6c2b2d54a8
The "Most-circulated items" report built its SQL by concatenating the Criteria and Filter request parameters directly into the query, with no bind placeholders and no whitelist on the Criteria identifier. An authenticated staff user with the reports permission could inject arbitrary SQL and read any data reachable by the Koha database user. This validates the Criteria parameter against a fixed allow-list of the report's own column options (matching reports/cat_issues_top.tt) so it is safe to use as a SQL identifier, and binds every Filter value with a placeholder in both the column-header query and the main calculation query. The Limit parameter is validated as a plain integer. This mirrors the fix already applied to the sibling reports/bor_issues_top.pl (bug 42369). Test plan: 0. Apply the patch 1. koha-plack --restart kohadev 2. Go to Reports > Most-circulated items (reports/cat_issues_top.pl) 3. Run the report with various Criteria and Filter values, confirm the output is correct and no errors appear 4. Before the patch, a Filter value or the Criteria containing SQL (a single quote followed by a subquery) broke out of the query. After the patch, confirm such input is treated as a literal value: you get normal output or an empty result, with no SQL error, no delay, and no data leak Signed-off-by: Sanjar Tulkinov Anvar o'g'li <sanjarbiy11@gmail.com> Signed-off-by: David Cook <dcook@prosentient.com.au> Signed-off-by: Aleisha Amohia <aleisha@catalyst.net.nz> (cherry picked from commit b6cdb398237ddfc3d3da97a0246c5a3a69fdaf9b) Signed-off-by: Fridolin Somers <fridolin.somers@biblibre.com> |
||
|---|---|---|
| .github/workflows | ||
| C4 | ||
| Koha | ||
| acqui | ||
| admin | ||
| api | ||
| authorities | ||
| basket | ||
| bin | ||
| bookings | ||
| catalogue | ||
| cataloguing | ||
| circ | ||
| clubs | ||
| course_reserves | ||
| debian | ||
| docs | ||
| erm | ||
| errors | ||
| etc | ||
| ill | ||
| installer | ||
| koha-tmpl | ||
| labels | ||
| lib | ||
| members | ||
| misc | ||
| offline_circ | ||
| opac | ||
| patron_lists | ||
| patroncards | ||
| plugins | ||
| pos | ||
| preservation | ||
| recalls | ||
| reports | ||
| reserve | ||
| reviews | ||
| rotating_collections | ||
| serials | ||
| services | ||
| skel | ||
| suggestion | ||
| svc | ||
| t | ||
| tags | ||
| tools | ||
| virtualshelves | ||
| xt | ||
| .editorconfig | ||
| .gitignore | ||
| .htaccess | ||
| .mailmap | ||
| .perlcriticrc | ||
| .perltidyrc | ||
| .prettierrc.js | ||
| .proverc.dist | ||
| .stylelintrc.json | ||
| INSTALL | ||
| Koha.pm | ||
| LICENSE | ||
| MANIFEST.SKIP | ||
| Makefile.PL | ||
| README | ||
| README.md | ||
| README.robots | ||
| SECURITY.md | ||
| about.pl | ||
| app.psgi | ||
| build-resources.PL | ||
| changelanguage.pl | ||
| cpanfile | ||
| cypress.config.ts | ||
| eslint.config.mjs | ||
| fix-perl-path.PL | ||
| gulpfile.js | ||
| help.pl | ||
| kohaversion.pl | ||
| mainpage.pl | ||
| package.json | ||
| rewrite-config.PL | ||
| rspack.config.js | ||
| tsconfig.json | ||
| webpack.config.js | ||
| yarn.lock | ||
README.md
Koha is a free software integrated library system (ILS).
Koha is distributed under the GNU GPL version 3 or later.
Note: Koha does not accept pull requests from git hosting sites.
Note: This project has its own bug tracker, to report a bug or submit a patch visit http://bugs.koha-community.org.
For guidelines on submitting patches for Koha please visit https://wiki.koha-community.org/wiki/SubmitingAPatch
The developers handbook can be found at https://wiki.koha-community.org/wiki/Developer_handbook
