From a12d82d447e0d79861dee966f8ecc643e619fd35 Mon Sep 17 00:00:00 2001 From: Jonathan Druart Date: Thu, 18 Feb 2021 15:49:40 +0100 Subject: [PATCH] Bug 27715: Sanitize order by DT params We are not on the safe side when we build the ORDER BY clause from the DataTables parameters. I've started to limit the columns by using Koha::Objects->columns, but for instance for the patron search we need (at least) the columns from the branches, categories and members tables. It seems easier, and still safe, to use a regex. --- C4/Utils/DataTables.pm | 5 +++++ 1 file changed, 5 insertions(+) diff --git a/C4/Utils/DataTables.pm b/C4/Utils/DataTables.pm index 99be4a1cda..18e6c8caa8 100644 --- a/C4/Utils/DataTables.pm +++ b/C4/Utils/DataTables.pm @@ -100,6 +100,11 @@ sub dt_build_orderby { $i++; } + return unless @orderbys; + + # Must be "branches.branchname asc", "borrowers.firstname desc", etc. + @orderbys = grep { /^\w+\.\w+\s(asc|desc)$/ } @orderbys; + $orderby = " ORDER BY " . join(',', @orderbys) . " " if @orderbys; return $orderby; } -- 2.20.1