View | Details | Raw Unified | Return to bug 37018
Collapse All | Expand All

(-)a/Koha/REST/Plugin/Exceptions.pm (+10 lines)
Lines 59-64 sub register { Link Here
59
            my $path   = $req->url->to_abs->path;
59
            my $path   = $req->url->to_abs->path;
60
            my $type = "";
60
            my $type = "";
61
61
62
            if ( blessed $exception && ref($exception) eq 'Koha::Exceptions::REST::Query::InvalidOperator' ) {
63
                return $c->render(
64
                    status => 500,
65
                    json   => {
66
                        error      => printf( "Invalid operator in query: %s", $exception->operator ),
67
                        error_code => 'invalid_query',
68
                    }
69
                );
70
            }
71
62
            if ( blessed $exception ) {
72
            if ( blessed $exception ) {
63
                $type = "(" . ref($exception) . ")";
73
                $type = "(" . ref($exception) . ")";
64
            }
74
            }
(-)a/t/db_dependent/api/v1/query.t (-2 / +1 lines)
Lines 171-177 subtest 'SQL injection in "query" handling' => sub { Link Here
171
        "[{\"-and\":[[{\"me.patron_id\":{\"like(IF(ASCII(SUBSTRING((SELECT version()),1,1))=ASCII('1'),SLEEP(1/100000),0))or\":\"\%a\%\"}}]]}]";
171
        "[{\"-and\":[[{\"me.patron_id\":{\"like(IF(ASCII(SUBSTRING((SELECT version()),1,1))=ASCII('1'),SLEEP(1/100000),0))or\":\"\%a\%\"}}]]}]";
172
172
173
    $t->get_ok("//$userid:$password@/api/v1/patrons?q=$q")
173
    $t->get_ok("//$userid:$password@/api/v1/patrons?q=$q")
174
        ->status_is( 400, 'Attempt to inject SQL through operators is rejected' );
174
        ->status_is( 500, 'Attempt to inject SQL through operators is rejected' );
175
175
176
    $schema->storage->txn_rollback;
176
    $schema->storage->txn_rollback;
177
};
177
};
178
- 

Return to bug 37018