View | Details | Raw Unified | Return to bug 37508
Collapse All | Expand All

(-)a/C4/Reports/Guided.pm (+7 lines)
Lines 623-628 sub execute_query { Link Here
623
        ->info("Report finished: $report_id") if $report_id;
623
        ->info("Report finished: $report_id") if $report_id;
624
624
625
    return ( $sth, { queryerr => $sth->errstr } ) if ( $sth->err );
625
    return ( $sth, { queryerr => $sth->errstr } ) if ( $sth->err );
626
627
    foreach my $column ( @{ $sth->{NAME_lc} } ) {
628
        if ( $column eq 'password' ) {
629
            return ( $sth, { passworderr => $column } );
630
        }
631
    }
632
626
    return ($sth);
633
    return ($sth);
627
}
634
}
628
635
(-)a/koha-tmpl/intranet-tmpl/prog/en/modules/reports/guided_reports_start.tt (+4 lines)
Lines 1443-1448 Link Here
1443
                                    [% error.queryerr | html %]<br />Please check the log for further details.
1443
                                    [% error.queryerr | html %]<br />Please check the log for further details.
1444
                                [% ELSIF ( error.cache_expiry ) %]
1444
                                [% ELSIF ( error.cache_expiry ) %]
1445
                                    Please select a cache expiry less than 30 days.
1445
                                    Please select a cache expiry less than 30 days.
1446
                                [% ELSIF ( error.passworderr ) %]
1447
                                    The column selection in this report includes a password field.<br>
1448
                                    The report cannot be executed due to security risks.<br>
1449
                                    Please edit this report and ensure no password columns have been selected.
1446
                                [% ELSE %]
1450
                                [% ELSE %]
1447
                                [% END %]
1451
                                [% END %]
1448
                                <div id="onerror_actions">
1452
                                <div id="onerror_actions">
(-)a/svc/report (-4 / +3 lines)
Lines 74-80 unless ($json_text) { Link Here
74
            report_id  => $report_id,
74
            report_id  => $report_id,
75
        }
75
        }
76
    );
76
    );
77
    if ($sth) {
77
    if ($errors) {
78
        $json_text = encode_json($errors);
79
    } else {
78
        my $lines;
80
        my $lines;
79
        if ($report_annotation) {
81
        if ($report_annotation) {
80
            $lines = $sth->fetchall_arrayref({});
82
            $lines = $sth->fetchall_arrayref({});
Lines 88-96 unless ($json_text) { Link Here
88
            $cache->set_in_cache( $cache_key, $json_text, { expiry => $report_rec->cache_expiry } );
90
            $cache->set_in_cache( $cache_key, $json_text, { expiry => $report_rec->cache_expiry } );
89
        }
91
        }
90
    }
92
    }
91
    else {
92
        $json_text = encode_json($errors);
93
    }
94
}
93
}
95
94
96
print $query->header(
95
print $query->header(
(-)a/t/db_dependent/Reports/Guided.t (-2 / +29 lines)
Lines 18-24 Link Here
18
18
19
use Modern::Perl;
19
use Modern::Perl;
20
20
21
use Test::More tests => 11;
21
use Test::More tests => 12;
22
use Test::Warn;
22
use Test::Warn;
23
23
24
use t::lib::TestBuilder;
24
use t::lib::TestBuilder;
Lines 499-504 subtest 'nb_rows() tests' => sub { Link Here
499
    $schema->storage->txn_rollback;
499
    $schema->storage->txn_rollback;
500
};
500
};
501
501
502
subtest 'Returning passwords tests' => sub {
503
504
    plan tests => 3;
505
506
    my $dbh = C4::Context->dbh;
507
    $schema->storage->txn_begin;
508
509
    my $query = q{ SELECT * FROM borrowers };
510
511
    my ( $sth, $errors ) = execute_query( { sql => $query } );
512
513
    is( defined($errors), 1, 'Query returns password field' );
514
515
    $query = q{ SELECT * FROM z3950servers };
516
517
    ( $sth, $errors ) = execute_query( { sql => $query } );
518
519
    is( defined($errors), 1, 'Query returns password field' );
520
521
    $query = q{ SELECT password FROM deletedborrowers };
522
523
    ( $sth, $errors ) = execute_query( { sql => $query } );
524
525
    is( defined($errors), 1, 'Query returns password field' );
526
527
    $schema->storage->txn_rollback;
528
};
529
502
sub trim {
530
sub trim {
503
    my ($s) = @_;
531
    my ($s) = @_;
504
    $s =~ s/^\s*(.*?)\s*$/$1/s;
532
    $s =~ s/^\s*(.*?)\s*$/$1/s;
505
- 

Return to bug 37508