In opac-topissues page, the limit URL argument is directly added to SQL query. This argument should be protected.
Created attachment 19646 [details] [review] Proposed patch See commit message
I'm unable to reproduce this, anything following ';' is stripped off. However, if you replace ; with %3B, then it gets through. However, adding e.g. '%3Btruncate+test%3B' to the end of limit does give me a query that finishes like: GROUP BY biblio.biblionumber HAVING tot >0 ORDER BY tot DESC LIMIT 15;truncate test; which isn't ideal. Running this gives me: DBD::mysql::st execute failed: You have an error in your SQL syntax; check the manual that corresponds to your MySQL server version for the right syntax to use near 'truncate test' at line 14 at /mnt/catalyst/koha/opac/opac-topissues.pl line 117. and I don't fully know why. This said, this shouldn't be possible. I don't think your patch goes far enough though: the $limit should be replaced by a '?' as well as being filtered. I'll test your patch and make a followup with that.
Created attachment 19659 [details] [review] Bug 10590 - in opac-topissues limit param is not protected In opac-topissues page, the limit URL argument is directly added to SQL query. This patch adds protections : limit must only contain digits and must be lower than 100. Test plan : - Edit URL to : /cgi-bin/koha/opac-topissues.pl?limit=10&branch=&itemtype=&timeLimit=999&do_it=1 => You get the results of 10 most cheched-out of all time - Edit URL to : /cgi-bin/koha/opac-topissues.pl?limit=&branch=&itemtype=&timeLimit=999&do_it=1 => You get the results of 10 most cheched-out of all time - Edit URL to : /cgi-bin/koha/opac-topissues.pl?limit=9999&branch=&itemtype=&timeLimit=999&do_it=1 => You get the results of 100 most cheched-out of all time - Edit URL to : /cgi-bin/koha/opac-topissues.pl?limit=WHERE&branch=&itemtype=&timeLimit=999&do_it=1 => You get the results of 10 most cheched-out of all time Signed-off-by: Robin Sheat <robin@catalyst.net.nz>
Created attachment 19660 [details] [review] Bug 10590 - parameterise the limit option The limit option was previously substituted directly into the query. The previous patch on bug 10590 filters it on input, but there's no reason not to have it made to work properly in the query for added safety.
(In reply to Robin Sheat from comment #2) I did not took the time to hack the system with that but nevertheless it is dangerous to keep it as it is. > I don't think your patch goes far enough though: the $limit should be replaced by a '?' as well as being filtered You mean ending query with "limit ?" and using execute($limit) ? I thought it would not work because limit will be a string : "limit '10'".
(In reply to Fridolyn SOMERS from comment #5) > (In reply to Robin Sheat from comment #2) > I did not took the time to hack the system with that but nevertheless it is > dangerous to keep it as it is. It is. > > I don't think your patch goes far enough though: the $limit should be replaced by a '?' as well as being filtered > You mean ending query with "limit ?" and using execute($limit) ? > I thought it would not work because limit will be a string : "limit '10'". It works fine, SQL doesn't really care about the difference between strings and numbers when working with parameters. I'm marking this signed off as it's /vital/ that one of these patches goes in, it'd be best if they both did.
(In reply to Robin Sheat from comment #2) > Running this gives me: > DBD::mysql::st execute failed: You have an error in your SQL syntax; check > the manual that corresponds to your MySQL server version for the right > syntax to use near 'truncate test' at line 14 at > /mnt/catalyst/koha/opac/opac-topissues.pl line 117. > > and I don't fully know why. Looks like one might have to enable multiple statement execution support [1] to get the canonical exploit to work. [1] http://dev.mysql.com/doc/refman/5.0/en/c-api-multiple-queries.html
I'm testing and doing a second signoff now, after which I've enlisted Katrin's help to QA.
