Koha-clms/reports
Jonathan Druart 8ddc98a6fc
Bug 42735: [24.11] Fix SQL injection
This change fixes an SQL injection in the circulation stats.

Test plan:
0. Apply the patch
1. sudo koha-plack --restart kohadev
2. Go to /cgi-bin/koha/reports/issues_stats.pl
3. Try out a bunch of options
4. Try to break it
5. Note that you just get output and no errors

Signed-off-by: Sanjar Tulkinov Anvar o'g'li <sanjarbiy11@gmail.com>
Signed-off-by: Martin Renvoize <martin.renvoize@openfifth.co.uk>
(cherry picked from commit da14a2f672330d445b442cd057bd72688bfb0c37)
Signed-off-by: Fridolin Somers <fridolin.somers@biblibre.com>
2026-06-18 15:50:41 +02:00
..
acquisitions_stats.pl Bug 42360: [24.11] Move separator validation to C4::Context::csv_delimiter 2026-06-18 15:50:38 +02:00
bor_issues_top.pl Bug 42369: [24.11] Use C4::Context::csv_delimiter for delimiter validation 2026-06-18 15:50:41 +02:00
borrowers_out.pl Bug 34478: op =~ ^cud- - Manual - cud-do_it => do_it 2024-03-01 10:58:32 +01:00
borrowers_stats.pl Bug 36380: Add filter value on patron statistics report summary 2024-05-10 15:19:11 +02:00
cash_register_stats.pl Bug 33339: Prevent Formula Injection (CSV Injection) in CSV files 2024-11-14 10:46:31 +01:00
cat_issues_top.pl Bug 34478: op =~ ^cud- - Manual - cud-do_it => do_it 2024-03-01 10:58:32 +01:00
catalog_by_itemtype.pl Bug 31988: Remove reports/itemtypes.plugin 2024-03-18 18:03:39 +01:00
catalogue_out.pl Bug 42361: Fix SQL injection in catalogue_out.pl 2026-05-28 10:12:20 +00:00
catalogue_stats.pl Bug 42363: [24.11] Use C4::Context::csv_delimiter for delimiter validation 2026-06-18 15:50:39 +02:00
dictionary.pl Bug 37784: (QA follow-up) Bail out to new definition 2025-03-24 17:59:10 +01:00
guided_reports.pl Bug 38414: [24.11.x] Fix permission controller-side 2026-05-28 10:09:20 +00:00
issues_avg_stats.pl Bug 42368: [24.11] Use C4::Context::csv_delimiter for delimiter validation 2026-06-18 15:50:40 +02:00
issues_stats.pl Bug 42735: [24.11] Fix SQL injection 2026-06-18 15:50:41 +02:00
itemslost.pl Bug 33339: Prevent Formula Injection (CSV Injection) in CSV files 2024-11-14 10:46:31 +01:00
orders_by_fund.pl Bug 40419: Fix wrong license 2025-08-01 14:50:29 +02:00
reports-home.pl Bug 34859: Remove unnecessary params from reports-home.pl 2023-10-04 16:40:16 -04:00
reserves_stats.pl Bug 34478: op =~ ^cud- - Manual - cud-do_it => do_it 2024-03-01 10:58:32 +01:00
serials_stats.pl Bug 34478: op =~ ^cud- - Manual - cud-do_it => do_it 2024-03-01 10:58:32 +01:00