Koha-community/Koha
13
7
Fork 0
Code Issues Releases Wiki Activity
Koha/C4
History
Jonathan Druart 167fff1aa8
Bug 36520: Prevent SQL injection in GetPreparedLetter 
Actually in _get_tt_params

The following query will delay the response

SELECT `me`.`biblionumber`, `me`.`frameworkcode`, `me`.`author`, `me`.`title`, `me`.`medium`, `me`.`subtitle`, `me`.`part_number`, `me`.`part_name`, `me`.`unititle`, `me`.`notes`, `me`.`serial`, `me`.`seriestitle`
, `me`.`copyrightdate`, `me`.`timestamp`, `me`.`datecreated`, `me`.`abstract`
  FROM `biblio` `me`
WHERE `biblionumber` = '1) AND (SELECT 1 FROM (SELECT(SLEEP(6)))x)-- -'
ORDER BY field( biblionumber, 1 ) AND (
    SELECT 1
      FROM
    SELECT SLEEP( 6 ) x
   ) -- - )

To test
1/ Add some items to your cart in the opac
2/ Choose send cart
3/ Open firefox developer tools and switch to the network tab
4/ Send cart
5/ In the network tab, find the post request and choose copy as curl
6/ Edit the curl command to add )+AND+(SELECT+1+FROM+(SELECT(SLEEP(6)))x)--+-  to the bib_list parameter
7/ Run the curl notice it takes a long time to respond, if you want to check run the curl without the above part added
8/ Apply the patch and restart plack
9/ Run the modified curl and notice no longer the slow down
10/ Test in browser and make sure the basket is still sent

Signed-off-by: Chris Cormack <chris@bigballofwax.co.nz>
Signed-off-by: Victor Grousset/tuxayo <victor@tuxayo.net>

