Koha-community/Koha
13
7
Fork 0
Code Issues Releases Wiki Activity
Koha/C4
History
Jonathan Druart 10068dd604 Bug 36520: Prevent SQL injection in GetPreparedLetter 
Actually in _get_tt_params

The following query will delay the response

SELECT `me`.`biblionumber`, `me`.`frameworkcode`, `me`.`author`, `me`.`title`, `me`.`medium`, `me`.`subtitle`, `me`.`part_number`, `me`.`part_name`, `me`.`unititle`, `me`.`notes`, `me`.`serial`, `me`.`seriestitle`
, `me`.`copyrightdate`, `me`.`timestamp`, `me`.`datecreated`, `me`.`abstract`
  FROM `biblio` `me`
WHERE `biblionumber` = '1) AND (SELECT 1 FROM (SELECT(SLEEP(6)))x)-- -'
ORDER BY field( biblionumber, 1 ) AND (
    SELECT 1
      FROM
    SELECT SLEEP( 6 ) x
   ) -- - )

To test
1/ Add some items to your cart in the opac
2/ Choose send cart
3/ Open firefox developer tools and switch to the network tab
4/ Send cart
5/ In the network tab, find the post request and choose copy as curl
6/ Edit the curl command to add )+AND+(SELECT+1+FROM+(SELECT(SLEEP(6)))x)--+-  to the bib_list parameter
7/ Run the curl notice it takes a long time to respond, if you want to check run the curl without the above part added
8/ Apply the patch and restart plack
9/ Run the modified curl and notice no longer the slow down
10/ Test in browser and make sure the basket is still sent

Signed-off-by: Chris Cormack <chris@bigballofwax.co.nz>
Signed-off-by: Victor Grousset/tuxayo <victor@tuxayo.net>

