gitea
/
Koha-clms
1
0
Fork 0
Code Issues Pull Requests Packages Projects Releases Wiki Activity

Bug 42747: Prevent SQL injection via image_name in edit-layout 

Signed-off-by: Sanjar Tulkinov Anvar o'g'li <sanjarbiy11@gmail.com>
Signed-off-by: Martin Renvoize <martin.renvoize@openfifth.co.uk>
Signed-off-by: Wainui Witika-Park <wainuiwitikapark@catalyst.net.nz>
This commit is contained in:
Jonathan Druart 2026-07-07 14:23:44 +01:00 committed by Wainui Witika-Park
parent 4117fdd35a
commit 32b9364b06
No known key found for this signature in database
GPG Key ID: 2D0A6AB5DAF1B78D
1 changed files with 16 additions and 2 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

18
patroncards/edit-layout.pl
View File

@ -195,6 +195,12 @@ UNUSED_IMAGE_FIELDS:
my $array_index = 0;
my $image_select = 0;
my $field_enabled = 0;
# Get valid image names for validation
my $valid_image_names = get_all_image_names();
my %valid_images = map { $_->{'type'} => 1 } @$valid_image_names;
$valid_images{'none'} = 1; # 'none' is also a valid value
CGI_PARAMS:
foreach my $parameter ( $cgi->multi_param() )
@ -223,10 +229,18 @@ CGI_PARAMS:
my $image_data = $2;
$field_enabled = $image_number if $cgi->param( "image_$image_number" . "_image_source" ) ne 'none';
next CGI_PARAMS unless $image_number == $field_enabled;
my $param_value = $cgi->param($parameter);
# Sanitize image_name
my $field_name = $image_data =~ m/^image_(.*)$/ ? $1 : $image_data;
$param_value = undef
if $field_name eq 'name'
&& $param_value
&& !exists $valid_images{$param_value};
if ( $image_data =~ m/^image_(.*)$/ ) {
$layout->{'images'}->{"image_$image_number"}->{'data_source'}->{"image_$1"} = $cgi->param($parameter);
$layout->{'images'}->{"image_$image_number"}->{'data_source'}->{"image_$1"} = $param_value;
} else {
$layout->{'images'}->{"image_$image_number"}->{$image_data} = $cgi->param($parameter);
$layout->{'images'}->{"image_$image_number"}->{$image_data} = $param_value;
}
} else {
$layout_name = $cgi->param($parameter) if $parameter eq 'layout_name';