Bugzilla – Attachment 117028 Details for
Bug 27715
Possibly SQL injection in virtualshelves
Home
|
New
|
Browse
|
Search
|
[?]
|
Reports
|
Help
|
New Account
|
Log In
[x]
|
Forgot Password
Login:
[x]
[patch]
Bug 27715: Remove unused dt_build_having
Bug-27715-Remove-unused-dtbuildhaving.patch (text/plain), 4.40 KB, created by
Martin Renvoize (ashimema)
on 2021-02-19 08:33:28 UTC
(
hide
)
Description:
Bug 27715: Remove unused dt_build_having
Filename:
MIME Type:
Creator:
Martin Renvoize (ashimema)
Created:
2021-02-19 08:33:28 UTC
Size:
4.40 KB
patch
obsolete
>From 28facd3b7ed7b2b390c1dff159d1ef4b5e3accaf Mon Sep 17 00:00:00 2001 >From: Jonathan Druart <jonathan.druart@bugs.koha-community.org> >Date: Thu, 18 Feb 2021 14:49:02 +0100 >Subject: [PATCH] Bug 27715: Remove unused dt_build_having > >Signed-off-by: Martin Renvoize <martin.renvoize@ptfs-europe.com> >--- > C4/Utils/DataTables.pm | 80 +-------------------------- > C4/Utils/DataTables/VirtualShelves.pm | 2 + > 2 files changed, 3 insertions(+), 79 deletions(-) > >diff --git a/C4/Utils/DataTables.pm b/C4/Utils/DataTables.pm >index 4a7dafed4f..99be4a1cda 100644 >--- a/C4/Utils/DataTables.pm >+++ b/C4/Utils/DataTables.pm >@@ -25,7 +25,7 @@ use vars qw(@ISA @EXPORT); > BEGIN { > > @ISA = qw(Exporter); >- @EXPORT = qw(dt_build_orderby dt_build_having dt_get_params); >+ @EXPORT = qw(dt_build_orderby dt_get_params); > } > > =head1 NAME >@@ -46,8 +46,6 @@ C4::Utils::DataTables - Utility subs for building query when DataTables source i > FROM borrowers > WHERE borrowernumber = ? > }; >- my ($having, $having_params) = dt_build_having($vars); >- $query .= $having; > $query .= dt_build_orderby($vars); > $query .= " LIMIT ?,? "; > >@@ -106,82 +104,6 @@ sub dt_build_orderby { > return $orderby; > } > >-=head2 dt_build_having >- >- my ($having, $having_params) = dt_build_having($dt_params) >- >- This function takes a reference to a hash containing DataTables parameters >- and build the corresponding 'HAVING' clause. >- This hash must contains the following keys: >- sSearch is the text entered in the global filter >- iColumns is the number of columns >- bSearchable_N is a boolean value that is true if the column is searchable >- mDataProp_N is a mapping between the column index, and the name of a SQL field >- sSearch_N is the text entered in individual filter for column N >- >-=cut >- >-sub dt_build_having { >- my $param = shift; >- >- my @filters; >- my @params; >- >- # Global filter >- if($param->{'sSearch'}) { >- my $sSearch = $param->{'sSearch'}; >- my $i = 0; >- my @gFilters; >- my @gParams; >- while($i < $param->{'iColumns'}) { >- if($param->{'bSearchable_'.$i} eq 'true') { >- my $mDataProp = $param->{'mDataProp_'.$i}; >- my @filter_fields = $param->{$mDataProp.'_filteron'} >- ? split(' ', $param->{$mDataProp.'_filteron'}) >- : (); >- if(@filter_fields > 0) { >- foreach my $field (@filter_fields) { >- push @gFilters, " $field LIKE ? "; >- push @gParams, "%$sSearch%"; >- } >- } else { >- push @gFilters, " $mDataProp LIKE ? "; >- push @gParams, "%$sSearch%"; >- } >- } >- $i++; >- } >- push @filters, " (" . join(" OR ", @gFilters) . ") "; >- push @params, @gParams; >- } >- >- # Individual filters >- my $i = 0; >- while($i < $param->{'iColumns'}) { >- my $sSearch = $param->{'sSearch_'.$i}; >- if($sSearch) { >- my $mDataProp = $param->{'mDataProp_'.$i}; >- my @filter_fields = $param->{$mDataProp.'_filteron'} >- ? split(' ', $param->{$mDataProp.'_filteron'}) >- : (); >- if(@filter_fields > 0) { >- my @localfilters; >- foreach my $field (@filter_fields) { >- push @localfilters, " $field LIKE ? "; >- push @params, "%$sSearch%"; >- } >- push @filters, " ( ". join(" OR ", @localfilters) ." ) "; >- } else { >- push @filters, " $mDataProp LIKE ? "; >- push @params, "%$sSearch%"; >- } >- } >- $i++; >- } >- >- return (\@filters, \@params); >-} >- > =head2 dt_get_params > > my %dtparam = = dt_get_params( $input ) >diff --git a/C4/Utils/DataTables/VirtualShelves.pm b/C4/Utils/DataTables/VirtualShelves.pm >index 5a349326b1..f18270fd85 100644 >--- a/C4/Utils/DataTables/VirtualShelves.pm >+++ b/C4/Utils/DataTables/VirtualShelves.pm >@@ -107,6 +107,8 @@ sub search { > ($orderby ? $orderby : ""), > ($limit ? $limit : "") > ); >+ warn $query; >+ use Data::Printer colored => 1; warn p @args; > my $shelves = $dbh->selectall_arrayref( $query, { Slice => {} }, @args ); > > # Get the iTotalDisplayRecords DataTable variable >-- >2.20.1
You cannot view the attachment while viewing its details because your browser does not support IFRAMEs.
View the attachment on a separate page
.
View Attachment As Diff
View Attachment As Raw
Actions:
View
|
Diff
|
Splinter Review
Attachments on
bug 27715
:
116992
|
116993
|
116994
|
116995
|
116998
|
117027
|
117028
|
117029
|
117030
|
117031
|
117032
|
117033
|
117034
|
117035
|
117036
|
117068
|
117069
|
117070
|
117071
|
117072
|
117073
|
117074
|
117076
|
117077
|
117078
|
117079
|
117080
|
117081
|
117082
|
117112
|
117113
|
117114
|
117115
|
117116
|
117117
|
117118