Bugzilla – Attachment 10746 Details for
Bug 7955
Statistics tab in patron module
Home
|
New
|
Browse
|
Search
|
[?]
|
Reports
|
Help
|
New Account
|
Log In
[x]
|
Forgot Password
Login:
[x]
[patch]
Bug 7955: Followup : Check the syspref value (avoid sql injection)
0001-Bug-7955-Followup-Check-the-syspref-value-avoid-sql-.patch (text/plain), 2.71 KB, created by
Jonathan Druart
on 2012-07-10 14:05:36 UTC
(
hide
)
Description:
Bug 7955: Followup : Check the syspref value (avoid sql injection)
Filename:
MIME Type:
Creator:
Jonathan Druart
Created:
2012-07-10 14:05:36 UTC
Size:
2.71 KB
patch
obsolete
>From 85d390184a4ed3092a277e18d4847fd5fc49329e Mon Sep 17 00:00:00 2001 >From: Jonathan Druart <jonathan.druart@biblibre.com> >Date: Tue, 10 Jul 2012 16:00:54 +0200 >Subject: [PATCH 1/1] Bug 7955: Followup : Check the syspref value (avoid sql > injection) > >--- > C4/Members/Statistics.pm | 17 ++++++++++++++--- > members/statistics.pl | 5 +++-- > 2 files changed, 17 insertions(+), 5 deletions(-) > >diff --git a/C4/Members/Statistics.pm b/C4/Members/Statistics.pm >index 302259c..d40c414 100644 >--- a/C4/Members/Statistics.pm >+++ b/C4/Members/Statistics.pm >@@ -40,6 +40,18 @@ BEGIN { > ); > } > >+ >+our $fields = get_fields(); >+ >+sub get_fields { >+ my $r = C4::Context->preference('StatisticsFields') || 'location|itype|ccode'; >+ unless ( $r =~ m/^(\w|\d|\||-)+$/) { >+ warn "Members/Statistics : Bad value for syspref StatisticsFields"; >+ $r = 'location|itype|ccode'; >+ } >+ return $r; >+} >+ > =head2 construct_query > Build a sql query from a subquery > Adds statistics fields to the select and the group by clause >@@ -47,10 +59,9 @@ BEGIN { > sub construct_query { > my $count = shift; > my $subquery = shift; >- my $fields = C4::Context->preference('StatisticsFields') || 'location|itype|ccode'; > my @select_fields = split '\|', $fields; >- my $query = "SELECT COUNT(*) as count_$count"; >- $query .= ", " . C4::Context->dbh->quote( $_ ) for @select_fields; >+ my $query = "SELECT COUNT(*) as count_$count,"; >+ $query .= join ',', @select_fields; > > $query .= " " . $subquery; > >diff --git a/members/statistics.pl b/members/statistics.pl >index 8551ec8..7125560 100755 >--- a/members/statistics.pl >+++ b/members/statistics.pl >@@ -58,7 +58,7 @@ foreach my $key ( keys %$borrower ) { > } > > # Construct column names >-my $fields = C4::Context->preference('StatisticsFields') || 'location|itype|ccode'; >+my $fields = C4::Members::Statistics::get_fields(); > our @statistic_column_names = split '\|', $fields; > our @value_column_names = ( 'count_precedent_state', 'count_total_issues_today', 'count_total_issues_returned_today' ); > our @column_names = ( @statistic_column_names, @value_column_names ); >@@ -70,6 +70,7 @@ my $total_issues_returned_today = GetTotalIssuesReturnedTodayByBorrower( $borrow > my $r = merge ( > @$precedent_state, @$total_issues_today, @$total_issues_returned_today > ); >+ > add_actual_state( $r ); > my ( $total, $datas ) = build_array( $r ); > >@@ -194,7 +195,7 @@ sub merge { > for my $ch ( @r ) { > $exists = 1; > for my $cn ( @statistic_column_names ) { >- if ( not $ch->{$cn} eq $h->{$cn} ) { >+ if ( $ch->{$cn} and not $ch->{$cn} eq $h->{$cn} ) { > $exists = 0; > last; > } >-- >1.7.7.3 >
You cannot view the attachment while viewing its details because your browser does not support IFRAMEs.
View the attachment on a separate page
.
View Attachment As Diff
View Attachment As Raw
Actions:
View
|
Diff
|
Splinter Review
Attachments on
bug 7955
:
9266
|
9763
|
9771
|
9776
|
10015
|
10223
|
10407
|
10409
|
10410
|
10518
|
10520
|
10746
|
10747
|
10826