View | Details | Raw Unified | Return to bug 27715
Collapse All | Expand All

(-)a/C4/Utils/DataTables.pm (-3 / +12 lines)
Lines 85-92 sub dt_build_orderby { Link Here
85
    my $param = shift;
85
    my $param = shift;
86
86
87
    my $i = 0;
87
    my $i = 0;
88
    my $orderby;
89
    my @orderbys;
88
    my @orderbys;
89
    my $dbh = C4::Context->dbh;
90
    while(exists $param->{'iSortCol_'.$i}){
90
    while(exists $param->{'iSortCol_'.$i}){
91
        my $iSortCol = $param->{'iSortCol_'.$i};
91
        my $iSortCol = $param->{'iSortCol_'.$i};
92
        my $sSortDir = $param->{'sSortDir_'.$i};
92
        my $sSortDir = $param->{'sSortDir_'.$i};
Lines 105-113 sub dt_build_orderby { Link Here
105
    return unless @orderbys;
105
    return unless @orderbys;
106
106
107
    # Must be "branches.branchname asc", "borrowers.firstname desc", etc.
107
    # Must be "branches.branchname asc", "borrowers.firstname desc", etc.
108
    @orderbys = grep { /^\w+\.\w+\s(asc|desc)$/ } @orderbys;
108
    @orderbys = grep { /^\w+\.\w+ (asc|desc)$/ } @orderbys;
109
110
    my @sanitized_orderbys;
111
    for my $orderby (@orderbys) {
112
      my ($identifier, $direction) = split / /, $orderby, 2;
113
      my ($table, $column) = split /\./, $identifier, 2;
114
      my $sanitized_identifier = $dbh->quote_identifier(undef, $table, $column);
115
      my $sanitized_direction = $direction eq 'asc' ? 'ASC' : 'DESC';
116
      push @sanitized_orderbys, "$sanitized_identifier $sanitized_direction";
117
    }
109
118
110
    $orderby = " ORDER BY " . join(',', @orderbys) . " " if @orderbys;
119
    my $orderby = " ORDER BY " . join(',', @sanitized_orderbys) . " " if @sanitized_orderbys;
111
    return $orderby;
120
    return $orderby;
112
}
121
}
113
122
(-)a/t/db_dependent/Utils/Datatables.t (-3 / +2 lines)
Lines 47-53 subtest 'dt_build_orderby' => sub { Link Here
47
    };
47
    };
48
48
49
    my $orderby = dt_build_orderby($dt_params);
49
    my $orderby = dt_build_orderby($dt_params);
50
    is( $orderby, " ORDER BY branches.branchname asc,borrowers.surname desc,borrowers.firstname desc ", 'ORDER BY has been correctly built' );
50
    is( $orderby, " ORDER BY `branches`.`branchname` ASC,`borrowers`.`surname` DESC,`borrowers`.`firstname` DESC ", 'ORDER BY has been correctly built' );
51
51
52
    $dt_params = {
52
    $dt_params = {
53
        %$dt_params,
53
        %$dt_params,
Lines 57-61 subtest 'dt_build_orderby' => sub { Link Here
57
    };
57
    };
58
58
59
    $orderby = dt_build_orderby($dt_params);
59
    $orderby = dt_build_orderby($dt_params);
60
    is( $orderby, " ORDER BY branches.branchname asc,borrowers.surname desc,borrowers.firstname desc ", 'ORDER BY has been correctly built, even with invalid stuff');
60
    is( $orderby, " ORDER BY `branches`.`branchname` ASC,`borrowers`.`surname` DESC,`borrowers`.`firstname` DESC ", 'ORDER BY has been correctly built, even with invalid stuff');
61
};
61
};
62
- 

Return to bug 27715