Bugzilla – Attachment 13830 Details for
Bug 7678
Statistics wizard: patrons
Home
|
New
|
Browse
|
Search
|
[?]
|
Reports
|
Help
|
New Account
|
Log In
[x]
|
Forgot Password
Login:
[x]
[patch]
[SIGNED-OFF] Bug 7678: follow-up to pass QA
SIGNED-OFF-Bug-7678-follow-up-to-pass-QA.patch (text/plain), 3.13 KB, created by
Katrin Fischer
on 2012-12-02 23:04:52 UTC
(
hide
)
Description:
[SIGNED-OFF] Bug 7678: follow-up to pass QA
Filename:
MIME Type:
Creator:
Katrin Fischer
Created:
2012-12-02 23:04:52 UTC
Size:
3.13 KB
patch
obsolete
>From 39c48bcdc03774883b85f7a9529ef772dbc145b7 Mon Sep 17 00:00:00 2001 >From: Julian Maurice <julian.maurice@biblibre.com> >Date: Mon, 20 Aug 2012 08:57:42 +0200 >Subject: [PATCH] [SIGNED-OFF] Bug 7678: follow-up to pass QA > >Check input parameters to avoid SQL injection >Rewrite a for loop for readability > >Signed-off-by: Kyle M Hall <kyle@bywatersolutions.com> >Signed-off-by: Katrin Fischer <Katrin.Fischer.83@web.de> >All tests pass, perlcritic is unchanged. > >Test plan >- Verify ExtendedPatronAttributes hides/shows new patron attribute > search criteria >- Verify patron attribute show up correctly > - pull down list for attributes linked to authorized values > - input field for other attributes >- Verify search works correctly >--- > reports/borrowers_stats.pl | 34 +++++++++++++++++++++++++++------- > 1 file changed, 27 insertions(+), 7 deletions(-) > >diff --git a/reports/borrowers_stats.pl b/reports/borrowers_stats.pl >index f8f285b..40c3861 100755 >--- a/reports/borrowers_stats.pl >+++ b/reports/borrowers_stats.pl >@@ -30,6 +30,7 @@ use C4::Acquisition; > use C4::Output; > use C4::Reports; > use C4::Circulation; >+use C4::Members::AttributeTypes; > use C4::Dates qw/format_date format_date_in_iso/; > use Date::Calc qw( > Today >@@ -181,6 +182,25 @@ sub calculate { > # extract parameters > my $dbh = C4::Context->dbh; > >+ # check parameters >+ my @valid_names = qw(categorycode zipcode branchcode sex sort1 sort2); >+ my @attribute_types = C4::Members::AttributeTypes::GetAttributeTypes; >+ if ($line =~ /^patron_attr\.(.*)/) { >+ my $attribute_type = $1; >+ return unless (grep {$attribute_type eq $_->{code}} @attribute_types); >+ } else { >+ return unless (grep /^$line$/, @valid_names); >+ } >+ if ($column =~ /^patron_attr\.(.*)/) { >+ my $attribute_type = $1; >+ return unless (grep {$attribute_type eq $_->{code}} @attribute_types); >+ } else { >+ return unless (grep /^$column$/, @valid_names); >+ } >+ return if ($digits and $digits !~ /^\d+$/); >+ return if ($status and (grep /^$status$/, qw(debarred gonenoaddress lost)) == 0); >+ return if ($activity and (grep /^$activity$/, qw(active nonactive)) == 0); >+ > # Filters > my $linefilter; > given ($line) { >@@ -207,7 +227,7 @@ sub calculate { > } > > my @loopfilter; >- for (my $i = 0; $i <= scalar @$filters; $i++) { >+ foreach my $i (0 .. scalar @$filters) { > my %cell; > if ( @$filters[$i] ) { > if ($i == 3 or $i == 4) { >@@ -249,7 +269,7 @@ sub calculate { > my $linefield; > > my $line_attribute_type; >- if ($line =~/^patron_attr.(.*)$/) { >+ if ($line =~/^patron_attr\.(.*)$/) { > $line_attribute_type = $1; > $line = 'borrower_attributes.attribute'; > } >@@ -305,11 +325,11 @@ sub calculate { > $column = 'borrower_attributes.attribute'; > } > >- if (($column =~/zipcode/) and ($digits)) { >- $colfield = "left($column,$digits)"; >- } else { >- $colfield = $column; >- } >+ if (($column =~/zipcode/) and ($digits)) { >+ $colfield = "left($column,$digits)"; >+ } else { >+ $colfield = $column; >+ } > > my $strsth2; > my @strparams2; # bind parameters for the query >-- >1.7.9.5
You cannot view the attachment while viewing its details because your browser does not support IFRAMEs.
View the attachment on a separate page
.
View Attachment As Diff
View Attachment As Raw
Actions:
View
|
Diff
|
Splinter Review
Attachments on
bug 7678
:
11445
|
11597
|
11687
|
12742
|
12753
|
12941
|
12942
|
13829
| 13830 |
13975
|
14710
|
14728