gitea
/
Koha-clms
1
0
Fork 0
Code Issues Pull Requests Packages Projects Releases Wiki Activity

Bug 42866: Prevent SQL injection in Koha::AddtionalContents->search_for_display 

Signed-off-by: Sanjar Tulkinov Anvar o'g'li <sanjarbiy11@gmail.com>

Signed-off-by: Marcel de Rooy <m.de.rooy@rijksmuseum.nl>
Signed-off-by: Lucas Gass <lucas@bywatersolutions.com>
(cherry picked from commit 9ed242f2e3ccdb944bac87f9033a695eac187f5c)
Signed-off-by: Lucas Gass <lucas@bywatersolutions.com>
This commit is contained in:
Jonathan Druart 2026-06-18 11:21:38 +02:00 committed by Lucas Gass
parent 9c982058fc
commit baedef6e14
No known key found for this signature in database
GPG Key ID: 60B447398B0D36CA
2 changed files with 25 additions and 8 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

22
Koha/AdditionalContents.pm
View File

@ -95,15 +95,23 @@ sub search_for_display {
my ( $self, $params ) = @_;
my $lang = $params->{lang} || q{};
# If lang is not default, we will search for entries matching $lang but fallback to default if $lang is not found
# Then we need a subquery count in where clause; DBIx::Class/SQL::Abstract does not support it, fallback to literal SQL
my $subquery =
qq|(SELECT COUNT(*) FROM additional_contents_localizations WHERE lang='$lang' AND additional_content_id=me.additional_content_id)=0|;
my $search_params = get_public_query_search_params($params);
$search_params->{lang} = 'default' if !$lang || $lang eq 'default';
$search_params->{-or} = [ { 'lang' => $lang }, '-and' => [ 'lang', 'default', \$subquery ] ]
if !$search_params->{lang};
unless ( $search_params->{lang} ) {
$search_params->{-or} = [
{ lang => $lang },
{
-and => [
{ lang => 'default' },
\[
'(SELECT COUNT(*) FROM additional_contents_localizations WHERE lang = ? AND additional_content_id = me.additional_content_id) = 0',
$lang
]
]
}
];
}
my $attribs = {
prefetch => 'additional_content',

11
t/db_dependent/Koha/AdditionalContents.t
View File

@ -192,7 +192,7 @@ subtest '->author' => sub {
subtest '->search_for_display' => sub {
plan tests => 4;
plan tests => 5;
$schema->storage->txn_begin;
@ -305,6 +305,15 @@ subtest '->search_for_display' => sub {
# TODO We should add more tests here
$schema->storage->txn_rollback;
subtest 'prevent SQL injections' => sub {
plan tests => 1;
$schema->storage->txn_begin;
my $lang = q{' OR Booh!};
Koha::AdditionalContents->search_for_display( { lang => $lang } )->count;
pass(q{Shouldn't get a warning or exception});
$schema->storage->txn_rollback;
};
};
subtest 'find_best_match' => sub {