Created attachment 19661 [details] [review] Bug 10590 - parameterise the limit option The limit option was previously substituted directly into the query. The previous patch on bug 10590 filters it on input, but there's no reason not to have it made to work properly in the query for added safety. To test: [1] Go to the top checkouts report (http://OPAC/cgi-bin/koha/opac-topissues.pl) [2] Run the report several times, varying the filters on number of results and item type. [3] Verify the the list of top checkouts appears to be correct. Signed-off-by: Galen Charlton <gmc@esilibrary.com>
Created attachment 19662 [details] [review] Bug 10590 - parameterise the limit option The limit option was previously substituted directly into the query. The previous patch on bug 10590 filters it on input, but there's no reason not to have it made to work properly in the query for added safety. To test: [1] Go to the top checkouts report (http://OPAC/cgi-bin/koha/opac-topissues.pl) [2] Run the report several times, varying the filters on number of results and item type. [3] Verify the the list of top checkouts appears to be correct. Signed-off-by: Galen Charlton <gmc@esilibrary.com>
Created attachment 19663 [details] [review] Bug 10590 - in opac-topissues limit param is not protected In opac-topissues page, the limit URL argument is directly added to SQL query. This patch adds protections : limit must only contain digits and must be lower than 100. Test plan : - Edit URL to : /cgi-bin/koha/opac-topissues.pl?limit=10&branch=&itemtype=&timeLimit=999&do_it=1 => You get the results of 10 most cheched-out of all time - Edit URL to : /cgi-bin/koha/opac-topissues.pl?limit=&branch=&itemtype=&timeLimit=999&do_it=1 => You get the results of 10 most cheched-out of all time - Edit URL to : /cgi-bin/koha/opac-topissues.pl?limit=9999&branch=&itemtype=&timeLimit=999&do_it=1 => You get the results of 100 most cheched-out of all time - Edit URL to : /cgi-bin/koha/opac-topissues.pl?limit=WHERE&branch=&itemtype=&timeLimit=999&do_it=1 => You get the results of 10 most cheched-out of all time Signed-off-by: Robin Sheat <robin@catalyst.net.nz> Signed-off-by: Galen Charlton <gmc@esilibrary.com>
Created attachment 19664 [details] [review] Bug 10590 - parameterise the limit option The limit option was previously substituted directly into the query. The previous patch on bug 10590 filters it on input, but there's no reason not to have it made to work properly in the query for added safety. To test: [1] Go to the top checkouts report (http://OPAC/cgi-bin/koha/opac-topissues.pl) [2] Run the report several times, varying the filters on number of results and item type. [3] Verify the the list of top checkouts appears to be correct. Signed-off-by: Galen Charlton <gmc@esilibrary.com>
Created attachment 19665 [details] [review] Bug 10590 - in opac-topissues limit param is not protected In opac-topissues page, the limit URL argument is directly added to SQL query. This patch adds protections : limit must only contain digits and must be lower than 100. Test plan : - Edit URL to : /cgi-bin/koha/opac-topissues.pl?limit=10&branch=&itemtype=&timeLimit=999&do_it=1 => You get the results of 10 most cheched-out of all time - Edit URL to : /cgi-bin/koha/opac-topissues.pl?limit=&branch=&itemtype=&timeLimit=999&do_it=1 => You get the results of 10 most cheched-out of all time - Edit URL to : /cgi-bin/koha/opac-topissues.pl?limit=9999&branch=&itemtype=&timeLimit=999&do_it=1 => You get the results of 100 most cheched-out of all time - Edit URL to : /cgi-bin/koha/opac-topissues.pl?limit=WHERE&branch=&itemtype=&timeLimit=999&do_it=1 => You get the results of 10 most cheched-out of all time Signed-off-by: Robin Sheat <robin@catalyst.net.nz> Signed-off-by: Galen Charlton <gmc@esilibrary.com>
Created attachment 19666 [details] [review] Bug 10590 - parameterise the limit option The limit option was previously substituted directly into the query. The previous patch on bug 10590 filters it on input, but there's no reason not to have it made to work properly in the query for added safety. To test: [1] Go to the top checkouts report (http://OPAC/cgi-bin/koha/opac-topissues.pl) [2] Run the report several times, varying the filters on number of results and item type. [3] Verify the the list of top checkouts appears to be correct. Signed-off-by: Galen Charlton <gmc@esilibrary.com>
