From 85d390184a4ed3092a277e18d4847fd5fc49329e Mon Sep 17 00:00:00 2001
From: Jonathan Druart <jonathan.druart@biblibre.com>
Date: Tue, 10 Jul 2012 16:00:54 +0200
Subject: [PATCH 1/1] Bug 7955: Followup : Check the syspref value (avoid sql
injection)
---
C4/Members/Statistics.pm | 17 ++++++++++++++---
members/statistics.pl | 5 +++--
2 files changed, 17 insertions(+), 5 deletions(-)
diff --git a/C4/Members/Statistics.pm b/C4/Members/Statistics.pm
index 302259c..d40c414 100644
--- a/C4/Members/Statistics.pm
+++ b/C4/Members/Statistics.pm
@@ -40,6 +40,18 @@ BEGIN {
);
}
+
+our $fields = get_fields();
+
+sub get_fields {
+ my $r = C4::Context->preference('StatisticsFields') || 'location|itype|ccode';
+ unless ( $r =~ m/^(\w|\d|\||-)+$/) {
+ warn "Members/Statistics : Bad value for syspref StatisticsFields";
+ $r = 'location|itype|ccode';
+ }
+ return $r;
+}
+
=head2 construct_query
Build a sql query from a subquery
Adds statistics fields to the select and the group by clause
@@ -47,10 +59,9 @@ BEGIN {
sub construct_query {
my $count = shift;
my $subquery = shift;
- my $fields = C4::Context->preference('StatisticsFields') || 'location|itype|ccode';
my @select_fields = split '\|', $fields;
- my $query = "SELECT COUNT(*) as count_$count";
- $query .= ", " . C4::Context->dbh->quote( $_ ) for @select_fields;
+ my $query = "SELECT COUNT(*) as count_$count,";
+ $query .= join ',', @select_fields;
$query .= " " . $subquery;
diff --git a/members/statistics.pl b/members/statistics.pl
index 8551ec8..7125560 100755
--- a/members/statistics.pl
+++ b/members/statistics.pl
@@ -58,7 +58,7 @@ foreach my $key ( keys %$borrower ) {
}
# Construct column names
-my $fields = C4::Context->preference('StatisticsFields') || 'location|itype|ccode';
+my $fields = C4::Members::Statistics::get_fields();
our @statistic_column_names = split '\|', $fields;
our @value_column_names = ( 'count_precedent_state', 'count_total_issues_today', 'count_total_issues_returned_today' );
our @column_names = ( @statistic_column_names, @value_column_names );
@@ -70,6 +70,7 @@ my $total_issues_returned_today = GetTotalIssuesReturnedTodayByBorrower( $borrow
my $r = merge (
@$precedent_state, @$total_issues_today, @$total_issues_returned_today
);
+
add_actual_state( $r );
my ( $total, $datas ) = build_array( $r );
@@ -194,7 +195,7 @@ sub merge {
for my $ch ( @r ) {
$exists = 1;
for my $cn ( @statistic_column_names ) {
- if ( not $ch->{$cn} eq $h->{$cn} ) {
+ if ( $ch->{$cn} and not $ch->{$cn} eq $h->{$cn} ) {
$exists = 0;
last;
}
--
1.7.7.3