Koha-clms/reports
David Cook 92865a3bec
Bug 42368: [24.11] Fix SQL injection in issue avg stats
This change fixes SQL injection in issues avg stats

Test plan:
0. Apply the patch
1. sudo koha-plack --restart kohadev
2. Go to /cgi-bin/koha/reports/issues_avg_stats.pl
3. Try out all the different options
4. Try to break the report
5. Note that you always get output instead of errors

Signed-off-by: Sanjar Tulkinov Anvar o'g'li <sanjarbiy11@gmail.com>
Signed-off-by: Martin Renvoize <martin.renvoize@openfifth.co.uk>
(cherry picked from commit f0d3bf850b8ff85c9393126763b1477d1cdc5c09)
Signed-off-by: Fridolin Somers <fridolin.somers@biblibre.com>
2026-06-18 15:50:40 +02:00
..
acquisitions_stats.pl Bug 42360: [24.11] Move separator validation to C4::Context::csv_delimiter 2026-06-18 15:50:38 +02:00
bor_issues_top.pl Bug 34478: op =~ ^cud- - Manual - cud-do_it => do_it 2024-03-01 10:58:32 +01:00
borrowers_out.pl Bug 34478: op =~ ^cud- - Manual - cud-do_it => do_it 2024-03-01 10:58:32 +01:00
borrowers_stats.pl Bug 36380: Add filter value on patron statistics report summary 2024-05-10 15:19:11 +02:00
cash_register_stats.pl Bug 33339: Prevent Formula Injection (CSV Injection) in CSV files 2024-11-14 10:46:31 +01:00
cat_issues_top.pl Bug 34478: op =~ ^cud- - Manual - cud-do_it => do_it 2024-03-01 10:58:32 +01:00
catalog_by_itemtype.pl Bug 31988: Remove reports/itemtypes.plugin 2024-03-18 18:03:39 +01:00
catalogue_out.pl Bug 42361: Fix SQL injection in catalogue_out.pl 2026-05-28 10:12:20 +00:00
catalogue_stats.pl Bug 42363: [24.11] Use C4::Context::csv_delimiter for delimiter validation 2026-06-18 15:50:39 +02:00
dictionary.pl Bug 37784: (QA follow-up) Bail out to new definition 2025-03-24 17:59:10 +01:00
guided_reports.pl Bug 38414: [24.11.x] Fix permission controller-side 2026-05-28 10:09:20 +00:00
issues_avg_stats.pl Bug 42368: [24.11] Fix SQL injection in issue avg stats 2026-06-18 15:50:40 +02:00
issues_stats.pl Bug 41715: Argument "YYYY-MM-DD" isn't numeric in numeric lt (<)... warnings in issues_stats.pl 2026-05-27 12:54:47 +00:00
itemslost.pl Bug 33339: Prevent Formula Injection (CSV Injection) in CSV files 2024-11-14 10:46:31 +01:00
orders_by_fund.pl Bug 40419: Fix wrong license 2025-08-01 14:50:29 +02:00
reports-home.pl Bug 34859: Remove unnecessary params from reports-home.pl 2023-10-04 16:40:16 -04:00
reserves_stats.pl Bug 34478: op =~ ^cud- - Manual - cud-do_it => do_it 2024-03-01 10:58:32 +01:00
serials_stats.pl Bug 34478: op =~ ^cud- - Manual - cud-do_it => do_it 2024-03-01 10:58:32 +01:00