View | Details | Raw Unified | Return to bug 36520
Collapse All | Expand All

(-)a/t/db_dependent/Letters.t (-2 / +39 lines)
Lines 18-24 Link Here
18
# along with Koha; if not, see <http://www.gnu.org/licenses>.
18
# along with Koha; if not, see <http://www.gnu.org/licenses>.
19
19
20
use Modern::Perl;
20
use Modern::Perl;
21
use Test::More tests => 100;
21
use Test::More tests => 101;
22
use Test::MockModule;
22
use Test::MockModule;
23
use Test::Warn;
23
use Test::Warn;
24
use Test::Exception;
24
use Test::Exception;
Lines 1523-1525 subtest 'Template toolkit syntax in parameters' => sub { Link Here
1523
        'Template toolkit syntax in parameter was not evaluated.'
1523
        'Template toolkit syntax in parameter was not evaluated.'
1524
    );
1524
    );
1525
};
1525
};
1526
- 
1526
1527
subtest 'Quote user params in GetPreparedLetter' => sub {
1528
    plan tests => 1;
1529
1530
    my $patron     = $builder->build_object( { class => 'Koha::Patrons' } );
1531
    my $biblio     = $builder->build_sample_biblio;
1532
    my %loops      = ( biblio  => [ $biblio->biblionumber . ') AND (SELECT 1 FROM (SELECT(SLEEP(10)))x)-- -' ] );
1533
    my %substitute = ( comment => 'some comment' );
1534
1535
    Koha::Notice::Template->new(
1536
        {
1537
            module                 => 'catalogue',
1538
            code                   => 'CART',
1539
            branchcode             => '',
1540
            message_transport_type => 'email',
1541
            content                =>
1542
                'Hello [% borrower.firstname %], Some comments about those biblios [% FOR b IN biblios %][% biblio.title %][% END %]: [% comment %]',
1543
        }
1544
    )->store;
1545
1546
    my $t      = time;
1547
    my $letter = C4::Letters::GetPreparedLetter(
1548
        module      => 'catalogue',
1549
        letter_code => 'CART',
1550
        tables      => {
1551
            borrowers => $patron->borrowernumber,
1552
        },
1553
        message_transport_type => 'email',
1554
        loops                  => \%loops,
1555
        substitute             => \%substitute,
1556
    );
1557
    my $exec_time = time - $t;
1558
    ok( $exec_time < 10, "We should not exec the SLEEP" )
1559
        or diag sprintf(
1560
        "Spent %ss to run GetPreparredLetter, SLEEP has certainly been executed which could lead to SQL injections",
1561
        $exec_time
1562
        );
1563
};

Return to bug 36520