Signed-off-by: Marcel de Rooy <m.de.rooy@rijksmuseum.nl>
Signed-off-by: Lucas Gass <lucas@bywatersolutions.com>
2024-06-07 13:16:28 +00:00
..
AuthoritiesMarc Bug 17600: Standardize our EXPORT_OK 2021-07-16 08:58:47 +02:00
Barcodes Bug 30718: Use flatpickr's altInput 2022-08-19 08:26:31 -03:00
ClassSortRoutine Bug 17600: Standardize our EXPORT_OK 2021-07-16 08:58:47 +02:00
ClassSplitRoutine Bug 28572: Remove C4::Debug 2021-06-22 12:04:32 +02:00
Creators Bug 32222: Fix capitalization in various "id is invalid" 2023-02-07 10:29:35 -03:00
External Bug 17600: Standardize our EXPORT_OK 2021-07-16 08:58:47 +02:00
Form Bug 30318: Don't reset messaging preferences when form is empty 2024-05-28 20:17:51 +00:00
Heading Bug 21828: build $bib_heading_fields only once per invocation 2023-09-22 10:36:33 -10:00
ILSDI Bug 36335: Fix ILS-DI GetRecords bad encoding for UNIMARC 2024-05-30 19:09:36 +00:00
Installer Bug 30731: Remove Readonly::XS::MAGIC_COOKIE 2022-06-01 16:15:26 -03:00
Labels Bug 29697: Replace GetMarcBiblio occurrences with $biblio->metadata->record 2022-07-22 15:24:11 -03:00
Linker Bug 30280: Add support for subject headings from different thesaurus when using Elasticsearch 2022-10-03 10:00:04 -03:00
Members Bug 17600: Standardize our EXPORT_OK 2021-07-16 08:58:47 +02:00
OAI Bug 30308: Fix bulkmarcimport.pl broken by OAI-PMH:AutoUpdateSets(EmbedItemData) 2022-07-29 15:43:39 -03:00
Output Bug 17600: Standardize our EXPORT_OK 2021-07-16 08:58:47 +02:00
Patroncards Bug 34532: Silence warns in Patroncard.pm 2023-09-17 21:35:44 -10:00
Reports Bug 30718: Use flatpickr's altInput 2022-08-19 08:26:31 -03:00
Search Bug 30718: Use flatpickr's altInput 2022-08-19 08:26:31 -03:00
Serials Bug 17600: Standardize our EXPORT_OK 2021-07-16 08:58:47 +02:00
SIP Bug 36676: SIP2 drops connection on unknown patron id in fee paid message 2024-05-30 19:04:12 +00:00
Utils/DataTables Bug 34913: Fix perlcritic for VirtualShelves.pm 2024-03-19 19:19:14 +00:00
Accounts.pm Bug 29184: Fix warn about undefined replacecost 2022-09-08 10:50:30 -07:00
Acquisition.pm Bug 11844: Use additional fields for order lines 2023-05-16 12:58:38 +02:00
Auth.pm Bug 36575: (QA follow-up) Shibboleth POD and checkpw_internal call 2024-06-03 15:10:14 +00:00
Auth_cas_servers.yaml.sample
Auth_with_cas.pm Bug 34893: (QA follow-up) Tidy code for qa script 2024-01-24 17:33:44 +00:00
Auth_with_ldap.pm Bug 36575: (bug 34893 follow-up) Return patron from LDAP 2024-06-03 15:10:14 +00:00
Auth_with_shibboleth.pm Bug 36575: (QA follow-up) Shibboleth POD and checkpw_internal call 2024-06-03 15:10:14 +00:00
AuthoritiesMarc.pm Bug 29522: [alternate] Skip relinking bibliographic records when merging authorities 2024-03-19 21:51:58 +00:00
BackgroundJob.pm Bug 17600: Standardize our EXPORT_OK 2021-07-16 08:58:47 +02:00
Barcodes.pm Bug 17600: Standardize our EXPORT_OK 2021-07-16 08:58:47 +02:00
Biblio.pm Bug 36137: Make update_totalissues cron always skip the holds queue 2024-05-28 21:32:29 +00:00
Breeding.pm Bug 33404: Fix serverhost and init $page 2023-07-17 16:33:29 +01:00
Budgets.pm Bug 27550: "Duplicate budget" does not keep users associated with that budget 2022-09-22 08:18:33 -03:00
Calendar.pm Bug 32048: Added clear cache routine to delete_holiday_range_repeatable 2023-09-18 11:45:38 -10:00
Charset.pm Bug 18984: Remove NORMARC support 2021-10-07 15:36:40 +02:00
Circulation.pm Bug 36313: Fix Undefined subroutine &C4::Circulation::CheckReserves error 2024-05-23 13:55:38 +00:00
ClassSortRoutine.pm Bug 29951: Fix EXPORT for C4::ClassS*Routine modules 2022-07-08 15:29:56 -03:00
ClassSource.pm Bug 29951: Fix EXPORT for C4::ClassS*Routine modules 2022-07-08 15:29:56 -03:00
ClassSplitRoutine.pm Bug 29951: Fix EXPORT for C4::ClassS*Routine modules 2022-07-08 15:29:56 -03:00
Context.pm Bug 36793: Fix case of $var in Context->delete_preference 2024-05-30 19:47:23 +00:00
