gitea
/
Koha-clms
1
0
Fork 0
Code Issues Pull Requests Packages Projects Releases Wiki Activity

Bug 42749: Prevent SQL injection from GetInvoices (order_by) 

Signed-off-by: Sanjar Tulkinov Anvar o'g'li <sanjarbiy11@gmail.com>
Signed-off-by: Martin Renvoize <martin.renvoize@openfifth.co.uk>
(cherry picked from commit cb22264499)
Signed-off-by: Baptiste Wojtkowski <baptiste.wojtkowski@biblibre.com>
This commit is contained in:
Jonathan Druart 2026-06-08 12:21:17 +02:00 committed by Baptiste Wojtkowski
parent 605b6fc4b5
commit 46eb21993c
No known key found for this signature in database
GPG Key ID: 47A8A13E10BC0D40
2 changed files with 10 additions and 2 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

2
C4/Acquisition.pm
View File

@ -2483,7 +2483,7 @@ sub GetInvoices {
if($args{order_by}) {
my ($column, $direction) = split / /, $args{order_by};
if(grep { $_ eq $column } @columns) {
$direction ||= 'ASC';
$direction = ( uc( $direction // '' ) eq 'DESC' ) ? 'DESC' : 'ASC';
$query .= " ORDER BY $column $direction";
}
}

10
t/db_dependent/Acquisition/Invoices.t
View File

@ -8,7 +8,7 @@ use Koha::Acquisition::Booksellers;
use Koha::Acquisition::Orders;
use Koha::Database;
use Test::More tests => 29;
use Test::More tests => 30;
BEGIN {
use_ok('C4::Acquisition', qw( NewBasket GetBasket AddInvoice GetInvoice ModReceiveOrder GetInvoiceDetails GetInvoices ModInvoice CloseInvoice ReopenInvoice MergeInvoices DelInvoice ));
@ -214,6 +214,14 @@ my @invoices_linked_to_subscriptions = map{
} @invoices;
is_deeply( \@invoices_linked_to_subscriptions, [], "GetInvoices return linked_to_subscriptions: there is no invoices linked to subscriptions yet" );
subtest 'prevent SQL injection in GetInvoices for order_by' => sub {
plan tests => 1;
# No error
GetInvoices( order_by => 'shipmentdate ASC,(SELECT/**/1/**/FROM/**/koha_zzz_nope)' );
pass();
};
END {
$dbh and $schema->storage->txn_rollback();
}