From af3e9a68d2ee496b84fb88a0a79c15332bb77470 Mon Sep 17 00:00:00 2001 From: Jonathan Druart Date: Mon, 13 May 2024 14:47:28 +0200 Subject: [PATCH] Bug 36520: Prevent SQL injection in GetPreparedLetter Actually in _get_tt_params The following query will delay the response SELECT `me`.`biblionumber`, `me`.`frameworkcode`, `me`.`author`, `me`.`title`, `me`.`medium`, `me`.`subtitle`, `me`.`part_number`, `me`.`part_name`, `me`.`unititle`, `me`.`notes`, `me`.`serial`, `me`.`seriestitle` , `me`.`copyrightdate`, `me`.`timestamp`, `me`.`datecreated`, `me`.`abstract` FROM `biblio` `me` WHERE `biblionumber` = '1) AND (SELECT 1 FROM (SELECT(SLEEP(6)))x)-- -' ORDER BY field( biblionumber, 1 ) AND ( SELECT 1 FROM SELECT SLEEP( 6 ) x ) -- - ) Note that those queries are run inside a transaction and thus it would not be possible to run a bad (stateful) query. --- C4/Letters.pm | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) diff --git a/C4/Letters.pm b/C4/Letters.pm index dfb7b786940..0233c33aa45 100644 --- a/C4/Letters.pm +++ b/C4/Letters.pm @@ -1890,6 +1890,7 @@ sub _get_tt_params { }, }; + my $dbh = C4::Context->dbh; foreach my $table ( keys %$tables ) { next unless $config->{$table}; @@ -1915,7 +1916,7 @@ sub _get_tt_params { # field is a MySQLism, but they are no other way to do it # To be generic we could do it in perl, but we will need to fetch # all the data then order them - @$values ? ( order_by => \[ "field($key, " . join( ', ', @$values ) . ")" ] ) : () + @$values ? ( order_by => \[ sprintf "field(%s, %s)", $dbh->quote($key), join( ', ', @$values ) ] ) : () } ); $params->{ $config->{$table}->{plural} } = $objects; -- 2.34.1