From 855156636645b6181e34d36e2f58c06703d9e4f3 Mon Sep 17 00:00:00 2001 From: Marcel de Rooy Date: Fri, 30 May 2025 10:56:35 +0200 Subject: [PATCH] Bug 39866: (QA follow-up) Rudimentary validation of line/column Content-Type: text/plain; charset=utf-8 Prevent SQL injection. Note: output_error in Output.pm needs further attention, but out of scope here. (The error passed gets replaced by 404 here too.) Test plan: Pass something else than table.field in Line or Column URL param. (Manipulate URL.) You should be redirected to 404 error instead of 500. Signed-off-by: Marcel de Rooy --- reports/acquisitions_stats.pl | 13 +++++++++++++ 1 file changed, 13 insertions(+) diff --git a/reports/acquisitions_stats.pl b/reports/acquisitions_stats.pl index 7619d442f3..0ef7761291 100755 --- a/reports/acquisitions_stats.pl +++ b/reports/acquisitions_stats.pl @@ -60,6 +60,19 @@ my ( $template, $borrowernumber, $cookie ) = get_template_and_user( } ); +# Validate line and column +if ( + $do_it + && ( !$line + || $line !~ /^(aqbasket|aqorders|aqbooksellers|items|biblioitems|aqbudgets)\.\w+$/ + || !$column + || $column !~ /^(aqbasket|aqorders|aqbooksellers|items|biblioitems|aqbudgets)\.\w+$/ ) + ) +{ + C4::Output::output_error( $input, 'Possible SQL injection' ); + exit; +} + our $sep = C4::Context->csv_delimiter( scalar $input->param("sep") ); $template->param( -- 2.39.5