gitea
/
Koha-clms
1
0
Fork 0
Code Issues Pull Requests Packages Projects Releases Wiki Activity

Bug 42747: Prevent SQL injection via image_name in edit-layout 

Signed-off-by: Sanjar Tulkinov Anvar o'g'li <sanjarbiy11@gmail.com>
Signed-off-by: Martin Renvoize <martin.renvoize@openfifth.co.uk>
(cherry picked from commit dc4403aae0)
Signed-off-by: Baptiste Wojtkowski <baptiste.wojtkowski@biblibre.com>
This commit is contained in:
Jonathan Druart 2026-07-07 14:23:44 +01:00 committed by Baptiste Wojtkowski
parent 1a552017ac
commit 26418d381e
No known key found for this signature in database
GPG Key ID: 47A8A13E10BC0D40
1 changed files with 17 additions and 4 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

21
patroncards/edit-layout.pl
View File

@ -178,6 +178,12 @@ elsif ($op eq 'cud-save') {
my $array_index = 0;
my $image_select = 0;
my $field_enabled = 0;
# Get valid image names for validation
my $valid_image_names = get_all_image_names();
my %valid_images = map { $_->{'type'} => 1 } @$valid_image_names;
$valid_images{'none'} = 1; # 'none' is also a valid value
CGI_PARAMS:
foreach my $parameter ($cgi->multi_param()) { # parse the field values and build a hash of the layout for conversion to xml and storage in the db
if ($parameter =~ m/^field_([0-9])_(.*)$/) {
@ -208,11 +214,18 @@ elsif ($op eq 'cud-save') {
my $image_data = $2;
$field_enabled = $image_number if $cgi->param("image_$image_number" . "_image_source") ne 'none';
next CGI_PARAMS unless $image_number == $field_enabled;
my $param_value = $cgi->param($parameter);
# Sanitize image_name
my $field_name = $image_data =~ m/^image_(.*)$/ ? $1 : $image_data;
$param_value = undef
if $field_name eq 'name'
&& $param_value
&& !exists $valid_images{$param_value};
if ($image_data =~ m/^image_(.*)$/) {
$layout->{'images'}->{"image_$image_number"}->{'data_source'}->{"image_$1"} = $cgi->param($parameter);
}
else {
$layout->{'images'}->{"image_$image_number"}->{$image_data} = $cgi->param($parameter);
$layout->{'images'}->{"image_$image_number"}->{'data_source'}->{"image_$1"} = $param_value;
} else {
$layout->{'images'}->{"image_$image_number"}->{$image_data} = $param_value;
}
}
else {