gitea
/
Koha-clms
1
0
Fork 0
Code Issues Pull Requests Packages Projects Releases Wiki Activity

Bug 41593: Validate displayby parameter in suggestion.pl 

This change validates the displayby parameter in suggestion.pl
in order to prevent SQL injection.

Test plan:
0. Do not apply the patch
1. Log into the staff interface
2. Visit the path /cgi-bin/koha/suggestion/suggestion.pl?
op=else&displayby=status+AND+EXTRACTVALUE(1,CONCAT(0x7e,@@version))
3. Notice a 500 error is generated
4. In the error logs, the MySQL version number will appear

5. Apply the patch
6. koha-plack --restart kohadev

7. Visit the path /cgi-bin/koha/suggestion/suggestion.pl?
op=else&displayby=status+AND+EXTRACTVALUE(1,CONCAT(0x7e,@@version))
8. Notice that no error is generated
9. Try each of the "Organize by" options on the left nav bar
10. Note that none of them generate an error and that the option is
retained after clicking "Go"

Signed-off-by: Jonathan Druart <jonathan.druart@bugs.koha-community.org>
Signed-off-by: Lisette Scheer <lisette@bywatersolutions.com>
Signed-off-by: Wainui Witika-Park <wainuiwitikapark@catalyst.net.nz>
This commit is contained in:
David Cook 2026-01-11 23:38:38 +00:00 committed by Wainui Witika-Park
parent e50da8836b
commit 849ea83491
No known key found for this signature in database
GPG Key ID: 2D0A6AB5DAF1B78D
1 changed files with 12 additions and 0 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

12
suggestion/suggestion.pl
View File

@ -95,6 +95,18 @@ my $save_confirmed = $input->param('save_confirmed') || 0;
my $notify = $input->param('notify');
my $filter_archived = $input->param('filter_archived') || 0;
#NOTE: Validate displayby as it gets passed to sensitive functions
my %valid_displayby = (
STATUS => 1,
branchcode => 1,
itemtype => 1,
managedby => 1,
acceptedby => 1,
);
if ( !$valid_displayby{$displayby} ) {
$displayby = '';
}
my $reasonsloop = GetAuthorisedValues("SUGGEST");
# filter informations which are not suggestion related.