From 0c679b7477da70c46029ed21b0fb2ee762b913de Mon Sep 17 00:00:00 2001 From: Aleisha Amohia Date: Fri, 30 Aug 2024 02:04:48 +0000 Subject: [PATCH] Bug 37784: Do not show forbidden columns in reports dictionary This patch prevents forbidden columns from being selected using the reports dictionary. To test: 1. Go to Reports -> View dictionary 2. Choose 'new dictionary' 3. After providing a name and description, select the 'patrons' table 4. Select the 'password' column and go Next 5. Notice it is possible to see a list of all the password hashes in the 'choose' selection box when asked to specify a value 6. Apply patch and restart services 7. Repeat steps 1-3 8. Notice the 'password' column and other forbidden columns are not available to be selected Sponsored-by: Reserve Bank of New Zealand --- C4/Reports/Guided.pm | 11 +++++++---- 1 file changed, 7 insertions(+), 4 deletions(-) diff --git a/C4/Reports/Guided.pm b/C4/Reports/Guided.pm index 1f1dd80ca23..6f53982437a 100644 --- a/C4/Reports/Guided.pm +++ b/C4/Reports/Guided.pm @@ -220,10 +220,13 @@ sub _get_columns { $tablehash{'__first__'} = $first; push @columns, \%tablehash; while ( my $data = $sth->fetchrow_arrayref() ) { - my %temphash; - $temphash{'name'} = "$tablename.$data->[0]"; - $temphash{'description'} = $columns->{$tablename}->{$data->[0]}; - push @columns, \%temphash; + my $forbidden = Koha::Report->new->check_columns( undef, $data ); + unless ($forbidden) { + my %temphash; + $temphash{'name'} = "$tablename.$data->[0]"; + $temphash{'description'} = $columns->{$tablename}->{ $data->[0] }; + push @columns, \%temphash; + } } $sth->finish(); return (@columns); -- 2.39.2