View | Details | Raw Unified | Return to bug 36520
Collapse All | Expand All

(-)a/t/db_dependent/Letters.t (-2 / +39 lines)
Lines 19-25 Link Here
19
19
20
use Modern::Perl;
20
use Modern::Perl;
21
use File::Basename qw(dirname);
21
use File::Basename qw(dirname);
22
use Test::More tests => 100;
22
use Test::More tests => 101;
23
use Test::MockModule;
23
use Test::MockModule;
24
use Test::Warn;
24
use Test::Warn;
25
use Test::Exception;
25
use Test::Exception;
Lines 1524-1526 subtest 'Template toolkit syntax in parameters' => sub { Link Here
1524
        'Template toolkit syntax in parameter was not evaluated.'
1524
        'Template toolkit syntax in parameter was not evaluated.'
1525
    );
1525
    );
1526
};
1526
};
1527
- 
1527
1528
subtest 'Quote user params in GetPreparedLetter' => sub {
1529
    plan tests => 1;
1530
1531
    my $patron     = $builder->build_object( { class => 'Koha::Patrons' } );
1532
    my $biblio     = $builder->build_sample_biblio;
1533
    my %loops      = ( biblio  => [ $biblio->biblionumber . ') AND (SELECT 1 FROM (SELECT(SLEEP(10)))x)-- -' ] );
1534
    my %substitute = ( comment => 'some comment' );
1535
1536
    Koha::Notice::Template->new(
1537
        {
1538
            module                 => 'catalogue',
1539
            code                   => 'CART',
1540
            branchcode             => '',
1541
            message_transport_type => 'email',
1542
            content                =>
1543
                'Hello [% borrower.firstname %], Some comments about those biblios [% FOR b IN biblios %][% biblio.title %][% END %]: [% comment %]',
1544
        }
1545
    )->store;
1546
1547
    my $t      = time;
1548
    my $letter = C4::Letters::GetPreparedLetter(
1549
        module      => 'catalogue',
1550
        letter_code => 'CART',
1551
        tables      => {
1552
            borrowers => $patron->borrowernumber,
1553
        },
1554
        message_transport_type => 'email',
1555
        loops                  => \%loops,
1556
        substitute             => \%substitute,
1557
    );
1558
    my $exec_time = time - $t;
1559
    ok( $exec_time < 10, "We should not exec the SLEEP" )
1560
        or diag sprintf(
1561
        "Spent %ss to run GetPreparredLetter, SLEEP has certainly been executed which could lead to SQL injections",
1562
        $exec_time
1563
        );
1564
};

Return to bug 36520