Lines 19-25
Link Here
|
19 |
|
19 |
|
20 |
use Modern::Perl; |
20 |
use Modern::Perl; |
21 |
use File::Basename qw(dirname); |
21 |
use File::Basename qw(dirname); |
22 |
use Test::More tests => 100; |
22 |
use Test::More tests => 101; |
23 |
use Test::MockModule; |
23 |
use Test::MockModule; |
24 |
use Test::Warn; |
24 |
use Test::Warn; |
25 |
use Test::Exception; |
25 |
use Test::Exception; |
Lines 1524-1526
subtest 'Template toolkit syntax in parameters' => sub {
Link Here
|
1524 |
'Template toolkit syntax in parameter was not evaluated.' |
1524 |
'Template toolkit syntax in parameter was not evaluated.' |
1525 |
); |
1525 |
); |
1526 |
}; |
1526 |
}; |
1527 |
- |
1527 |
|
|
|
1528 |
subtest 'Quote user params in GetPreparedLetter' => sub { |
1529 |
plan tests => 1; |
1530 |
|
1531 |
my $patron = $builder->build_object( { class => 'Koha::Patrons' } ); |
1532 |
my $biblio = $builder->build_sample_biblio; |
1533 |
my %loops = ( biblio => [ $biblio->biblionumber . ') AND (SELECT 1 FROM (SELECT(SLEEP(10)))x)-- -' ] ); |
1534 |
my %substitute = ( comment => 'some comment' ); |
1535 |
|
1536 |
Koha::Notice::Template->new( |
1537 |
{ |
1538 |
module => 'catalogue', |
1539 |
code => 'CART', |
1540 |
branchcode => '', |
1541 |
message_transport_type => 'email', |
1542 |
content => |
1543 |
'Hello [% borrower.firstname %], Some comments about those biblios [% FOR b IN biblios %][% biblio.title %][% END %]: [% comment %]', |
1544 |
} |
1545 |
)->store; |
1546 |
|
1547 |
my $t = time; |
1548 |
my $letter = C4::Letters::GetPreparedLetter( |
1549 |
module => 'catalogue', |
1550 |
letter_code => 'CART', |
1551 |
tables => { |
1552 |
borrowers => $patron->borrowernumber, |
1553 |
}, |
1554 |
message_transport_type => 'email', |
1555 |
loops => \%loops, |
1556 |
substitute => \%substitute, |
1557 |
); |
1558 |
my $exec_time = time - $t; |
1559 |
ok( $exec_time < 10, "We should not exec the SLEEP" ) |
1560 |
or diag sprintf( |
1561 |
"Spent %ss to run GetPreparredLetter, SLEEP has certainly been executed which could lead to SQL injections", |
1562 |
$exec_time |
1563 |
); |
1564 |
}; |