Bug 17227 - SQL reserved words should be dis-allowed as branchcodes / authorized values / item types
Summary: SQL reserved words should be dis-allowed as branchcodes / authorized values /...
Status: NEW
Alias: None
Product: Koha
Classification: Unclassified
Component: Staff interface (show other bugs)
Version: Main
Hardware: All All
: P5 - low enhancement (vote)
Assignee: Bugs List
QA Contact: Testopia
URL:
Keywords:
Depends on:
Blocks:
 
Reported: 2016-08-30 21:18 UTC by Barton Chittenden
Modified: 2016-08-30 21:18 UTC (History)
1 user (show)

See Also:
Change sponsored?: ---
Patch complexity: ---
Documentation contact:
Documentation submission:
Text to go in the release notes:
Version(s) released in:


Attachments

Note You need to log in before you can comment on or make changes to this bug.
Description Barton Chittenden 2016-08-30 21:18:36 UTC
Related to bug 13727

It is possible for the report selectors

<<...|branch>>
<<...|[authorised value]>>
<<...|itemtypes>>
... etc.

To insert SQL keywords into the SQL of a report, causing a software error when the report runs, because Koha will now allow SQL reserved words in the queries.

To replicate:

Create a branch with the branch code 'CREATE'

Then create a report using the following query:

SELECT *
FROM items
WHERE items.homebranch = <<Branch|branch>>

Run the report, and select the branch with branchcode 'CREATE'.

This will cause a software error.

There is no way around this (because we *don't* want to allow SQL reserved words to be injected by user input). Therefore we *must* restrict the use of SQL reserved words on branch/authorized value/itemtype creation.