Created attachment 19667 [details] [review] Bug 10590 - parameterise the limit option The limit option was previously substituted directly into the query. The previous patch on bug 10590 filters it on input, but there's no reason not to have it made to work properly in the query for added safety. To test: [1] Go to the top checkouts report (http://OPAC/cgi-bin/koha/opac-topissues.pl) [2] Run the report several times, varying the filters on number of results and item type. [3] Verify the the list of top checkouts appears to be correct. Signed-off-by: Galen Charlton <gmc@esilibrary.com> Signed-off-by: Jonathan Druart <jonathan.druart@biblibre.com>
Created attachment 19668 [details] [review] Bug 10590 - in opac-topissues limit param is not protected In opac-topissues page, the limit URL argument is directly added to SQL query. This patch adds protections : limit must only contain digits and must be lower than 100. Test plan : - Edit URL to : /cgi-bin/koha/opac-topissues.pl?limit=10&branch=&itemtype=&timeLimit=999&do_it=1 => You get the results of 10 most cheched-out of all time - Edit URL to : /cgi-bin/koha/opac-topissues.pl?limit=&branch=&itemtype=&timeLimit=999&do_it=1 => You get the results of 10 most cheched-out of all time - Edit URL to : /cgi-bin/koha/opac-topissues.pl?limit=9999&branch=&itemtype=&timeLimit=999&do_it=1 => You get the results of 100 most cheched-out of all time - Edit URL to : /cgi-bin/koha/opac-topissues.pl?limit=WHERE&branch=&itemtype=&timeLimit=999&do_it=1 => You get the results of 10 most cheched-out of all time Signed-off-by: Robin Sheat <robin@catalyst.net.nz> Signed-off-by: Galen Charlton <gmc@esilibrary.com> Signed-off-by: Jonathan Druart <jonathan.druart@biblibre.com>
Created attachment 19669 [details] [review] Bug 10590 - parameterise the limit option The limit option was previously substituted directly into the query. The previous patch on bug 10590 filters it on input, but there's no reason not to have it made to work properly in the query for added safety. To test: [1] Go to the top checkouts report (http://OPAC/cgi-bin/koha/opac-topissues.pl) [2] Run the report several times, varying the filters on number of results and item type. [3] Verify the the list of top checkouts appears to be correct. Signed-off-by: Galen Charlton <gmc@esilibrary.com> Signed-off-by: Jonathan Druart <jonathan.druart@biblibre.com>
Fixes sound good to me. Marked as Passed QA.
Created attachment 19670 [details] [review] [PASSED QA] Bug 10590 - in opac-topissues limit param is not protected In opac-topissues page, the limit URL argument is directly added to SQL query. This patch adds protections : limit must only contain digits and must be lower than 100. Test plan : - Edit URL to : /cgi-bin/koha/opac-topissues.pl?limit=10&branch=&itemtype=&timeLimit=999&do_it=1 => You get the results of 10 most cheched-out of all time - Edit URL to : /cgi-bin/koha/opac-topissues.pl?limit=&branch=&itemtype=&timeLimit=999&do_it=1 => You get the results of 10 most cheched-out of all time - Edit URL to : /cgi-bin/koha/opac-topissues.pl?limit=9999&branch=&itemtype=&timeLimit=999&do_it=1 => You get the results of 100 most cheched-out of all time - Edit URL to : /cgi-bin/koha/opac-topissues.pl?limit=WHERE&branch=&itemtype=&timeLimit=999&do_it=1 => You get the results of 10 most cheched-out of all time Signed-off-by: Robin Sheat <robin@catalyst.net.nz> Signed-off-by: Galen Charlton <gmc@esilibrary.com> Signed-off-by: Jonathan Druart <jonathan.druart@biblibre.com> Signed-off-by: Katrin Fischer <katrin.fischer@bsz-bw.de>
Created attachment 19671 [details] [review] [PASSED QA] Bug 10590 - parameterise the limit option The limit option was previously substituted directly into the query. The previous patch on bug 10590 filters it on input, but there's no reason not to have it made to work properly in the query for added safety. To test: [1] Go to the top checkouts report (http://OPAC/cgi-bin/koha/opac-topissues.pl) [2] Run the report several times, varying the filters on number of results and item type. [3] Verify the the list of top checkouts appears to be correct. Signed-off-by: Galen Charlton <gmc@esilibrary.com> Signed-off-by: Jonathan Druart <jonathan.druart@biblibre.com> Signed-off-by: Katrin Fischer <katrin.fischer@bsz-bw.de>
Pushed to master. Thanks, everybody!
This patch has been pushed to 3.12.x, will be in 3.12.2. Thanks Fridolyn and Robin!
Pushed to 3.10.x, will be in 3.10.8
Pushed to 3.8.x, will be in 3.8.15