Koha-clms/svc
Aleisha Amohia 62874e328d
Bug 37508: Throw error if password column is detected in SQL report
This enhancement prevents SQL queries from being run if they would return a password field from the database table.

To test:

1. Run tests and notice they fail t/db_dependent/Reports/Guided.t

2. Apply patch and restart services

3. Create a public report with an SQL report which would access a password column in a database table
4. Try to run the report. Notice you are met with an error and the results are not shown.
5. Access the JSON URL, you should not get the results and should be shown an error
6. Confirm tests pass t/db_dependent/Reports/Guided.t

Sponsored-by: Reserve Bank of New Zealand
Signed-off-by: David Cook <dcook@prosentient.com.au>

Signed-off-by: Marcel de Rooy <m.de.rooy@rijksmuseum.nl>
Signed-off-by: Tomas Cohen Arazi <tomascohen@theke.io>
2024-08-12 15:35:12 -03:00
..
cataloguing Bug 31682: Silence automatic linker warn 2022-10-11 10:41:23 -03:00
club Bug 37031: Club enrollment from staff interface fails due to Entrollment typo 2024-07-17 21:33:49 +00:00
config Bug 36084: svc - config/systempreferences 2024-03-01 11:00:46 +01:00
letters Bug 32496: Reduce unnecessary unblessings of objects in Circulation.pm 2023-09-22 10:52:39 -03:00
mana Bug 36418: Catch more cases where header response should be application/json 2024-04-02 17:59:04 +02:00
members Bug 36084: svc - members/add_to_list 2024-03-01 11:00:55 +01:00
records Bug 32631: Error when previewing record during batch record modification 2023-01-27 16:16:43 -03:00
virtualshelves Bug 34913: Adjust C4::Utils::DataTables::VirtualShelves 2024-01-26 15:13:42 +01:00
article_request Bug 36418: Set header response content type to application/json - svc 2024-04-02 17:59:04 +02:00
authentication Bug 36700: Update svc to use CSRF-TOKEN 2024-05-01 13:40:19 +01:00
authorised_values Bug 28785: Adjust check_cookie_auth calls 2021-10-18 11:28:41 +02:00
barcode Bug 37464: Validate "type" sent to barcode/svc 2024-08-12 15:35:10 -03:00
bib Bug 36891: Restore returning 404 from svc/bib when the bib number doesn't exist 2024-07-18 20:12:47 +00:00
bib_framework Bug 28750: fix svc/bib_framework 2021-07-26 16:28:52 +02:00
bib_profile Bug 25898: Prohibit indirect object notation 2020-10-15 12:56:30 +02:00
checkin Bug 36418: Explicitly set response to json 2024-04-02 17:59:03 +02:00
checkout_notes Bug 36084: svc - checkout_notes 2024-03-01 11:00:49 +01:00
checkouts Bug 36418: Set header response content type to application/json - svc 2024-04-02 17:59:04 +02:00
convert_report Bug 34478: Add 'op' to reports/guided_reports - WIP 2024-03-01 10:58:53 +01:00
cover_images Bug 36084: svc - cover_images 2024-03-01 11:00:52 +01:00
creator_batches Bug 36084: svc - creator_batches 2024-03-01 11:00:53 +01:00
holds Bug 36418: Set header response content type to application/json - svc 2024-04-02 17:59:04 +02:00
import_bib Bug 33418: Add overlay_framework option to connexion scripts 2024-05-10 16:45:50 +02:00
localization Bug 14391: Add granular permissions to the administration module 2018-11-07 12:29:32 +00:00
new_bib Bug 29697: Replace some missing occurrences 2022-07-25 09:30:30 -03:00
problem_reports Bug 36084: svc - problem_reports 2024-03-01 11:00:56 +01:00
recall Bug 36418: Catch more cases where header response should be application/json 2024-04-02 17:59:04 +02:00
renew Bug 36418: Explicitly set response to json 2024-04-02 17:59:03 +02:00
report Bug 37508: Throw error if password column is detected in SQL report 2024-08-12 15:35:12 -03:00
return_claims Bug 36418: Set header response content type to application/json - svc 2024-04-02 17:59:04 +02:00
split_callnumbers Bug 26251: Remove unused routines from svc/split_callnumbers 2020-08-20 10:23:56 +02:00