From 2ea4b032c5caac59519943995e18ecdfb0605009 Mon Sep 17 00:00:00 2001 From: Jonathan Druart Date: Mon, 13 May 2024 14:47:28 +0200 Subject: [PATCH] Bug 36520: Prevent SQL injection in GetPreparedLetter Actually in _get_tt_params The following query will delay the response SELECT `me`.`biblionumber`, `me`.`frameworkcode`, `me`.`author`, `me`.`title`, `me`.`medium`, `me`.`subtitle`, `me`.`part_number`, `me`.`part_name`, `me`.`unititle`, `me`.`notes`, `me`.`serial`, `me`.`seriestitle` , `me`.`copyrightdate`, `me`.`timestamp`, `me`.`datecreated`, `me`.`abstract` FROM `biblio` `me` WHERE `biblionumber` = '1) AND (SELECT 1 FROM (SELECT(SLEEP(6)))x)-- -' ORDER BY field( biblionumber, 1 ) AND ( SELECT 1 FROM SELECT SLEEP( 6 ) x ) -- - ) Note that those queries are run inside a transaction and thus it would not be possible to run a bad (stateful) query. --- C4/Letters.pm | 20 ++++++++++++++------ 1 file changed, 14 insertions(+), 6 deletions(-) diff --git a/C4/Letters.pm b/C4/Letters.pm index dfb7b786940..b6d77591efb 100644 --- a/C4/Letters.pm +++ b/C4/Letters.pm @@ -1890,6 +1890,7 @@ sub _get_tt_params { }, }; + my $dbh = C4::Context->dbh; foreach my $table ( keys %$tables ) { next unless $config->{$table}; @@ -1910,12 +1911,19 @@ sub _get_tt_params { my $objects = $module->search( { $key => $values }, { - # We want to retrieve the data in the same order - # FIXME MySQLism - # field is a MySQLism, but they are no other way to do it - # To be generic we could do it in perl, but we will need to fetch - # all the data then order them - @$values ? ( order_by => \[ "field($key, " . join( ', ', @$values ) . ")" ] ) : () + # We want to retrieve the data in the same order + # FIXME MySQLism + # field is a MySQLism, but they are no other way to do it + # To be generic we could do it in perl, but we will need to fetch + # all the data then order them + @$values + ? ( + order_by => \[ + sprintf "field(%s, %s)", $dbh->quote($key), + map { $dbh->quote($_) } join( ', ', @$values ) + ] + ) + : () } ); $params->{ $config->{$table}->{plural} } = $objects; -- 2.34.1