Signed-off-by: Marcel de Rooy <m.de.rooy@rijksmuseum.nl>
Signed-off-by: Katrin Fischer <katrin.fischer@bsz-bw.de>
2024-06-20 17:55:35 +02:00
..
AuthoritiesMarc Bug 17600: Standardize our EXPORT_OK 2021-07-16 08:58:47 +02:00
Barcodes Bug 30718: Use flatpickr's altInput 2022-08-19 08:26:31 -03:00
ClassSortRoutine Bug 17600: Standardize our EXPORT_OK 2021-07-16 08:58:47 +02:00
ClassSplitRoutine Bug 28572: Remove C4::Debug 2021-06-22 12:04:32 +02:00
Creators Bug 10762: (QA follow-up) Perltidy 2023-10-25 10:35:31 -03:00
External Bug 17600: Standardize our EXPORT_OK 2021-07-16 08:58:47 +02:00
Form Bug 30318: Don't reset messaging preferences when form is empty 2024-04-26 08:52:51 +02:00
Heading Bug 36917: (follow-up) Remove Elasticsearch warnings and tidy 2024-05-24 15:36:42 +02:00
ILSDI Bug 36453: Update old occurrences of effective_BlockExpiredPatronOpacActions 2024-06-11 09:17:18 +01:00
Installer Bug 30731: Remove Readonly::XS::MAGIC_COOKIE 2022-06-01 16:15:26 -03:00
Labels Bug 10762: (QA follow-up) Perltidy 2023-10-25 10:35:31 -03:00
Linker Bug 30280: Add support for subject headings from different thesaurus when using Elasticsearch 2022-10-03 10:00:04 -03:00
Members Bug 33239: Add the ability to run borrowers-force-messaging-defaults.pl only on a specified message name 2023-10-11 10:31:46 -03:00
OAI Bug 30308: Fix bulkmarcimport.pl broken by OAI-PMH:AutoUpdateSets(EmbedItemData) 2022-07-29 15:43:39 -03:00
Output Bug 17600: Standardize our EXPORT_OK 2021-07-16 08:58:47 +02:00
Patroncards Bug 34532: Silence warns in Patroncard.pm 2023-09-15 11:57:08 -03:00
Reports Bug 35907: Tidy execute_query 2024-05-10 16:45:45 +02:00
Search Bug 30718: Use flatpickr's altInput 2022-08-19 08:26:31 -03:00
Serials Bug 17600: Standardize our EXPORT_OK 2021-07-16 08:58:47 +02:00
SIP Bug 36948: (follow-up) Allow IPv[46] in port config 2024-06-11 08:10:01 +01:00
Utils/DataTables Bug 34913: Fix perlcritic for VirtualShelves.pm 2024-01-29 12:24:54 +01:00
Accounts.pm Bug 29184: Fix warn about undefined replacecost 2022-09-08 10:50:30 -07:00
Acquisition.pm Bug 36002: Remove unused subroutine GetParcels 2024-04-30 17:09:43 +02:00
Auth.pm Bug 36575: (QA follow-up) Shibboleth POD and checkpw_internal call 2024-06-20 17:55:34 +02:00
Auth_cas_servers.yaml.sample
Auth_with_cas.pm Bug 34893: (QA follow-up) Tidy code for qa script 2024-02-02 17:31:47 +01:00
Auth_with_ldap.pm Bug 36575: (bug 34893 follow-up) Return patron from LDAP 2024-06-20 17:55:32 +02:00
Auth_with_shibboleth.pm Bug 36575: (QA follow-up) Shibboleth POD and checkpw_internal call 2024-06-20 17:55:34 +02:00
AuthoritiesMarc.pm Bug 35989: (QA follow-up): Fix QA tests 2024-06-06 15:18:43 +01:00
Barcodes.pm Bug 17600: Standardize our EXPORT_OK 2021-07-16 08:58:47 +02:00
Biblio.pm Bug 36137: Make update_totalissues cron always skip the holds queue 2024-05-03 18:02:15 +02:00
Breeding.pm Bug 28166: (QA follow-up) Fix and tidy tests and code 2023-10-23 11:33:50 -03:00
Budgets.pm Bug 31631: Optionally use tax-exclusive values for calculating fund values 2023-10-18 15:41:35 -03:00
Calendar.pm Bug 32048: Added clear cache routine to delete_holiday_range_repeatable 2023-09-18 15:31:50 -03:00
Charset.pm Bug 18984: Remove NORMARC support 2021-10-07 15:36:40 +02:00
Circulation.pm Bug 36453: Update old occurrences of effective_BlockExpiredPatronOpacActions 2024-06-11 09:17:18 +01:00
ClassSortRoutine.pm Bug 29951: Fix EXPORT for C4::ClassS*Routine modules 2022-07-08 15:29:56 -03:00
ClassSource.pm Bug 29951: Fix EXPORT for C4::ClassS*Routine modules 2022-07-08 15:29:56 -03:00
ClassSplitRoutine.pm Bug 29951: Fix EXPORT for C4::ClassS*Routine modules 2022-07-08 15:29:56 -03:00
Context.pm Bug 36367: Set to undef when unsetting 2024-06-14 11:17:18 +01:00
Contract.pm Bug 17600: Standardize our EXPORT_OK 2021-07-16 08:58:47 +02:00
