From 84087929bc6ab7251cc1d0efdbdd022f87c4ae11 Mon Sep 17 00:00:00 2001 From: David Cook Date: Sun, 11 Jan 2026 23:38:38 +0000 Subject: [PATCH] Bug 41593: Validate displayby parameter in suggestion.pl This change validates the displayby parameter in suggestion.pl in order to prevent SQL injection. Test plan: 0. Do not apply the patch 1. Log into the staff interface 2. Visit the path /cgi-bin/koha/suggestion/suggestion.pl? op=else&displayby=status+AND+EXTRACTVALUE(1,CONCAT(0x7e,@@version)) 3. Notice a 500 error is generated 4. In the error logs, the MySQL version number will appear 5. Apply the patch 6. koha-plack --restart kohadev 7. Visit the path /cgi-bin/koha/suggestion/suggestion.pl? op=else&displayby=status+AND+EXTRACTVALUE(1,CONCAT(0x7e,@@version)) 8. Notice that no error is generated 9. Try each of the "Organize by" options on the left nav bar 10. Note that none of them generate an error and that the option is retained after clicking "Go" Signed-off-by: Jonathan Druart Signed-off-by: Lisette Scheer --- suggestion/suggestion.pl | 12 ++++++++++++ 1 file changed, 12 insertions(+) diff --git a/suggestion/suggestion.pl b/suggestion/suggestion.pl index 6408c7b1729..155c97bf644 100755 --- a/suggestion/suggestion.pl +++ b/suggestion/suggestion.pl @@ -98,6 +98,18 @@ my $filter_archived = $input->param('filter_archived') || 0; my $new_itemtype = $input->param('suggestion_itemtype'); my $sugg_managedby = $input->param('suggestion_managedby'); +#NOTE: Validate displayby as it gets passed to sensitive functions +my %valid_displayby = ( + STATUS => 1, + branchcode => 1, + itemtype => 1, + managedby => 1, + acceptedby => 1, +); +if ( !$valid_displayby{$displayby} ) { + $displayby = ''; +} + my $reasonsloop = GetAuthorisedValues("SUGGEST"); my $suggestion_ref = { $input->Vars }; -- 2.43.0