From 3624bf8caada21b0797fa0a3cfb31333afff8925 Mon Sep 17 00:00:00 2001 From: Jonathan Druart Date: Tue, 2 Jun 2026 14:14:34 +0200 Subject: [PATCH] Bug 42746: Sanitize condition and substitution fields Signed-off-by: Sanjar Tulkinov Anvar o'g'li Amended-by: Jonathan Druart: Replace , with ; Signed-off-by: Martin Renvoize (cherry picked from commit 3b53d6711d3d6f1dce71b22c34787bfc4ec30748) Signed-off-by: Baptiste Wojtkowski --- tools/automatic_item_modification_by_age.pl | 10 +++++++--- 1 file changed, 7 insertions(+), 3 deletions(-) diff --git a/tools/automatic_item_modification_by_age.pl b/tools/automatic_item_modification_by_age.pl index b8c0280eb0..26a62f17eb 100755 --- a/tools/automatic_item_modification_by_age.pl +++ b/tools/automatic_item_modification_by_age.pl @@ -60,6 +60,8 @@ my $op = $cgi->param('op') // 'show'; my @item_fields = map { "items.$_" } Koha::Items->columns; my @biblioitem_fields = map { "biblioitems.$_" } Koha::Biblioitems->columns; my @biblio_fields = map { "biblio.$_" } Koha::Biblios->columns; +my @allowed_condition_fields = ( @item_fields, @biblioitem_fields, @biblio_fields ); +my @allowed_substitution_fields = @item_fields; my @allowed_age_fields = ( 'items.dateaccessioned', 'items.replacementpricedate', 'items.datelastborrowed', 'items.datelastseen', 'items.damaged_on', 'items.itemlost_on', 'items.withdrawn_on' @@ -82,6 +84,7 @@ if ( $op eq 'cud-update' ) { for my $value ( @substitution_values ) { my $field = shift @substitution_fields; last unless $field; + next unless grep { $_ eq $field } @allowed_substitution_fields; push @{ $rule->{substitutions} }, { field => $field, value => $value }; } push @{ $rule->{substitutions} }, {} @@ -89,6 +92,7 @@ if ( $op eq 'cud-update' ) { for my $value ( @condition_values ) { my $field = shift @condition_fields; last unless $field; + next unless grep { $_ eq $field } @allowed_condition_fields; push @{ $rule->{conditions} }, { field => $field, value => $value }; } push @{ $rule->{conditions} }, {} @@ -125,9 +129,9 @@ if ( $@ ) { $template->param( op => $op, messages => \@messages, - agefields => [@allowed_age_fields], - condition_fields => [ @item_fields, @biblioitem_fields, @biblio_fields ], - substitution_fields => \@item_fields, + agefields => \@allowed_age_fields, + condition_fields => \@allowed_condition_fields, + substitution_fields => \@allowed_substitution_fields, rules => $rules, );