Lines 85-92
sub dt_build_orderby {
Link Here
|
85 |
my $param = shift; |
85 |
my $param = shift; |
86 |
|
86 |
|
87 |
my $i = 0; |
87 |
my $i = 0; |
88 |
my $orderby; |
|
|
89 |
my @orderbys; |
88 |
my @orderbys; |
|
|
89 |
my $dbh = C4::Context->dbh; |
90 |
while(exists $param->{'iSortCol_'.$i}){ |
90 |
while(exists $param->{'iSortCol_'.$i}){ |
91 |
my $iSortCol = $param->{'iSortCol_'.$i}; |
91 |
my $iSortCol = $param->{'iSortCol_'.$i}; |
92 |
my $sSortDir = $param->{'sSortDir_'.$i}; |
92 |
my $sSortDir = $param->{'sSortDir_'.$i}; |
Lines 105-113
sub dt_build_orderby {
Link Here
|
105 |
return unless @orderbys; |
105 |
return unless @orderbys; |
106 |
|
106 |
|
107 |
# Must be "branches.branchname asc", "borrowers.firstname desc", etc. |
107 |
# Must be "branches.branchname asc", "borrowers.firstname desc", etc. |
108 |
@orderbys = grep { /^\w+\.\w+\s(asc|desc)$/ } @orderbys; |
108 |
@orderbys = grep { /^\w+\.\w+ (asc|desc)$/ } @orderbys; |
|
|
109 |
|
110 |
my @sanitized_orderbys; |
111 |
for my $orderby (@orderbys) { |
112 |
my ($identifier, $direction) = split / /, $orderby, 2; |
113 |
my ($table, $column) = split /\./, $identifier, 2; |
114 |
my $sanitized_identifier = $dbh->quote_identifier(undef, $table, $column); |
115 |
my $sanitized_direction = $direction eq 'asc' ? 'ASC' : 'DESC'; |
116 |
push @sanitized_orderbys, "$sanitized_identifier $sanitized_direction"; |
117 |
} |
109 |
|
118 |
|
110 |
$orderby = " ORDER BY " . join(',', @orderbys) . " " if @orderbys; |
119 |
my $orderby = " ORDER BY " . join(',', @sanitized_orderbys) . " " if @sanitized_orderbys; |
111 |
return $orderby; |
120 |
return $orderby; |
112 |
} |
121 |
} |
113 |
|
122 |
|