Attachment 169929 Details for Bug 37210 – Bug 37210: Escape single quote in search string in overdue.pl

[patch] Bug 37210: Escape single quote in search string in overdue.pl

Bug-37210-Escape-single-quote-in-search-string-in-.patch (text/plain), 1.96 KB, created by Martin Renvoize (ashimema) on 2024-08-01 09:56:49 UTC

(hide)

Description:

Filename:

MIME Type:

Creator: Martin Renvoize (ashimema)

Created: 2024-08-01 09:56:49 UTC

Size: 1.96 KB

patch

obsolete

>From b53388bd69d2d0dfe0f381ba0edcf827263ed6dd Mon Sep 17 00:00:00 2001
>From: Hammat Wele <hammat.wele@inlibro.com>
>Date: Thu, 27 Jun 2024 14:09:04 +0000
>Subject: [PATCH] Bug 37210: Escape single quote in search string in overdue.pl
>MIME-Version: 1.0
>Content-Type: text/plain; charset=UTF-8
>Content-Transfer-Encoding: 8bit
>
>To Test:
>1. Go to /cgi-bin/koha/circ/overdue.pl
>2. In the Â«Name or card numberÂ» field, type Â«Tommy'and(select(0)from(select(sleep(10)))v)and'Â»
>3. Apply the filter
>   ==> It takes 10 seconds, sleep(10) is executed
>4. Inspect the page, in Â«Patron category:Â» field, put Â«Tommy'and(select(0)from(select(sleep(10)))v)and'Â» in one of his option's value
>5. select the option from the filter and Apply the filter
>   ==> It takes 10 seconds, sleep(10) is executed
>we can inject SQL to the followin field : borname, itemtype, borcat, holdingbranch, homebranch and branch
>6. Apply the patch
>7. Repeat step 1,2,3
>   ==> it doesn't take 10 seconds, the injected sql is not executed
>8. Repeat step 5
>==> it doesn't take 10 seconds, the injected sql is not executed
>9. Repeat step 5 with the followin field : itemtype, holdingbranch, homebranch and branch
>   ==> it doesn't take 10 seconds, the injected sql is not executed
>
>Signed-off-by: Chris Cormack <chris@bigballofwax.co.nz>
>
>Signed-off-by: Marcel de Rooy <m.de.rooy@rijksmuseum.nl>
>---
> circ/overdue.pl | 8 ++++++++
> 1 file changed, 8 insertions(+)
>
>diff --git a/circ/overdue.pl b/circ/overdue.pl
>index 7c9e02eae40..38740fba22d 100755
>--- a/circ/overdue.pl
>+++ b/circ/overdue.pl
>@@ -231,6 +231,14 @@ if ($noreport) {
>     $bornamefilter =~ s/\*/\%/g;
>     $bornamefilter =~ s/\?/\_/g;
> 
>+    # Escape single quote
>+    $bornamefilter =~s/'/\\'/g;
>+    $itemtypefilter =~s/'/\\'/g;
>+    $borcatfilter =~s/'/\\'/g;
>+    $holdingbranchfilter =~s/'/\\'/g;
>+    $homebranchfilter =~s/'/\\'/g;
>+    $branchfilter =~s/'/\\'/g;
>+
>     my $strsth = "SELECT date_due,
>         borrowers.title as borrowertitle,
>         borrowers.surname,
>-- 
>2.45.2

Actions: View | Diff | Splinter Review

Attachments on bug 37210: 168197 | 168300 | 168372 | 168487 | 169182 | 169183 | 169929 | 169930