Bug 27715: Sanitize order by DT params

We are not on the safe side when we build the ORDER BY clause from the
DataTables parameters.

I've started to limit the columns by using Koha::Objects->columns, but
for instance for the patron search we need (at least) the columns from
the branches, categories and members tables.
It seems easier, and still safe, to use a regex.

Signed-off-by: Martin Renvoize <martin.renvoize@ptfs-europe.com>
Signed-off-by: Joonas Kylmälä <joonas.kylmala@helsinki.fi>

Signed-off-by: Marcel de Rooy <m.de.rooy@rijksmuseum.nl>

Signed-off-by: Jonathan Druart <jonathan.druart@bugs.koha-community.org>

C4/Utils/DataTables.pm

@@ -100,6 +100,11 @@ sub dt_build_orderby {
         $i++;
     }
 
+    return unless @orderbys;
+
+    # Must be "branches.branchname asc", "borrowers.firstname desc", etc.
+    @orderbys = grep { /^\w+\.\w+\s(asc|desc)$/ } @orderbys;
+
     $orderby = " ORDER BY " . join(',', @orderbys) . " " if @orderbys;
     return $orderby;
 }