Bugzilla – Attachment 176312 Details for
Bug 38829
[CVE-2025-22954] SQL Injection in lateissues-export.pl
Home
|
New
|
Browse
|
Search
|
[?]
|
Reports
|
Help
|
New Account
|
Log In
[x]
|
Forgot Password
Login:
[x]
[patch]
Bug 38829: Add a test
Bug-38829-Add-a-test.patch (text/plain), 1.51 KB, created by
Marcel de Rooy
on 2025-01-10 09:06:41 UTC
(
hide
)
Description:
Bug 38829: Add a test
Filename:
MIME Type:
Creator:
Marcel de Rooy
Created:
2025-01-10 09:06:41 UTC
Size:
1.51 KB
patch
obsolete
>From 81a230ccdc435e460a4f1f823d9c3cbbc5f099c9 Mon Sep 17 00:00:00 2001 >From: Jonathan Druart <jonathan.druart@bugs.koha-community.org> >Date: Mon, 6 Jan 2025 14:26:00 +0100 >Subject: [PATCH] Bug 38829: Add a test >Content-Type: text/plain; charset=utf-8 > >Signed-off-by: Magnus Enger <magnus@libriotech.no> > >Signed-off-by: Marcel de Rooy <m.de.rooy@rijksmuseum.nl> >[EDIT] Added a shebang line. >--- > t/db_dependent/Serials/Claims.t | 13 ++++++++++++- > 1 file changed, 12 insertions(+), 1 deletion(-) > >diff --git a/t/db_dependent/Serials/Claims.t b/t/db_dependent/Serials/Claims.t >index afc3a18e66..d121dc8ffb 100755 >--- a/t/db_dependent/Serials/Claims.t >+++ b/t/db_dependent/Serials/Claims.t >@@ -1,5 +1,7 @@ >+#!/usr/bin/perl >+ > use Modern::Perl; >-use Test::More tests => 17; >+use Test::More tests => 18; > > use C4::Acquisition; > use C4::Budgets qw( AddBudgetPeriod AddBudget ); >@@ -162,3 +164,12 @@ is( $serial_claimed->{claims_count}, 1, 'The serial should have been claimed' ); > my $today = output_pref({ dt => dt_from_string, dateformat => 'iso', dateonly => 1 }); > # FIXME: This test should pass. The GetLateOrMissingIssues should not deal with date format! > #is( $serial_claimed->{claimdate}, $today, 'The serial should have been claimed today' ); >+ >+subtest 'prevent SQL injections' => sub { >+ plan tests => 1; >+ my $time1 = time; >+ my $hack = q|1 OR (SELECT 1 FROM (SELECT(SLEEP(10)))x)-- -|; >+ GetLateOrMissingIssues($hack); >+ my $time2 = time; >+ ok( $time2 < $time1 + 10, 'The sleep should not be executed' ); >+}; >-- >2.39.5
You cannot view the attachment while viewing its details because your browser does not support IFRAMEs.
View the attachment on a separate page
.
View Attachment As Diff
View Attachment As Raw
Actions:
View
|
Diff
|
Splinter Review
Attachments on
bug 38829
:
176149
|
176150
|
176171
|
176172
| 176312 |
176313
|
176426