gitea
/
Koha-clms
1
0
Fork 0
Code Issues Pull Requests Packages Projects Releases Wiki Activity

Bug 42749: Prevent SQL injection from GetInvoices (order_by) 

Signed-off-by: Sanjar Tulkinov Anvar o'g'li <sanjarbiy11@gmail.com>
Signed-off-by: Martin Renvoize <martin.renvoize@openfifth.co.uk>
Signed-off-by: Wainui Witika-Park <wainuiwitikapark@catalyst.net.nz>
This commit is contained in:
Jonathan Druart 2026-06-08 12:21:17 +02:00 committed by Wainui Witika-Park
parent bc07155f03
commit e8d39513ea
No known key found for this signature in database
GPG Key ID: 2D0A6AB5DAF1B78D
2 changed files with 10 additions and 2 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

2
C4/Acquisition.pm
View File

@ -2531,7 +2531,7 @@ sub GetInvoices {
if ( $args{order_by} ) {
my ( $column, $direction ) = split / /, $args{order_by};
if ( grep { $_ eq $column } @columns ) {
$direction ||= 'ASC';
$direction = ( uc( $direction // '' ) eq 'DESC' ) ? 'DESC' : 'ASC';
$query .= " ORDER BY $column $direction";
}
}

10
t/db_dependent/Acquisition/Invoices.t
View File

@ -9,7 +9,7 @@ use Koha::Acquisition::Orders;
use Koha::Database;
use Test::NoWarnings;
use Test::More tests => 30;
use Test::More tests => 31;
BEGIN {
use_ok(
@ -223,6 +223,14 @@ is_deeply(
"GetInvoices return linked_to_subscriptions: there is no invoices linked to subscriptions yet"
);
subtest 'prevent SQL injection in GetInvoices for order_by' => sub {
plan tests => 1;
# No error
GetInvoices( order_by => 'shipmentdate ASC,(SELECT/**/1/**/FROM/**/koha_zzz_nope)' );
pass();
};
END {
$dbh and $schema->storage->txn_rollback();
}