Bugzilla – Attachment 17402 Details for
Bug 10033
dangerous query in _koha_modify_item
Home
|
New
|
Browse
|
Search
|
[?]
|
Reports
|
Help
|
New Account
|
Log In
[x]
|
Forgot Password
Login:
[x]
[patch]
Proposed patch
0001-Bug-10033-dangerous-query-in-_koha_modify_item.patch (text/plain), 1.14 KB, created by
Fridolin Somers
on 2013-04-12 16:00:49 UTC
(
hide
)
Description:
Proposed patch
Filename:
MIME Type:
Creator:
Fridolin Somers
Created:
2013-04-12 16:00:49 UTC
Size:
1.14 KB
patch
obsolete
>From 0101ef8f65d04afef415528dd8b0601d348f6cae Mon Sep 17 00:00:00 2001 >From: Fridolyn SOMERS <fridolyn.somers@biblibre.com> >Date: Fri, 12 Apr 2013 17:24:17 +0200 >Subject: [PATCH] Bug 10033 - dangerous query in _koha_modify_item > >The SQL query build in C4::Items::_koha_modify_item performs an update on a row of items table identified by itemnumber. >Actually the query is build using a hash of datas : > for my $key ( keys %$item ) { > $query.="$key=?,"; > push @bind, $item->{$key}; > } >But this hash contains 'itemnumber' key, so you get an update including the primary key. >It is actually harmless but may be dangerous. > >This patch simply skips itemnumber key in above loop. > >Test plan : >Check you can create and modify items. >--- > C4/Items.pm | 1 + > 1 file changed, 1 insertion(+) > >diff --git a/C4/Items.pm b/C4/Items.pm >index e173dc2..aa76c65 100644 >--- a/C4/Items.pm >+++ b/C4/Items.pm >@@ -2254,6 +2254,7 @@ sub _koha_modify_item { > my $query = "UPDATE items SET "; > my @bind; > for my $key ( keys %$item ) { >+ next if ( $key eq 'itemnumber' ); > $query.="$key=?,"; > push @bind, $item->{$key}; > } >-- >1.7.10.4 >
You cannot view the attachment while viewing its details because your browser does not support IFRAMEs.
View the attachment on a separate page
.
View Attachment As Diff
View Attachment As Raw
Actions:
View
|
Diff
|
Splinter Review
Attachments on
bug 10033
:
17401
|
17402
|
17541
|
17794