Bugzilla – Attachment 117079 Details for
Bug 27715
Possibly SQL injection in virtualshelves
Home
|
New
|
Browse
|
Search
|
[?]
|
Reports
|
Help
|
New Account
|
Log In
[x]
|
Forgot Password
Login:
[x]
[patch]
Bug 27715: Sanitize order by DT params
Bug-27715-Sanitize-order-by-DT-params.patch (text/plain), 1.32 KB, created by
Martin Renvoize (ashimema)
on 2021-02-19 12:52:36 UTC
(
hide
)
Description:
Bug 27715: Sanitize order by DT params
Filename:
MIME Type:
Creator:
Martin Renvoize (ashimema)
Created:
2021-02-19 12:52:36 UTC
Size:
1.32 KB
patch
obsolete
>From b40b2691097f723f010197dc91eea2d324d331a5 Mon Sep 17 00:00:00 2001 >From: Jonathan Druart <jonathan.druart@bugs.koha-community.org> >Date: Thu, 18 Feb 2021 15:49:40 +0100 >Subject: [PATCH] Bug 27715: Sanitize order by DT params >MIME-Version: 1.0 >Content-Type: text/plain; charset=UTF-8 >Content-Transfer-Encoding: 8bit > >We are not on the safe side when we build the ORDER BY clause from the >DataTables parameters. > >I've started to limit the columns by using Koha::Objects->columns, but >for instance for the patron search we need (at least) the columns from >the branches, categories and members tables. >It seems easier, and still safe, to use a regex. > >Signed-off-by: Martin Renvoize <martin.renvoize@ptfs-europe.com> >Signed-off-by: Joonas Kylmälä <joonas.kylmala@helsinki.fi> >--- > C4/Utils/DataTables.pm | 5 +++++ > 1 file changed, 5 insertions(+) > >diff --git a/C4/Utils/DataTables.pm b/C4/Utils/DataTables.pm >index 99be4a1cda..18e6c8caa8 100644 >--- a/C4/Utils/DataTables.pm >+++ b/C4/Utils/DataTables.pm >@@ -100,6 +100,11 @@ sub dt_build_orderby { > $i++; > } > >+ return unless @orderbys; >+ >+ # Must be "branches.branchname asc", "borrowers.firstname desc", etc. >+ @orderbys = grep { /^\w+\.\w+\s(asc|desc)$/ } @orderbys; >+ > $orderby = " ORDER BY " . join(',', @orderbys) . " " if @orderbys; > return $orderby; > } >-- >2.20.1
You cannot view the attachment while viewing its details because your browser does not support IFRAMEs.
View the attachment on a separate page
.
View Attachment As Diff
View Attachment As Raw
Actions:
View
|
Diff
|
Splinter Review
Attachments on
bug 27715
:
116992
|
116993
|
116994
|
116995
|
116998
|
117027
|
117028
|
117029
|
117030
|
117031
|
117032
|
117033
|
117034
|
117035
|
117036
|
117068
|
117069
|
117070
|
117071
|
117072
|
117073
|
117074
|
117076
|
117077
|
117078
|
117079
|
117080
|
117081
|
117082
|
117112
|
117113
|
117114
|
117115
|
117116
|
117117
|
117118