Bug 17227

Summary: SQL reserved words should be dis-allowed as branchcodes / authorized values / item types
Product: Koha Reporter: Barton Chittenden <barton>
Component: Staff interfaceAssignee: Bugs List <koha-bugs>
Status: NEW --- QA Contact: Testopia <testopia>
Severity: enhancement    
Priority: P5 - low CC: gmcharlt
Version: Main   
Hardware: All   
OS: All   
Change sponsored?: --- Patch complexity: ---
Documentation contact: Documentation submission:
Text to go in the release notes:
Version(s) released in:
Circulation function:

Description Barton Chittenden 2016-08-30 21:18:36 UTC
Related to bug 13727

It is possible for the report selectors

<<...|branch>>
<<...|[authorised value]>>
<<...|itemtypes>>
... etc.

To insert SQL keywords into the SQL of a report, causing a software error when the report runs, because Koha will now allow SQL reserved words in the queries.

To replicate:

Create a branch with the branch code 'CREATE'

Then create a report using the following query:

SELECT *
FROM items
WHERE items.homebranch = <<Branch|branch>>

Run the report, and select the branch with branchcode 'CREATE'.

This will cause a software error.

There is no way around this (because we *don't* want to allow SQL reserved words to be injected by user input). Therefore we *must* restrict the use of SQL reserved words on branch/authorized value/itemtype creation.