| Summary: | SQL Injection vulnerability in ysearch.pl | ||
|---|---|---|---|
| Product: | Koha | Reporter: | Ryan Henderson <ryan.henderson> |
| Component: | Architecture, internals, and plumbing | Assignee: | David Cook <dcook> |
| Status: | CLOSED FIXED | QA Contact: | Nick Clemens (kidclamp) <nick> |
| Severity: | enhancement | ||
| Priority: | P5 - low | CC: | 1joynelson, dcook, didier.gautheron, fridolin.somers, jonathan.druart, kyle, laurent.ducos, lucas, m.de.rooy, martin.renvoize, nick, tomascohen |
| Version: | unspecified | ||
| Hardware: | All | ||
| OS: | All | ||
| Change sponsored?: | --- | Patch complexity: | Trivial patch |
| Documentation contact: | Documentation submission: | ||
| Text to go in the release notes: | Version(s) released in: |
23.11.00,23.05.06,22.11.12,22.05.17,21.11.26
|
|
| Circulation function: | |||
| Bug Depends on: | |||
| Bug Blocks: | 35835 | ||
| Attachments: |
Bug 35290: Sanitize field input on cataloguing/ysearch.pl
Bug 35290: Sanitize field input on cataloguing/ysearch.pl Bug 35290: (follow-up) Perltidy formatting corrections Bug 35290: Sanitize field input on cataloguing/ysearch.pl Bug 35290: (follow-up) Perltidy formatting corrections |
||
|
Description
Ryan Henderson
2023-11-08 15:08:01 UTC
Can easily be fixed as it's only used in a couple of places: cataloguing/value_builder/marc21_field_260b.pl: source: '/cgi-bin/koha/cataloguing/ysearch.pl?table=biblioitems&field=publishercode', koha-tmpl/intranet-tmpl/prog/en/modules/cataloguing/value_builder/unimarc_field_210c_bis.tt: source: "/cgi-bin/koha/cataloguing/ysearch.pl?table=biblioitems&field=publishercode", koha-tmpl/intranet-tmpl/prog/en/modules/cataloguing/value_builder/unimarc_field_225a_bis.tt: source: "/cgi-bin/koha/cataloguing/ysearch.pl?table=biblioitems&field=collectiontitle", Sanitizing the input should be trivial. (In reply to Jonathan Druart from comment #1) > Can easily be fixed as it's only used in a couple of places: > > cataloguing/value_builder/marc21_field_260b.pl: source: > '/cgi-bin/koha/cataloguing/ysearch.pl?table=biblioitems&field=publishercode', > koha-tmpl/intranet-tmpl/prog/en/modules/cataloguing/value_builder/ > unimarc_field_210c_bis.tt: source: > "/cgi-bin/koha/cataloguing/ysearch.pl?table=biblioitems&field=publishercode", > koha-tmpl/intranet-tmpl/prog/en/modules/cataloguing/value_builder/ > unimarc_field_225a_bis.tt: source: > "/cgi-bin/koha/cataloguing/ysearch. > pl?table=biblioitems&field=collectiontitle", > > Sanitizing the input should be trivial. Looks like we're already filtering "table", so "field" just needs to be filtered as well for "publishercode" or "collectiontitle" it seems? Created attachment 158682 [details] [review] Bug 35290: Sanitize field input on cataloguing/ysearch.pl This change sanitizies the field input on cataloguing/ysearch.pl Test plan: 0. Apply the patch and restart/reload Koha 1a. "Add marc21_field_260b.pl plugin to 260$b in the Default framework" 1b. Go to http://localhost:8081/cgi-bin/koha/admin/marc_subfields_structure.pl? op=add_form&tagfield=260&frameworkcode=#subbfield 1c. Choose "marc21_field_260b.pl" from the dropdown next to "Plugin" 1d. Click "Save changes" 2a. "Add new record" 2b. Go to http://localhost:8081/cgi-bin/koha/cataloguing/addbiblio.pl?frameworkcode= 3. Click on tab "2" and scroll down to 260 "b" 4. Type in "Ori" into 260 subfield b 5. Some autocomplete suggestions should appear Created attachment 158762 [details] [review] Bug 35290: Sanitize field input on cataloguing/ysearch.pl This change sanitizies the field input on cataloguing/ysearch.pl Test plan: 0. Apply the patch and restart/reload Koha 1a. "Add marc21_field_260b.pl plugin to 260$b in the Default framework" 1b. Go to http://localhost:8081/cgi-bin/koha/admin/marc_subfields_structure.pl? op=add_form&tagfield=260&frameworkcode=#subbfield 1c. Choose "marc21_field_260b.pl" from the dropdown next to "Plugin" 1d. Click "Save changes" 2a. "Add new record" 2b. Go to http://localhost:8081/cgi-bin/koha/cataloguing/addbiblio.pl?frameworkcode= 3. Click on tab "2" and scroll down to 260 "b" 4. Type in "Ori" into 260 subfield b 5. Some autocomplete suggestions should appear Signed-off-by: Owen Leonard <oleonard@myacpl.org> Created attachment 158763 [details] [review] Bug 35290: (follow-up) Perltidy formatting corrections Created attachment 158764 [details] [review] Bug 35290: Sanitize field input on cataloguing/ysearch.pl This change sanitizies the field input on cataloguing/ysearch.pl Test plan: 0. Apply the patch and restart/reload Koha 1a. "Add marc21_field_260b.pl plugin to 260$b in the Default framework" 1b. Go to http://localhost:8081/cgi-bin/koha/admin/marc_subfields_structure.pl? op=add_form&tagfield=260&frameworkcode=#subbfield 1c. Choose "marc21_field_260b.pl" from the dropdown next to "Plugin" 1d. Click "Save changes" 2a. "Add new record" 2b. Go to http://localhost:8081/cgi-bin/koha/cataloguing/addbiblio.pl?frameworkcode= 3. Click on tab "2" and scroll down to 260 "b" 4. Type in "Ori" into 260 subfield b 5. Some autocomplete suggestions should appear Signed-off-by: Owen Leonard <oleonard@myacpl.org> Signed-off-by: Nick Clemens <nick@bywatersolutions.com> Created attachment 158765 [details] [review] Bug 35290: (follow-up) Perltidy formatting corrections Signed-off-by: Nick Clemens <nick@bywatersolutions.com> Pushed to master for 23.11. Nice work everyone, thanks! --- a/cataloguing/ysearch.pl +++ b/cataloguing/ysearch.pl @@ -1,4 +1,4 @@ -#!/usr/bin/perl + #!/usr/bin/perl Whooo is this normal ? (In reply to Fridolin Somers from comment #9) > --- a/cataloguing/ysearch.pl > +++ b/cataloguing/ysearch.pl > @@ -1,4 +1,4 @@ > -#!/usr/bin/perl > + #!/usr/bin/perl > > Whooo is this normal ? Looks like a bad perltidy to me. It probably won't have any negative consequences overall when using Plack instead of CGI. But good to fix that I'd say. Pushed to 21.11.x for 21.11.26 (In reply to Fridolin Somers from comment #9) > --- a/cataloguing/ysearch.pl > +++ b/cataloguing/ysearch.pl > @@ -1,4 +1,4 @@ > -#!/usr/bin/perl > + #!/usr/bin/perl > > Whooo is this normal ? We should catch that in qa tools ? (In reply to David Cook from comment #10) > It probably won't have any negative consequences overall when using Plack > instead of CGI. But good to fix that I'd say. Done on 35835 Do we move this back to Koha project now? (In reply to David Cook from comment #14) > Do we move this back to Koha project now? Yes, done. |