Koha-clms/svc
Aleisha Amohia 09315dfb28
Bug 37508: Throw error if password column is detected in SQL report
This enhancement prevents SQL queries from being run if they would return a password field from the database table.

To test:

1. Run tests and notice they fail t/db_dependent/Reports/Guided.t

2. Apply patch and restart services

3. Create a public report with an SQL report which would access a password column in a database table
4. Try to run the report. Notice you are met with an error and the results are not shown.
5. Access the JSON URL, you should not get the results and should be shown an error
6. Confirm tests pass t/db_dependent/Reports/Guided.t

Sponsored-by: Reserve Bank of New Zealand

Signed-off-by: David Cook <dcook@prosentient.com.au>
Signed-off-by: Marcel de Rooy <m.de.rooy@rijksmuseum.nl>
Signed-off-by: Tomas Cohen Arazi <tomascohen@theke.io>
2024-08-13 11:54:01 -03:00
..
cataloguing Bug 31682: Silence automatic linker warn 2022-10-11 10:41:23 -03:00
club Bug 35942: OPAC user can enroll several times to the same club [23.05.x] 2024-03-04 17:34:39 +01:00
config Bug 34369: Require CSRF token for updating system preferences 2023-09-28 09:18:30 +00:00
letters Bug 17600: Fix imports for svc/letters/preview 2021-10-21 09:56:29 +02:00
mana Bug 28785: Adjust check_cookie_auth calls 2021-10-18 11:28:41 +02:00
members Bug 30063: Remove svc/members/search 2022-04-04 09:47:01 +02:00
records Bug 32631: Error when previewing record during batch record modification 2023-01-31 14:26:35 +00:00
virtualshelves Bug 25498: Add transfer button on intranet 2022-07-19 11:25:23 -03:00
article_request Bug 28785: Adjust check_cookie_auth calls 2021-10-18 11:28:41 +02:00
authentication Bug 25898: Prohibit indirect object notation 2020-10-15 12:56:30 +02:00
authorised_values Bug 28785: Adjust check_cookie_auth calls 2021-10-18 11:28:41 +02:00
barcode Bug 37464: Validate "type" sent to barcode/svc 2024-08-13 11:53:59 -03:00
bib Bug 29697: Replace some missing occurrences 2022-07-25 09:30:30 -03:00
bib_framework Bug 28750: fix svc/bib_framework 2021-07-26 16:28:52 +02:00
bib_profile Bug 25898: Prohibit indirect object notation 2020-10-15 12:56:30 +02:00
checkin Bug 28785: Adjust check_cookie_auth calls 2021-10-18 11:28:41 +02:00
checkout_notes Bug 28785: Adjust check_cookie_auth calls 2021-10-18 11:28:41 +02:00
checkouts Bug 33944: Don't fetch item object unless using recalls 2023-07-18 11:11:10 +00:00
convert_report Bug 34533: jsdiff library missing from guided reports page 2023-08-31 10:11:32 +00:00
cover_images Bug 29771: Remove trivial cases 2022-03-08 23:03:34 -10:00
creator_batches Bug 28785: Adjust check_cookie_auth calls 2021-10-18 11:28:41 +02:00
holds Bug 24860: Add hold's item group to holds table on circulation.pl and moremember.pl 2022-11-04 19:39:57 -03:00
import_bib Bug 15869: Change framework on overlay 2023-02-08 16:34:09 +00:00
localization
…
new_bib Bug 29697: Replace some missing occurrences 2022-07-25 09:30:30 -03:00
problem_reports Bug 28785: Adjust check_cookie_auth calls 2021-10-18 11:28:41 +02:00
recall Bug 30924: Add missing branchtransfers.reason value for recall cancellation 2022-06-13 10:30:51 -03:00
renew Bug 27249: Prevent infinite loop when searching for an open day 2023-11-13 13:45:36 +00:00
report Bug 37508: Throw error if password column is detected in SQL report 2024-08-13 11:54:01 -03:00
return_claims Bug 29931: (follow-up) Fix svc/checkouts and return_claims too 2022-03-15 22:30:50 -10:00
split_callnumbers Bug 26251: Remove unused routines from svc/split_callnumbers 2020-08-20 10:23:56 +02:00