From 072b8d35b586c29199c6d19527aac0e4c287a276 Mon Sep 17 00:00:00 2001 From: Jonathan Druart Date: Thu, 18 Feb 2021 15:49:40 +0100 Subject: [PATCH] Bug 27715: Sanitize order by DT params We are not on the safe side when we build the ORDER BY clause from the DataTables parameters. I've started to limit the columns by using Koha::Objects->columns, but for instance for the patron search we need (at least) the columns from the branches, categories and members tables. It seems easier, and still safe, to use a regex. Signed-off-by: Martin Renvoize --- C4/Utils/DataTables.pm | 5 +++++ 1 file changed, 5 insertions(+) diff --git a/C4/Utils/DataTables.pm b/C4/Utils/DataTables.pm index 99be4a1cda..18e6c8caa8 100644 --- a/C4/Utils/DataTables.pm +++ b/C4/Utils/DataTables.pm @@ -100,6 +100,11 @@ sub dt_build_orderby { $i++; } + return unless @orderbys; + + # Must be "branches.branchname asc", "borrowers.firstname desc", etc. + @orderbys = grep { /^\w+\.\w+\s(asc|desc)$/ } @orderbys; + $orderby = " ORDER BY " . join(',', @orderbys) . " " if @orderbys; return $orderby; } -- 2.20.1