@@ -, +, @@ input --- C4/Utils/DataTables.pm | 15 ++++++++++++--- t/db_dependent/Utils/Datatables.t | 4 ++-- 2 files changed, 14 insertions(+), 5 deletions(-) --- a/C4/Utils/DataTables.pm +++ a/C4/Utils/DataTables.pm @@ -85,8 +85,8 @@ sub dt_build_orderby { my $param = shift; my $i = 0; - my $orderby; my @orderbys; + my $dbh = C4::Context->dbh; while(exists $param->{'iSortCol_'.$i}){ my $iSortCol = $param->{'iSortCol_'.$i}; my $sSortDir = $param->{'sSortDir_'.$i}; @@ -105,9 +105,18 @@ sub dt_build_orderby { return unless @orderbys; # Must be "branches.branchname asc", "borrowers.firstname desc", etc. - @orderbys = grep { /^\w+\.\w+\s(asc|desc)$/ } @orderbys; + @orderbys = grep { /^\w+\.\w+ (asc|desc)$/ } @orderbys; + + my @sanitized_orderbys; + for my $orderby (@orderbys) { + my ($identifier, $direction) = split / /, $orderby, 2; + my ($table, $column) = split /\./, $identifier, 2; + my $sanitized_identifier = $dbh->quote_identifier(undef, $table, $column); + my $sanitized_direction = $direction eq 'asc' ? 'ASC' : 'DESC'; + push @sanitized_orderbys, "$sanitized_identifier $sanitized_direction"; + } - $orderby = " ORDER BY " . join(',', @orderbys) . " " if @orderbys; + my $orderby = " ORDER BY " . join(',', @sanitized_orderbys) . " " if @sanitized_orderbys; return $orderby; } --- a/t/db_dependent/Utils/Datatables.t +++ a/t/db_dependent/Utils/Datatables.t @@ -47,7 +47,7 @@ subtest 'dt_build_orderby' => sub { }; my $orderby = dt_build_orderby($dt_params); - is( $orderby, " ORDER BY branches.branchname asc,borrowers.surname desc,borrowers.firstname desc ", 'ORDER BY has been correctly built' ); + is( $orderby, " ORDER BY `branches`.`branchname` ASC,`borrowers`.`surname` DESC,`borrowers`.`firstname` DESC ", 'ORDER BY has been correctly built' ); $dt_params = { %$dt_params, @@ -57,5 +57,5 @@ subtest 'dt_build_orderby' => sub { }; $orderby = dt_build_orderby($dt_params); - is( $orderby, " ORDER BY branches.branchname asc,borrowers.surname desc,borrowers.firstname desc ", 'ORDER BY has been correctly built, even with invalid stuff'); + is( $orderby, " ORDER BY `branches`.`branchname` ASC,`borrowers`.`surname` DESC,`borrowers`.`firstname` DESC ", 'ORDER BY has been correctly built, even with invalid stuff'); }; --