|
Lines 18-24
Link Here
|
| 18 |
# along with Koha; if not, see <http://www.gnu.org/licenses>. |
18 |
# along with Koha; if not, see <http://www.gnu.org/licenses>. |
| 19 |
|
19 |
|
| 20 |
use Modern::Perl; |
20 |
use Modern::Perl; |
| 21 |
use Test::More tests => 100; |
21 |
use Test::More tests => 101; |
| 22 |
use Test::MockModule; |
22 |
use Test::MockModule; |
| 23 |
use Test::Warn; |
23 |
use Test::Warn; |
| 24 |
use Test::Exception; |
24 |
use Test::Exception; |
|
Lines 1523-1525
subtest 'Template toolkit syntax in parameters' => sub {
Link Here
|
| 1523 |
'Template toolkit syntax in parameter was not evaluated.' |
1523 |
'Template toolkit syntax in parameter was not evaluated.' |
| 1524 |
); |
1524 |
); |
| 1525 |
}; |
1525 |
}; |
| 1526 |
- |
1526 |
|
|
|
1527 |
subtest 'Quote user params in GetPreparedLetter' => sub { |
| 1528 |
plan tests => 1; |
| 1529 |
|
| 1530 |
my $patron = $builder->build_object( { class => 'Koha::Patrons' } ); |
| 1531 |
my $biblio = $builder->build_sample_biblio; |
| 1532 |
my %loops = ( biblio => [ $biblio->biblionumber . ') AND (SELECT 1 FROM (SELECT(SLEEP(10)))x)-- -' ] ); |
| 1533 |
my %substitute = ( comment => 'some comment' ); |
| 1534 |
|
| 1535 |
Koha::Notice::Template->new( |
| 1536 |
{ |
| 1537 |
module => 'catalogue', |
| 1538 |
code => 'CART', |
| 1539 |
branchcode => '', |
| 1540 |
message_transport_type => 'email', |
| 1541 |
content => |
| 1542 |
'Hello [% borrower.firstname %], Some comments about those biblios [% FOR b IN biblios %][% biblio.title %][% END %]: [% comment %]', |
| 1543 |
} |
| 1544 |
)->store; |
| 1545 |
|
| 1546 |
my $t = time; |
| 1547 |
my $letter = C4::Letters::GetPreparedLetter( |
| 1548 |
module => 'catalogue', |
| 1549 |
letter_code => 'CART', |
| 1550 |
tables => { |
| 1551 |
borrowers => $patron->borrowernumber, |
| 1552 |
}, |
| 1553 |
message_transport_type => 'email', |
| 1554 |
loops => \%loops, |
| 1555 |
substitute => \%substitute, |
| 1556 |
); |
| 1557 |
my $exec_time = time - $t; |
| 1558 |
ok( $exec_time < 10, "We should not exec the SLEEP" ) |
| 1559 |
or diag sprintf( |
| 1560 |
"Spent %ss to run GetPreparredLetter, SLEEP has certainly been executed which could lead to SQL injections", |
| 1561 |
$exec_time |
| 1562 |
); |
| 1563 |
}; |