Bugzilla – Attachment 176172 Details for
Bug 38829
[CVE-2025-22954] SQL Injection in lateissues-export.pl
Home
|
New
|
Browse
|
Search
|
[?]
|
Reports
|
Help
|
New Account
|
Log In
[x]
|
Forgot Password
Login:
[x]
[patch]
Bug 38829: Sanitize GetLateOrMissingIssues inputs
Bug-38829-Sanitize-GetLateOrMissingIssues-inputs.patch (text/plain), 856 bytes, created by
Magnus Enger
on 2025-01-07 10:30:35 UTC
(
hide
)
Description:
Bug 38829: Sanitize GetLateOrMissingIssues inputs
Filename:
MIME Type:
Creator:
Magnus Enger
Created:
2025-01-07 10:30:35 UTC
Size:
856 bytes
patch
obsolete
>From cd29ea8104b76285b61d39ac62ad6975831c4087 Mon Sep 17 00:00:00 2001 >From: Magnus Enger <magnus@libriotech.no> >Date: Tue, 7 Jan 2025 10:27:04 +0000 >Subject: [PATCH] Bug 38829: Sanitize GetLateOrMissingIssues inputs > >Signed-off-by: Magnus Enger <magnus@libriotech.no> >The new test fails without this patch, and passes >when it is applied. >--- > C4/Serials.pm | 2 ++ > 1 file changed, 2 insertions(+) > >diff --git a/C4/Serials.pm b/C4/Serials.pm >index 4421bf35b0..d5ecbfc214 100644 >--- a/C4/Serials.pm >+++ b/C4/Serials.pm >@@ -1874,6 +1874,8 @@ sub GetLateOrMissingIssues { > my ( $supplierid, $serialid, $order ) = @_; > > return unless ( $supplierid or $serialid ); >+ return if defined $supplierid && !looks_like_number($supplierid); >+ return if defined $serialid && !looks_like_number($serialid); > > my $dbh = C4::Context->dbh; > >-- >2.34.1
You cannot view the attachment while viewing its details because your browser does not support IFRAMEs.
View the attachment on a separate page
.
View Attachment As Diff
View Attachment As Raw
Actions:
View
|
Diff
|
Splinter Review
Attachments on
bug 38829
:
176149
|
176150
|
176171
|
176172
|
176312
|
176313
|
176426