Bugzilla – Attachment 182855 Details for
Bug 39866
Acquisitions statistics fails when filling only the To date
Home
|
New
|
Browse
|
Search
|
[?]
|
Reports
|
Help
|
New Account
|
Log In
[x]
|
Forgot Password
Login:
[x]
[patch]
Bug 39866: (QA follow-up) Rudimentary validation of line/column
Bug-39866-QA-follow-up-Rudimentary-validation-of-l.patch (text/plain), 1.45 KB, created by
Marcel de Rooy
on 2025-05-30 09:48:25 UTC
(
hide
)
Description:
Bug 39866: (QA follow-up) Rudimentary validation of line/column
Filename:
MIME Type:
Creator:
Marcel de Rooy
Created:
2025-05-30 09:48:25 UTC
Size:
1.45 KB
patch
obsolete
>From 855156636645b6181e34d36e2f58c06703d9e4f3 Mon Sep 17 00:00:00 2001 >From: Marcel de Rooy <m.de.rooy@rijksmuseum.nl> >Date: Fri, 30 May 2025 10:56:35 +0200 >Subject: [PATCH] Bug 39866: (QA follow-up) Rudimentary validation of > line/column >Content-Type: text/plain; charset=utf-8 > >Prevent SQL injection. > >Note: output_error in Output.pm needs further attention, but out >of scope here. (The error passed gets replaced by 404 here too.) > >Test plan: >Pass something else than table.field in Line or Column URL param. >(Manipulate URL.) >You should be redirected to 404 error instead of 500. > >Signed-off-by: Marcel de Rooy <m.de.rooy@rijksmuseum.nl> >--- > reports/acquisitions_stats.pl | 13 +++++++++++++ > 1 file changed, 13 insertions(+) > >diff --git a/reports/acquisitions_stats.pl b/reports/acquisitions_stats.pl >index 7619d442f3..0ef7761291 100755 >--- a/reports/acquisitions_stats.pl >+++ b/reports/acquisitions_stats.pl >@@ -60,6 +60,19 @@ my ( $template, $borrowernumber, $cookie ) = get_template_and_user( > } > ); > >+# Validate line and column >+if ( >+ $do_it >+ && ( !$line >+ || $line !~ /^(aqbasket|aqorders|aqbooksellers|items|biblioitems|aqbudgets)\.\w+$/ >+ || !$column >+ || $column !~ /^(aqbasket|aqorders|aqbooksellers|items|biblioitems|aqbudgets)\.\w+$/ ) >+ ) >+{ >+ C4::Output::output_error( $input, 'Possible SQL injection' ); >+ exit; >+} >+ > our $sep = C4::Context->csv_delimiter( scalar $input->param("sep") ); > > $template->param( >-- >2.39.5
You cannot view the attachment while viewing its details because your browser does not support IFRAMEs.
View the attachment on a separate page
.
View Attachment As Diff
View Attachment As Raw
Actions:
View
|
Diff
|
Splinter Review
Attachments on
bug 39866
:
182160
|
182227
|
182854
| 182855