View | Details | Raw Unified | Return to bug 37018
Collapse All | Expand All

(-)a/t/db_dependent/api/v1/query.t (-2 / +28 lines)
Lines 17-23 Link Here
17
17
18
use Modern::Perl;
18
use Modern::Perl;
19
19
20
use Test::More tests => 2;
20
use Test::More tests => 3;
21
use Test::Mojo;
21
use Test::Mojo;
22
22
23
use t::lib::TestBuilder;
23
use t::lib::TestBuilder;
Lines 148-150 subtest 'x-koha-embed tests' => sub { Link Here
148
148
149
    $schema->storage->txn_rollback;
149
    $schema->storage->txn_rollback;
150
};
150
};
151
- 
151
152
subtest 'SQL injection in "query" handling' => sub {
153
154
    plan tests => 2;
155
156
    $schema->storage->txn_begin;
157
158
    my $librarian = $builder->build_object(
159
        {
160
            class => 'Koha::Patrons',
161
            value => { flags => 1 }     # superlibrarian
162
        }
163
    );
164
    my $password = 'thePassword123';
165
    $librarian->set_password( { password => $password, skip_validation => 1 } );
166
    my $userid = $librarian->userid;
167
168
    my $patron_id = $builder->build_object( { class => 'Koha::Patrons' } )->id;
169
170
    my $q =
171
        "[{\"-and\":[[{\"me.patron_id\":{\"like(IF(ASCII(SUBSTRING((SELECT version()),1,1))=ASCII('1'),SLEEP(1/100000),0))or\":\"\%a\%\"}}]]}]";
172
173
    $t->get_ok("//$userid:$password@/api/v1/patrons?q=$q")
174
        ->status_is( 400, 'Attempt to inject SQL through operators is rejected' );
175
176
    $schema->storage->txn_rollback;
177
};

Return to bug 37018