Bugzilla – Attachment 176171 Details for
Bug 38829
[CVE-2025-22954] SQL Injection in lateissues-export.pl
Home
|
New
|
Browse
|
Search
|
[?]
|
Reports
|
Help
|
New Account
|
Log In
[x]
|
Forgot Password
Login:
[x]
[patch]
Bug 38829: Add a test
Bug-38829-Add-a-test.patch (text/plain), 1.37 KB, created by
Magnus Enger
on 2025-01-07 10:30:31 UTC
(
hide
)
Description:
Bug 38829: Add a test
Filename:
MIME Type:
Creator:
Magnus Enger
Created:
2025-01-07 10:30:31 UTC
Size:
1.37 KB
patch
obsolete
>From 0bcccd3b067933d59e889d97732ce302d147b1b7 Mon Sep 17 00:00:00 2001 >From: Jonathan Druart <jonathan.druart@bugs.koha-community.org> >Date: Mon, 6 Jan 2025 14:26:00 +0100 >Subject: [PATCH] Bug 38829: Add a test > >Signed-off-by: Magnus Enger <magnus@libriotech.no> >--- > t/db_dependent/Serials/Claims.t | 11 ++++++++++- > 1 file changed, 10 insertions(+), 1 deletion(-) > >diff --git a/t/db_dependent/Serials/Claims.t b/t/db_dependent/Serials/Claims.t >index afc3a18e66..34c4fba1ff 100755 >--- a/t/db_dependent/Serials/Claims.t >+++ b/t/db_dependent/Serials/Claims.t >@@ -1,5 +1,5 @@ > use Modern::Perl; >-use Test::More tests => 17; >+use Test::More tests => 18; > > use C4::Acquisition; > use C4::Budgets qw( AddBudgetPeriod AddBudget ); >@@ -162,3 +162,12 @@ is( $serial_claimed->{claims_count}, 1, 'The serial should have been claimed' ); > my $today = output_pref({ dt => dt_from_string, dateformat => 'iso', dateonly => 1 }); > # FIXME: This test should pass. The GetLateOrMissingIssues should not deal with date format! > #is( $serial_claimed->{claimdate}, $today, 'The serial should have been claimed today' ); >+ >+subtest 'prevent SQL injections' => sub { >+ plan tests => 1; >+ my $time1 = time; >+ my $hack = q|1 OR (SELECT 1 FROM (SELECT(SLEEP(10)))x)-- -|; >+ GetLateOrMissingIssues($hack); >+ my $time2 = time; >+ ok( $time2 < $time1 + 10, 'The sleep should not be executed' ); >+}; >-- >2.34.1
You cannot view the attachment while viewing its details because your browser does not support IFRAMEs.
View the attachment on a separate page
.
View Attachment As Diff
View Attachment As Raw
Actions:
View
|
Diff
|
Splinter Review
Attachments on
bug 38829
:
176149
|
176150
|
176171
|
176172
|
176312
|
176313
|
176426