From 9c982058fcbb1e5d676c8f7df6775fa17084cf64 Mon Sep 17 00:00:00 2001 From: Jonathan Druart Date: Mon, 8 Jun 2026 12:21:17 +0200 Subject: [PATCH] Bug 42749: Prevent SQL injection from GetInvoices (order_by) Signed-off-by: Sanjar Tulkinov Anvar o'g'li Signed-off-by: Martin Renvoize Signed-off-by: Lucas Gass (cherry picked from commit f2c2314baa29ef39b2a0743d7838eb439de08c17) Signed-off-by: Lucas Gass --- C4/Acquisition.pm | 2 +- t/db_dependent/Acquisition/Invoices.t | 10 +++++++++- 2 files changed, 10 insertions(+), 2 deletions(-) diff --git a/C4/Acquisition.pm b/C4/Acquisition.pm index be67162a9c..52a9c41997 100644 --- a/C4/Acquisition.pm +++ b/C4/Acquisition.pm @@ -2530,7 +2530,7 @@ sub GetInvoices { if ( $args{order_by} ) { my ( $column, $direction ) = split / /, $args{order_by}; if ( grep { $_ eq $column } @columns ) { - $direction ||= 'ASC'; + $direction = ( uc( $direction // '' ) eq 'DESC' ) ? 'DESC' : 'ASC'; $query .= " ORDER BY $column $direction"; } } diff --git a/t/db_dependent/Acquisition/Invoices.t b/t/db_dependent/Acquisition/Invoices.t index 0ac98f044f..0c130d94ea 100755 --- a/t/db_dependent/Acquisition/Invoices.t +++ b/t/db_dependent/Acquisition/Invoices.t @@ -9,7 +9,7 @@ use Koha::Acquisition::Orders; use Koha::Database; use Test::NoWarnings; -use Test::More tests => 30; +use Test::More tests => 31; BEGIN { use_ok( @@ -223,6 +223,14 @@ is_deeply( "GetInvoices return linked_to_subscriptions: there is no invoices linked to subscriptions yet" ); +subtest 'prevent SQL injection in GetInvoices for order_by' => sub { + plan tests => 1; + + # No error + GetInvoices( order_by => 'shipmentdate ASC,(SELECT/**/1/**/FROM/**/koha_zzz_nope)' ); + pass(); +}; + END { $dbh and $schema->storage->txn_rollback(); }