Attachment 168300 Details for Bug 37210 – Bug 37210: Escape single quote in search string in overdue.pl

[patch] Bug 37210: Escape single quote in search string in overdue.pl

Bug-37210-Escape-single-quote-in-search-string-in-.patch (text/plain), 1.87 KB, created by Chris Cormack on 2024-06-29 23:09:07 UTC

(hide)

Description:

Filename:

MIME Type:

Creator: Chris Cormack

Created: 2024-06-29 23:09:07 UTC

Size: 1.87 KB

patch

obsolete

>From 0fe4a0c2f4f99a28db95597b79035f06c116c91c Mon Sep 17 00:00:00 2001
>From: Hammat Wele <hammat.wele@inlibro.com>
>Date: Thu, 27 Jun 2024 14:09:04 +0000
>Subject: [PATCH] Bug 37210: Escape single quote in search string in overdue.pl
>MIME-Version: 1.0
>Content-Type: text/plain; charset=UTF-8
>Content-Transfer-Encoding: 8bit
>
>To Test:
>1. Go to /cgi-bin/koha/circ/overdue.pl
>2. In the Â«Name or card numberÂ» field, type Â«Tommy'and(select(0)from(select(sleep(10)))v)and'Â»
>3. Apply the filter
>   ==> It takes 10 seconds, sleep(10) is executed
>4. Inspect the page, in Â«Patron category:Â» field, put Â«Tommy'and(select(0)from(select(sleep(10)))v)and'Â» in one of his option's value
>5. select the option from the filter and Apply the filter
>   ==> It takes 10 seconds, sleep(10) is executed
>we can inject SQL to the followin field : borname, itemtype, borcat, holdingbranch, homebranch and branch
>6. Apply the patch
>7. Repeat step 1,2,3
>   ==> it doesn't take 10 seconds, the injected sql is not executed
>8. Repeat step 5
>==> it doesn't take 10 seconds, the injected sql is not executed
>9. Repeat step 5 with the followin field : itemtype, holdingbranch, homebranch and branch
>   ==> it doesn't take 10 seconds, the injected sql is not executed
>
>Signed-off-by: Chris Cormack <chris@bigballofwax.co.nz>
>---
> circ/overdue.pl | 7 +++++++
> 1 file changed, 7 insertions(+)
>
>diff --git a/circ/overdue.pl b/circ/overdue.pl
>index bc8a28d39f2..e50bc15766f 100755
>--- a/circ/overdue.pl
>+++ b/circ/overdue.pl
>@@ -223,6 +223,13 @@ if ($noreport) {
> 
>     $bornamefilter =~s/\*/\%/g;
>     $bornamefilter =~s/\?/\_/g;
>+    #scape single quote
>+    $bornamefilter =~s/'/\\'/g;
>+    $itemtypefilter =~s/'/\\'/g;
>+    $borcatfilter =~s/'/\\'/g;
>+    $holdingbranchfilter =~s/'/\\'/g;
>+    $homebranchfilter =~s/'/\\'/g;
>+    $branchfilter =~s/'/\\'/g;
> 
>     my $strsth="SELECT date_due,
>         borrowers.title as borrowertitle,
>-- 
>2.39.2

Actions: View | Diff | Splinter Review

Attachments on bug 37210: 168197 | 168300 | 168372 | 168487 | 169182 | 169183 | 169929 | 169930