Bugzilla – Attachment 170898 Details for
Bug 37784
Patron password hash can be fetched using report dictionary
Home
|
New
|
Browse
|
Search
|
[?]
|
Reports
|
Help
|
New Account
|
Log In
[x]
|
Forgot Password
Login:
[x]
[patch]
Bug 37784: Do not show forbidden columns in reports dictionary
Bug-37784-Do-not-show-forbidden-columns-in-reports.patch (text/plain), 1.78 KB, created by
Aleisha Amohia
on 2024-08-30 02:08:12 UTC
(
hide
)
Description:
Bug 37784: Do not show forbidden columns in reports dictionary
Filename:
MIME Type:
Creator:
Aleisha Amohia
Created:
2024-08-30 02:08:12 UTC
Size:
1.78 KB
patch
obsolete
>From 0c679b7477da70c46029ed21b0fb2ee762b913de Mon Sep 17 00:00:00 2001 >From: Aleisha Amohia <aleishaamohia@hotmail.com> >Date: Fri, 30 Aug 2024 02:04:48 +0000 >Subject: [PATCH] Bug 37784: Do not show forbidden columns in reports > dictionary > >This patch prevents forbidden columns from being selected using the reports dictionary. > >To test: > >1. Go to Reports -> View dictionary >2. Choose 'new dictionary' >3. After providing a name and description, select the 'patrons' table >4. Select the 'password' column and go Next >5. Notice it is possible to see a list of all the password hashes in the 'choose' selection box when asked to specify a value > >6. Apply patch and restart services > >7. Repeat steps 1-3 >8. Notice the 'password' column and other forbidden columns are not available to be selected > >Sponsored-by: Reserve Bank of New Zealand >--- > C4/Reports/Guided.pm | 11 +++++++---- > 1 file changed, 7 insertions(+), 4 deletions(-) > >diff --git a/C4/Reports/Guided.pm b/C4/Reports/Guided.pm >index 1f1dd80ca23..6f53982437a 100644 >--- a/C4/Reports/Guided.pm >+++ b/C4/Reports/Guided.pm >@@ -220,10 +220,13 @@ sub _get_columns { > $tablehash{'__first__'} = $first; > push @columns, \%tablehash; > while ( my $data = $sth->fetchrow_arrayref() ) { >- my %temphash; >- $temphash{'name'} = "$tablename.$data->[0]"; >- $temphash{'description'} = $columns->{$tablename}->{$data->[0]}; >- push @columns, \%temphash; >+ my $forbidden = Koha::Report->new->check_columns( undef, $data ); >+ unless ($forbidden) { >+ my %temphash; >+ $temphash{'name'} = "$tablename.$data->[0]"; >+ $temphash{'description'} = $columns->{$tablename}->{ $data->[0] }; >+ push @columns, \%temphash; >+ } > } > $sth->finish(); > return (@columns); >-- >2.39.2
You cannot view the attachment while viewing its details because your browser does not support IFRAMEs.
View the attachment on a separate page
.
View Attachment As Diff
View Attachment As Raw
Actions:
View
|
Diff
|
Splinter Review
Attachments on
bug 37784
:
170898
|
171041
|
174817
|
177824
|
179297
|
179312
|
179313
|
179314
|
179567
|
179568
|
179569