gitea
/
Koha-clms
1
0
Fork 0
Code Issues Pull Requests Packages Projects Releases Wiki Activity

Bug 41593: Validate displayby parameter in suggestion.pl 

This change validates the displayby parameter in suggestion.pl
in order to prevent SQL injection.

Test plan:
0. Do not apply the patch
1. Log into the staff interface
2. Visit the path /cgi-bin/koha/suggestion/suggestion.pl?
op=else&displayby=status+AND+EXTRACTVALUE(1,CONCAT(0x7e,@@version))
3. Notice a 500 error is generated
4. In the error logs, the MySQL version number will appear

5. Apply the patch
6. koha-plack --restart kohadev

7. Visit the path /cgi-bin/koha/suggestion/suggestion.pl?
op=else&displayby=status+AND+EXTRACTVALUE(1,CONCAT(0x7e,@@version))
8. Notice that no error is generated
9. Try each of the "Organize by" options on the left nav bar
10. Note that none of them generate an error and that the option is
retained after clicking "Go"

Signed-off-by: Jonathan Druart <jonathan.druart@bugs.koha-community.org>
Signed-off-by: Lisette Scheer <lisette@bywatersolutions.com>
Signed-off-by: Jacob O'Mara <jacob.omara@openfifth.co.uk>
This commit is contained in:
David Cook 2026-01-11 23:38:38 +00:00 committed by Jacob O'Mara
parent 2c2c04dfb2
commit a80f3429f0
No known key found for this signature in database
1 changed files with 12 additions and 0 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

12
suggestion/suggestion.pl Executable file → Normal file
View File

@ -103,6 +103,18 @@ my $filter_archived = $input->param('filter_archived') || 0;
my $new_itemtype = $input->param('suggestion_itemtype');
my $sugg_managedby = $input->param('suggestion_managedby');
#NOTE: Validate displayby as it gets passed to sensitive functions
my %valid_displayby = (
STATUS => 1,
branchcode => 1,
itemtype => 1,
managedby => 1,
acceptedby => 1,
);
if ( !$valid_displayby{$displayby} ) {
$displayby = '';
}
my $reasonsloop = GetAuthorisedValues("SUGGEST");
my $suggestion_ref = { $input->Vars };