gitea
/
Koha-clms
1
0
Fork 0
Code Issues Pull Requests Packages Projects Releases Wiki Activity

close security holes in patron search autocompletion 

* Added authorization check - user must have a valid
  session cookie to use this feature; before this change,
  anybody could use circ/ysearch.pl to retrieve the entire
  patron directory without authorization.
* (bug 1953) now uses SQL placeholders

Note: this does, unfortunately, noticeably slow down automcompletion;
this indicates a need for factoring of C4::Auth to make authentication
for AJAX scripts as fast as possible.

Signed-off-by: Joshua Ferraro <jmf@liblime.com>
This commit is contained in:
Galen Charlton 2008-05-12 10:01:10 -05:00 committed by Joshua Ferraro
parent 9fb4a72122
commit 1cdfcdf12b
1 changed files with 14 additions and 8 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

22
circ/ysearch.pl
View File

@ -27,21 +27,27 @@
use strict;
use CGI;
use C4::Context;
use C4::Auth qw/check_cookie_auth/;
my $input = new CGI;
my $query = $input->param('query');
print $input->header(-type => 'text/plain', -charset => 'UTF-8');
my ($auth_status, $sessionID) = check_cookie_auth($input->cookie('CGISESSID'), { circulate => '*' });
if ($auth_status ne "ok") {
exit 0;
}
my $dbh = C4::Context->dbh;
$query = "SELECT surname, firstname, cardnumber, address, city, zipcode ".
"FROM borrowers " .
"WHERE surname LIKE '". $query . "%' " .
"OR firstname LIKE '" . $query . "%' " .
#"OR cardnumber LIKE '" . $query . "%' " .
"ORDER BY surname, firstname ";
my $sth = $dbh->prepare( $query );
$sth->execute();
my $sql = qq(SELECT surname, firstname, cardnumber, address, city, zipcode
FROM borrowers
WHERE surname LIKE ?
OR firstname LIKE ?
ORDER BY surname, firstname);
#"OR cardnumber LIKE '" . $query . "%' " .
my $sth = $dbh->prepare( $sql );
$sth->execute("$query%", "$query%");
while ( my $rec = $sth->fetchrow_hashref ) {
print $rec->{surname} . ", " . $rec->{firstname} . "\t" .
$rec->{cardnumber} . "\t" .