488,7 +1488,7 @@ sub checkaddress{
>   	if (! $cgiparams{'txt_plz'}){
>   		$errormessage.=3D"$Lang::tr{'acct empty field'} $Lang::tr{'acct plz'}<b=
r>";
>   	}else{
> -		if(! &validnumfield($cgiparams{'txt_plz'})){
> +		if(! &validalphanumfield($cgiparams{'txt_plz'})){
>   			$errormessage.=3D"$Lang::tr{'acct invalid'} $Lang::tr{'acct plz'}<br>";
>   		}
>   	}
> @@ -1523,7 +1523,7 @@ sub checkaddress{
>   		}
>   		if(($cgiparams{'txt_iban'} && $cgiparams{'txt_blz'})||(!$cgiparams{'txt=
_iban'} && $cgiparams{'txt_blz'})){
>   			#Check BLZ
> -			if(! &validnumfield($cgiparams{'txt_blz'})){
> +			if(! &validalphanumfield($cgiparams{'txt_blz'})){
>   				$errormessage.=3D"$Lang::tr{'acct invalid'} $Lang::tr{'acct blz'}<br>=
";
>   			}
>   			#Check BANKACCOUNT
> @@ -1653,7 +1653,7 @@ sub validphonefield{
>   }
>  =20
>   sub validalphanumfield{
> -	#GET: Input from a numeric field
> +	#GET: Input from an alphanumeric field
>   	#GIVES: True if valid, false if not valid
>   	my $remark =3D $_[0];
>  =20
> @@ -1661,8 +1661,8 @@ sub validalphanumfield{
>   	# but no more than 63 characters
>   	if (length ($remark) < 1 || length ($remark) > 255) {
>   		return 0;}
> -	# Only valid characters are a-z, A-Z, 0-9 and -
> -	if ($remark !~ /^[0-9a-zA-Z]*$/) {
> +	# Only valid characters are a-z, A-Z, 0-9 - and space
> +	if ($remark !~ /^[0-9a-zA-Z- ]*$/) {
>   		return 0;}
>   	# First character can only be a letter or a digit
>   	if (substr ($remark, 0, 1) !~ /^[0-9A-Za-z]*$/) {

--===============7181729178248241140==--