Bugzilla – Attachment 167032 Details for
Bug 36875
SQL injection in additional content pages
Home
|
New
|
Browse
|
Search
|
[?]
|
Reports
|
Help
|
New Account
|
Log In
[x]
|
Forgot Password
Login:
[x]
[patch]
Bug 36875: (follow-up) Modify query in translated_content
Bug-36875-follow-up-Modify-query-in-translatedcont.patch (text/plain), 1.51 KB, created by
Martin Renvoize (ashimema)
on 2024-05-22 12:54:47 UTC
(
hide
)
Description:
Bug 36875: (follow-up) Modify query in translated_content
Filename:
MIME Type:
Creator:
Martin Renvoize (ashimema)
Created:
2024-05-22 12:54:47 UTC
Size:
1.51 KB
patch
obsolete
>From d13373daa65dccf0cc147c5e0da76f5a82ff6e6e Mon Sep 17 00:00:00 2001 >From: Marcel de Rooy <m.de.rooy@rijksmuseum.nl> >Date: Thu, 16 May 2024 09:25:34 +0000 >Subject: [PATCH] Bug 36875: (follow-up) Modify query in translated_content > >This removes the MySQLism for FIELD(..). >In this case we just want to get the non-default records in >the front. So we can just test lang=default. And prevent inserting >$lang in the expression. And so prevent execution in ORDER BY. >No longer needing the ->quote call too. > >Test plan: >Run Koha/AdditionalContents.t again. > >Signed-off-by: Marcel de Rooy <m.de.rooy@rijksmuseum.nl> >Signed-off-by: Victor Grousset/tuxayo <victor@tuxayo.net> >Signed-off-by: Martin Renvoize <martin.renvoize@ptfs-europe.com> >--- > Koha/AdditionalContent.pm | 5 +++-- > 1 file changed, 3 insertions(+), 2 deletions(-) > >diff --git a/Koha/AdditionalContent.pm b/Koha/AdditionalContent.pm >index 3aca46ad875..3b2807a8496 100644 >--- a/Koha/AdditionalContent.pm >+++ b/Koha/AdditionalContent.pm >@@ -134,9 +134,10 @@ Return the translated content for a given language. The default is returned if n > > sub translated_content { > my ( $self, $lang ) = @_; >+ $lang ||= 'default'; > my $content = $self->translated_contents->search( >- { lang => [ 'default', ( $lang ? $lang : () ) ] }, >- { ( $lang ? ( order_by => \[ "field(lang, '" . $lang . "', 'default')" ] ) : () ) } >+ { lang => [ 'default', $lang ] }, >+ { order_by => { -asc => [ \'lang="default"', 'id' ] } } > )->next; > return $content; > } >-- >2.45.1
You cannot view the attachment while viewing its details because your browser does not support IFRAMEs.
View the attachment on a separate page
.
View Attachment As Diff
View Attachment As Raw
Actions:
View
|
Diff
|
Splinter Review
Attachments on
bug 36875
:
166804
|
166805
|
166806
|
166832
|
166833
|
166872
|
166873
|
166874
|
166875
|
166918
|
166919
|
166920
|
166921
|
167029
|
167030
|
167031
| 167032