Bugzilla – Attachment 117027 Details for
Bug 27715
Possibly SQL injection in virtualshelves
Home
|
New
|
Browse
|
Search
|
[?]
|
Reports
|
Help
|
New Account
|
Log In
[x]
|
Forgot Password
Login:
[x]
[patch]
Bug 27715: Remove unused build_dt_query
Bug-27715-Remove-unused-builddtquery.patch (text/plain), 2.90 KB, created by
Martin Renvoize (ashimema)
on 2021-02-19 08:33:25 UTC
(
hide
)
Description:
Bug 27715: Remove unused build_dt_query
Filename:
MIME Type:
Creator:
Martin Renvoize (ashimema)
Created:
2021-02-19 08:33:25 UTC
Size:
2.90 KB
patch
obsolete
>From 7e0455dd55e996d7f39deb2a7e26ffdda903d166 Mon Sep 17 00:00:00 2001 >From: Jonathan Druart <jonathan.druart@bugs.koha-community.org> >Date: Thu, 18 Feb 2021 14:47:03 +0100 >Subject: [PATCH] Bug 27715: Remove unused build_dt_query > >Signed-off-by: Martin Renvoize <martin.renvoize@ptfs-europe.com> >--- > C4/Utils/DataTables.pm | 73 +----------------------------------------- > 1 file changed, 1 insertion(+), 72 deletions(-) > >diff --git a/C4/Utils/DataTables.pm b/C4/Utils/DataTables.pm >index e6fc1ccbcf..4a7dafed4f 100644 >--- a/C4/Utils/DataTables.pm >+++ b/C4/Utils/DataTables.pm >@@ -25,7 +25,7 @@ use vars qw(@ISA @EXPORT); > BEGIN { > > @ISA = qw(Exporter); >- @EXPORT = qw(dt_build_orderby dt_build_having dt_get_params dt_build_query); >+ @EXPORT = qw(dt_build_orderby dt_build_having dt_get_params); > } > > =head1 NAME >@@ -209,75 +209,4 @@ sub dt_get_params { > return %dtparam; > } > >-=head2 dt_build_query_simple >- >- my ( $query, $params )= dt_build_query_simple( $value, $field ) >- >- This function takes a value and a field (table.field). >- >- It returns (undef, []) if not $value. >- Else, returns a SQL where string and an arrayref containing parameters >- for the execute method of the statement. >- >-=cut >-sub dt_build_query_simple { >- my ( $value, $field ) = @_; >- my $query; >- my @params; >- if( $value ) { >- $query .= " AND $field = ? "; >- push @params, $value; >- } >- return ( $query, \@params ); >-} >- >-=head2 dt_build_query_dates >- >- my ( $query, $params )= dt_build_query_dates( $datefrom, $dateto, $field) >- >- This function takes a datefrom, dateto and a field (table.field). >- >- It returns (undef, []) if not $value. >- Else, returns a SQL where string and an arrayref containing parameters >- for the execute method of the statement. >- >-=cut >-sub dt_build_query_dates { >- my ( $datefrom, $dateto, $field ) = @_; >- my $query; >- my @params; >- if ( $datefrom ) { >- $query .= " AND $field >= ? "; >- push @params, eval { output_pref( { dt => dt_from_string( $datefrom ), dateonly => 1, dateformat => 'iso' } ); }; >- } >- if ( $dateto ) { >- $query .= " AND $field <= ? "; >- push @params, eval { output_pref( { dt => dt_from_string( $dateto ), dateonly => 1, dateformat => 'iso' } ); }; >- } >- return ( $query, \@params ); >-} >- >-=head2 dt_build_query >- >- my ( $query, $filter ) = dt_build_query( $type, @params ) >- >- This function takes a value and a list of parameters. >- >- It calls dt_build_query_dates or dt_build_query_simple function of $type. >- >- $type can contain 'simple' or 'range_dates'. >- if $type is not matched it returns undef >- >-=cut >-sub dt_build_query { >- my ( $type, @params ) = @_; >- if ( $type =~ m/simple/ ) { >- return dt_build_query_simple(@params); >- } >- elsif ( $type =~ m/range_dates/ ) { >- return dt_build_query_dates(@params); >- } >- return; >-} >- > 1; >-- >2.20.1
You cannot view the attachment while viewing its details because your browser does not support IFRAMEs.
View the attachment on a separate page
.
View Attachment As Diff
View Attachment As Raw
Actions:
View
|
Diff
|
Splinter Review
Attachments on
bug 27715
:
116992
|
116993
|
116994
|
116995
|
116998
|
117027
|
117028
|
117029
|
117030
|
117031
|
117032
|
117033
|
117034
|
117035
|
117036
|
117068
|
117069
|
117070
|
117071
|
117072
|
117073
|
117074
|
117076
|
117077
|
117078
|
117079
|
117080
|
117081
|
117082
|
117112
|
117113
|
117114
|
117115
|
117116
|
117117
|
117118