From 2b09e846bcafb33fba547a4c18ec4b762192be8c Mon Sep 17 00:00:00 2001 From: Jonathan Druart Date: Tue, 2 Jun 2026 14:08:10 +0200 Subject: [PATCH] Bug 42746: Sanitize age_field Signed-off-by: Sanjar Tulkinov Anvar o'g'li Signed-off-by: Pedro Amorim --- tools/automatic_item_modification_by_age.pl | 19 ++++++++++--------- 1 file changed, 10 insertions(+), 9 deletions(-) diff --git a/tools/automatic_item_modification_by_age.pl b/tools/automatic_item_modification_by_age.pl index 8be74ee0cb..41f4013aa8 100755 --- a/tools/automatic_item_modification_by_age.pl +++ b/tools/automatic_item_modification_by_age.pl @@ -56,7 +56,14 @@ my ( $template, $loggedinuser, $cookie ) = get_template_and_user( } ); -my $op = $cgi->param('op') // 'show'; +my $op = $cgi->param('op') // 'show'; +my @item_fields = map { "items.$_" } Koha::Items->columns; +my @biblioitem_fields = map { "biblioitems.$_" } Koha::Biblioitems->columns; +my @biblio_fields = map { "biblio.$_" } Koha::Biblios->columns; +my @allowed_age_fields = ( + 'items.dateaccessioned', 'items.replacementpricedate', 'items.datelastborrowed', 'items.datelastseen', + 'items.damaged_on', 'items.itemlost_on', 'items.withdrawn_on' +); my $syspref_name = q|automatic_item_modification_by_age_configuration|; if ( $op eq 'cud-update' ) { @@ -89,6 +96,7 @@ if ( $op eq 'cud-update' ) { $rule->{age} = $cgi->param("age_$unique_id"); for my $age_field (@age_fields) { + next unless grep { $_ eq $age_field } @allowed_age_fields; $rule->{agefield} = $age_field ? $age_field : "items.dateaccessioned"; } push @rules, $rule; @@ -114,17 +122,10 @@ if ($@) { exit; } -my @item_fields = map { "items.$_" } Koha::Items->columns; -my @biblioitem_fields = map { "biblioitems.$_" } Koha::Biblioitems->columns; -my @biblio_fields = map { "biblio.$_" } Koha::Biblios->columns; -my @age_fields = ( - 'items.dateaccessioned', 'items.replacementpricedate', 'items.datelastborrowed', 'items.datelastseen', - 'items.damaged_on', 'items.itemlost_on', 'items.withdrawn_on' -); $template->param( op => $op, messages => \@messages, - agefields => [@age_fields], + agefields => [@allowed_age_fields], condition_fields => [ @item_fields, @biblioitem_fields, @biblio_fields ], substitution_fields => \@item_fields, rules => $rules,