Contract.pm Bug 17600: Standardize our EXPORT_OK 2021-07-16 08:58:47 +02:00
CourseReserves.pm Bug 30016: Remove GetOpenIssue subroutine 2022-08-31 08:50:37 -03:00
Creators.pm Bug 17600: Standardize our EXPORT_OK 2021-07-16 08:58:47 +02:00
Heading.pm Bug 33557: Add LinkerConsiderThesaurus system preference 2023-05-10 15:26:26 -03:00
HoldsQueue.pm Bug 32565: (follow-up) Tidy 2024-05-28 21:14:39 +00:00
HTML5Media.pm Bug 18984: Remove NORMARC support 2021-10-07 15:36:40 +02:00
ImportBatch.pm Bug 35438: Remove skip_intermediate_commit parameter 2024-02-02 17:47:39 +00:00
ImportExportFramework.pm Bug 13952: (follow-up) JS translatability, clean warns, other 2022-04-04 16:23:46 +02:00
InstallAuth.pm Bug 26019: Koha should set SameSite attribute on cookies 2022-04-13 15:55:38 +02:00
Installer.pm Bug 34174: (bug 33341 follow-up) Fix Ris export 2023-07-17 16:43:20 +01:00
ItemCirculationAlertPreference.pm Bug 29844: Fix ->search occurrences 2022-02-09 15:36:23 -10:00
Items.pm Bug 32029: Automatic item modifications by age add biblio table 2024-03-19 19:50:15 +00:00
Koha.pm Bug 33341: Address some perlcritic errors in 5.36 2023-03-28 14:50:33 +02:00
Labels.pm
Languages.pm Bug 35582: Supress possible warning 2024-05-28 21:08:43 +00:00
Letters.pm Bug 36520: Prevent SQL injection in GetPreparedLetter 2024-06-07 13:16:28 +00:00
Linker.pm Bug 17600: Standardize our EXPORT_OK 2021-07-16 08:58:47 +02:00
Log.pm Bug 32057: (QA follow-up) Remove pretty flag 2023-03-14 08:49:34 -03:00
MarcModificationTemplates.pm Bug 17600: Standardize our EXPORT_OK 2021-07-16 08:58:47 +02:00
Matcher.pm Bug 26611: Make authority record matching use required match checks 2023-05-24 11:21:31 -03:00
Members.pm Bug 33937: Remove incorrect export in C4::Members 2023-07-12 08:07:53 +01:00
Message.pm Bug 18398: (follow-up) Update POD & Unit tests 2023-03-31 13:13:35 +02:00
Output.pm Bug 30524: Core CSRF checking code 2023-07-28 09:12:39 -10:00
Overdues.pm Bug 34279: Don't enforce overduefinescap unless it is greater than 0 2023-08-07 20:05:46 -10:00
Patroncards.pm Bug 17600: Standardize our EXPORT_OK 2021-07-16 08:58:47 +02:00
Record.pm Bug 35588: Scope authorised value desc lookup according to field/subfield 2024-01-12 22:05:02 +00:00
Reports.pm Bug 17600: Standardize our EXPORT_OK 2021-07-16 08:58:47 +02:00
Reserves.pm Bug 34972: Remove GetOtherReserves 2024-05-23 14:13:19 +00:00
Ris.pm Bug 34174: (bug 33341 follow-up) Fix Ris export 2023-07-17 16:43:20 +01:00
RotatingCollections.pm Bug 31735: Avoid re-fetcing objects from database by passing them directly instead of ids to various subroutines 2023-05-12 12:40:21 -03:00
Scheduler.pm Bug 17600: Standardize our EXPORT_OK 2021-07-16 08:58:47 +02:00
Scrubber.pm Bug 36328: (QA follow-up) Expand tests and reorder elements to clarify differences 2024-05-01 15:17:00 +00:00
Search.pm Bug 33725: (follow-up) Add ccode to grouping logic 2023-06-09 16:05:10 -03:00
Serials.pm Bug 36939: Remove a warning from Serials.t 2024-05-31 15:37:11 +00:00
Service.pm Bug 17600: Standardize our EXPORT_OK 2021-07-16 08:58:47 +02:00
ShelfBrowser.pm Bug 29697: Replace GetMarcBiblio occurrences with $biblio->metadata->record 2022-07-22 15:24:11 -03:00
SMS.pm
SocialData.pm Bug 17600: Standardize our EXPORT_OK 2021-07-16 08:58:47 +02:00
Stats.pm Bug 30928: Add interface to statistics 2023-05-10 14:19:22 -03:00
Suggestions.pm Bug 33236: (follow-up) Remove export of NewSuggestion 2023-06-09 12:04:47 -03:00
Tags.pm Bug 31517: (QA follow-up) Fix indentation 2022-11-04 19:30:56 -03:00
Templates.pm Bug 35070: Tidy 2024-01-12 22:16:25 +00:00
TmplToken.pm
TmplTokenType.pm Bug 17600: Standardize our EXPORT_OK 2021-07-16 08:58:47 +02:00
TTParser.pm
UsageStats.pm Bug 33961: Remove built-in offline circ tool 2023-07-17 08:18:59 +01:00
XISBN.pm Bug 30813: (QA follow-up) Adjust three use statements 2022-06-08 11:40:32 -03:00
XSLT.pm Bug 33567: Remove hardcoded fallback in module 2023-05-12 11:22:42 -03:00