Attachment 4759 Details for Bug 5131 – Bug 5131 :restrict use of sort_by value to allowed values

[patch] Bug 5131 :restrict use of sort_by value to allowed values

Bug-5131-restrict-use-of-sortby-value-to-allowed-v.patch (text/plain), 1.49 KB, created by Chris Cormack on 2011-07-27 21:16:41 UTC

(hide)

Description:

Filename:

MIME Type:

Creator: Chris Cormack

Created: 2011-07-27 21:16:41 UTC

Size: 1.49 KB

patch

obsolete

>From e2c44f990f4f0ef814b5df73febc524048b0870f Mon Sep 17 00:00:00 2001
>From: =?UTF-8?q?Fr=C3=A8re=20S=C3=A9bastien=20Marie?= <semarie-koha@latrappe.fr>
>Date: Wed, 27 Jul 2011 11:48:29 +0200
>Subject: [PATCH] Bug 5131 :restrict use of sort_by value to allowed values
>
>The user input for sort_by value was used without care, resulting the possibility for user to set any Template Variable to 1.
>
>This patch restrict the values to sort field.
>The list of allowd_sortby was taken from 'includes/resort_form.inc'.
>
>Signed-off-by: Chris Cormack <chrisc@catalyst.net.nz>
>---
> opac/opac-search.pl |    5 ++++-
> 1 files changed, 4 insertions(+), 1 deletions(-)
>
>diff --git a/opac/opac-search.pl b/opac/opac-search.pl
>index cd34610..81b7ce6 100755
>--- a/opac/opac-search.pl
>+++ b/opac/opac-search.pl
>@@ -285,10 +285,13 @@ if (   C4::Context->preference('OPACdefaultSortField')
>       . C4::Context->preference('OPACdefaultSortOrder');
> }
> 
>+my @allowed_sortby = qw /acqdate_asc acqdate_dsc author_az author_za call_number_asc call_number_dsc popularity_asc popularity_dsc pubdate_asc pubdate_dsc relevance title_az title_za/; 
> @sort_by = split("\0",$params->{'sort_by'}) if $params->{'sort_by'};
> $sort_by[0] = $default_sort_by if !$sort_by[0] && defined($default_sort_by);
> foreach my $sort (@sort_by) {
>-    $template->param($sort => 1);   # FIXME: security hole.  can set any TMPL_VAR here
>+    if ( $sort ~~ @allowed_sortby ) {
>+        $template->param($sort => 1);
>+    }
> }
> $template->param('sort_by' => $sort_by[0]);
> 
>-- 
>1.7.4.1

Actions: View | Diff | Splinter Review

Attachments on bug 5131: 4753 | 4759 | 4821