gitea
/
Koha-clms
1
0
Fork 0
Code Issues Pull Requests Packages Projects Releases Wiki Activity

Bug 39866: (QA follow-up) Rudimentary validation of line/column 

Prevent SQL injection.

Note: output_error in Output.pm needs further attention, but out
of scope here. (The error passed gets replaced by 404 here too.)

Test plan:
Pass something else than table.field in Line or Column URL param.
(Manipulate URL.)
You should be redirected to 404 error instead of 500.

Signed-off-by: Marcel de Rooy <m.de.rooy@rijksmuseum.nl>
Signed-off-by: Lucas Gass <lucas@bywatersolutions.com>
(cherry picked from commit eedb6cece6)
Signed-off-by: Paul Derscheid <paul.derscheid@lmscloud.de>
This commit is contained in:
Marcel de Rooy 2025-05-30 10:56:35 +02:00 committed by Paul Derscheid
parent 169b255f9d
commit 1096a512e2
No known key found for this signature in database
GPG Key ID: C25F9FD44CED595B
1 changed files with 13 additions and 0 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

13
reports/acquisitions_stats.pl
View File

@ -60,6 +60,19 @@ my ( $template, $borrowernumber, $cookie ) = get_template_and_user(
}
);
# Validate line and column
if (
$do_it
&& ( !$line
|| $line !~ /^(aqbasket|aqorders|aqbooksellers|items|biblioitems|aqbudgets)\.\w+$/
|| !$column
|| $column !~ /^(aqbasket|aqorders|aqbooksellers|items|biblioitems|aqbudgets)\.\w+$/ )
)
{
C4::Output::output_error( $input, 'Possible SQL injection' );
exit;
}
our $sep = C4::Context->csv_delimiter( scalar $input->param("sep") );
$template->param(