View | Details | Raw Unified | Return to bug 37508
Collapse All | Expand All

(-)a/C4/Reports/Guided.pm (+6 lines)
Lines 615-620 sub execute_query { Link Here
615
    };
615
    };
616
    warn $@ if $@;
616
    warn $@ if $@;
617
617
618
    foreach my $column ( @{ $sth->{NAME_lc} } ) {
619
        if ( $column eq 'password' ) {
620
            return ( $sth, { passworderr => $column } );
621
        }
622
    }
623
618
    return ( $sth, { queryerr => $sth->errstr } ) if ($sth->err);
624
    return ( $sth, { queryerr => $sth->errstr } ) if ($sth->err);
619
    return ( $sth );
625
    return ( $sth );
620
}
626
}
(-)a/koha-tmpl/intranet-tmpl/prog/en/modules/reports/guided_reports_start.tt (+4 lines)
Lines 1426-1431 Link Here
1426
                                    [% error.queryerr | html %]<br />Please check the log for further details.
1426
                                    [% error.queryerr | html %]<br />Please check the log for further details.
1427
                                [% ELSIF ( error.cache_expiry ) %]
1427
                                [% ELSIF ( error.cache_expiry ) %]
1428
                                    Please select a cache expiry less than 30 days.
1428
                                    Please select a cache expiry less than 30 days.
1429
                                [% ELSIF ( error.passworderr ) %]
1430
                                    The column selection in this report includes a password field.<br>
1431
                                    The report cannot be executed due to security risks.<br>
1432
                                    Please edit this report and ensure no password columns have been selected.
1429
                                [% ELSE %]
1433
                                [% ELSE %]
1430
                                [% END %]
1434
                                [% END %]
1431
                                <div id="onerror_actions">
1435
                                <div id="onerror_actions">
(-)a/svc/report (-4 / +3 lines)
Lines 76-82 unless ($json_text) { Link Here
76
            report_id  => $report_id,
76
            report_id  => $report_id,
77
        }
77
        }
78
    );
78
    );
79
    if ($sth) {
79
    if ($errors) {
80
        $json_text = encode_json($errors);
81
    } else {
80
        my $lines;
82
        my $lines;
81
        if ($report_annotation) {
83
        if ($report_annotation) {
82
            $lines = $sth->fetchall_arrayref({});
84
            $lines = $sth->fetchall_arrayref({});
Lines 90-98 unless ($json_text) { Link Here
90
            $cache->set_in_cache( $cache_key, $json_text, { expiry => $report_rec->cache_expiry } );
92
            $cache->set_in_cache( $cache_key, $json_text, { expiry => $report_rec->cache_expiry } );
91
        }
93
        }
92
    }
94
    }
93
    else {
94
        $json_text = encode_json($errors);
95
    }
96
}
95
}
97
96
98
print $query->header(
97
print $query->header(
(-)a/t/db_dependent/Reports/Guided.t (-2 / +29 lines)
Lines 18-24 Link Here
18
18
19
use Modern::Perl;
19
use Modern::Perl;
20
20
21
use Test::More tests => 11;
21
use Test::More tests => 12;
22
use Test::Warn;
22
use Test::Warn;
23
23
24
use t::lib::TestBuilder;
24
use t::lib::TestBuilder;
Lines 499-504 subtest 'nb_rows() tests' => sub { Link Here
499
    $schema->storage->txn_rollback;
499
    $schema->storage->txn_rollback;
500
};
500
};
501
501
502
subtest 'Returning passwords tests' => sub {
503
504
    plan tests => 3;
505
506
    my $dbh = C4::Context->dbh;
507
    $schema->storage->txn_begin;
508
509
    my $query = q{ SELECT * FROM borrowers };
510
511
    my ( $sth, $errors ) = execute_query( { sql => $query } );
512
513
    is( defined($errors), 1, 'Query returns password field' );
514
515
    $query = q{ SELECT * FROM z3950servers };
516
517
    ( $sth, $errors ) = execute_query( { sql => $query } );
518
519
    is( defined($errors), 1, 'Query returns password field' );
520
521
    $query = q{ SELECT password FROM deletedborrowers };
522
523
    ( $sth, $errors ) = execute_query( { sql => $query } );
524
525
    is( defined($errors), 1, 'Query returns password field' );
526
527
    $schema->storage->txn_rollback;
528
};
529
502
sub trim {
530
sub trim {
503
    my ($s) = @_;
531
    my ($s) = @_;
504
    $s =~ s/^\s*(.*?)\s*$/$1/s;
532
    $s =~ s/^\s*(.*?)\s*$/$1/s;
505
- 

Return to bug 37508