From 46eb21993cb5fd42cd138e0068c20f7151f4f2ab Mon Sep 17 00:00:00 2001 From: Jonathan Druart Date: Mon, 8 Jun 2026 12:21:17 +0200 Subject: [PATCH] Bug 42749: Prevent SQL injection from GetInvoices (order_by) Signed-off-by: Sanjar Tulkinov Anvar o'g'li Signed-off-by: Martin Renvoize (cherry picked from commit cb22264499740a7f962b9d893f784b24f5a1c00c) Signed-off-by: Baptiste Wojtkowski --- C4/Acquisition.pm | 2 +- t/db_dependent/Acquisition/Invoices.t | 10 +++++++++- 2 files changed, 10 insertions(+), 2 deletions(-) diff --git a/C4/Acquisition.pm b/C4/Acquisition.pm index 253c509b49..df4bdc938b 100644 --- a/C4/Acquisition.pm +++ b/C4/Acquisition.pm @@ -2483,7 +2483,7 @@ sub GetInvoices { if($args{order_by}) { my ($column, $direction) = split / /, $args{order_by}; if(grep { $_ eq $column } @columns) { - $direction ||= 'ASC'; + $direction = ( uc( $direction // '' ) eq 'DESC' ) ? 'DESC' : 'ASC'; $query .= " ORDER BY $column $direction"; } } diff --git a/t/db_dependent/Acquisition/Invoices.t b/t/db_dependent/Acquisition/Invoices.t index 337bd94883..5386f17ce5 100755 --- a/t/db_dependent/Acquisition/Invoices.t +++ b/t/db_dependent/Acquisition/Invoices.t @@ -8,7 +8,7 @@ use Koha::Acquisition::Booksellers; use Koha::Acquisition::Orders; use Koha::Database; -use Test::More tests => 29; +use Test::More tests => 30; BEGIN { use_ok('C4::Acquisition', qw( NewBasket GetBasket AddInvoice GetInvoice ModReceiveOrder GetInvoiceDetails GetInvoices ModInvoice CloseInvoice ReopenInvoice MergeInvoices DelInvoice )); @@ -214,6 +214,14 @@ my @invoices_linked_to_subscriptions = map{ } @invoices; is_deeply( \@invoices_linked_to_subscriptions, [], "GetInvoices return linked_to_subscriptions: there is no invoices linked to subscriptions yet" ); +subtest 'prevent SQL injection in GetInvoices for order_by' => sub { + plan tests => 1; + + # No error + GetInvoices( order_by => 'shipmentdate ASC,(SELECT/**/1/**/FROM/**/koha_zzz_nope)' ); + pass(); +}; + END { $dbh and $schema->storage->txn_rollback(); }