CourseReserves.pm Bug 30016: Remove GetOpenIssue subroutine 2022-08-31 08:50:37 -03:00
Creators.pm Bug 17600: Standardize our EXPORT_OK 2021-07-16 08:58:47 +02:00
Heading.pm Bug 30047: (follow-up) Fix failing tests 2024-05-13 16:24:18 +02:00
HoldsQueue.pm Bug 32565: (follow-up) Tidy 2024-04-30 14:32:07 +02:00
HTML5Media.pm Bug 18984: Remove NORMARC support 2021-10-07 15:36:40 +02:00
ImportBatch.pm Bug 35438: Remove skip_intermediate_commit parameter 2024-01-16 12:06:08 +01:00
ImportExportFramework.pm Bug 13952: (follow-up) JS translatability, clean warns, other 2022-04-04 16:23:46 +02:00
InstallAuth.pm Bug 36367: Remove _new_userenv 2024-06-14 11:17:17 +01:00
Installer.pm Bug 34174: (bug 33341 follow-up) Fix Ris export 2023-07-06 12:24:12 -03:00
ItemCirculationAlertPreference.pm Bug 29844: Fix ->search occurrences 2022-02-09 15:36:23 -10:00
Items.pm Bug 19097: Adjust some GetMarcFromKohaField calls 2024-04-29 09:35:47 +02:00
Koha.pm Bug 36750: Use the same label for Zebra 2024-05-07 17:41:19 +02:00
Labels.pm Bug 21395: Make perlcritic happy 2020-06-29 12:37:02 +02:00
Languages.pm Bug 35582: Supress possible warning 2024-04-29 18:53:13 +02:00
Letters.pm Bug 36520: Prevent SQL injection in GetPreparedLetter 2024-06-20 17:55:35 +02:00
Linker.pm Bug 17600: Standardize our EXPORT_OK 2021-07-16 08:58:47 +02:00
Log.pm Bug 25159: (QA follow-up) Tidy changes 2024-05-02 16:47:44 +02:00
MarcModificationTemplates.pm Bug 17600: Standardize our EXPORT_OK 2021-07-16 08:58:47 +02:00
Matcher.pm Bug 26611: Make authority record matching use required match checks 2023-05-24 11:21:31 -03:00
Members.pm Bug 26170: Add protected status for patrons 2023-11-01 17:23:06 -03:00
Message.pm Bug 18398: (follow-up) Update POD & Unit tests 2023-03-31 13:13:35 +02:00
Output.pm Bug 34478: Remove check_csrf from pl files 2024-03-01 10:56:01 +01:00
Overdues.pm Bug 34279: Don't enforce overduefinescap unless it is greater than 0 2023-07-19 13:00:41 -03:00
Patroncards.pm Bug 17600: Standardize our EXPORT_OK 2021-07-16 08:58:47 +02:00
Record.pm Bug 33431: Make C4::Record use C4::Context->yaml_preference 2024-03-18 11:03:38 +01:00
Reports.pm Bug 17600: Standardize our EXPORT_OK 2021-07-16 08:58:47 +02:00
Reserves.pm Bug 34972: Remove GetOtherReserves 2024-05-07 15:53:42 +02:00
Ris.pm Bug 33431: Fix remaining cases 2024-03-18 11:03:39 +01:00
RotatingCollections.pm Bug 31735: Avoid re-fetcing objects from database by passing them directly instead of ids to various subroutines 2023-05-12 12:40:21 -03:00
Scheduler.pm Bug 17600: Standardize our EXPORT_OK 2021-07-16 08:58:47 +02:00
Scrubber.pm Bug 36328: (QA follow-up) Expand tests and reorder elements to clarify differences 2024-04-22 12:39:20 +02:00
Search.pm Bug 35138: Add the ability to manage ES facets 2024-04-30 12:00:56 +02:00
Serials.pm Bug 36939: Remove a warning from Serials.t 2024-05-24 15:36:47 +02:00
Service.pm Bug 17600: Standardize our EXPORT_OK 2021-07-16 08:58:47 +02:00
ShelfBrowser.pm Bug 29697: Replace GetMarcBiblio occurrences with $biblio->metadata->record 2022-07-22 15:24:11 -03:00
SMS.pm Bug 36051: (QA follow-up): Use yaml_preference 2024-04-12 11:26:12 +02:00
SocialData.pm Bug 33833: Add two FIXMEs to SocialData::get_report 2023-09-05 14:35:35 -03:00
Stats.pm Bug 33608: (QA follow-up) Remove ->insert method 2023-10-25 11:07:59 -03:00
Suggestions.pm Bug 35597: Move modification logging to Koha::Suggestion 2024-06-13 14:08:33 +01:00
Tags.pm Bug 36785: Typo unreconized and bilbio in tags code 2024-05-17 10:36:35 +02:00
Templates.pm Bug 35070: Tidy 2024-01-04 16:51:45 +01:00
TmplToken.pm
TmplTokenType.pm Bug 17600: Standardize our EXPORT_OK 2021-07-16 08:58:47 +02:00
TTParser.pm Bug 26673: Remove #!/usr/bin/env perl from .pm modules too 2020-10-26 00:14:42 +01:00
UsageStats.pm Bug 26176: (QA follow-up) Branch -> Library 2024-05-23 17:51:18 +02:00
XISBN.pm Bug 30813: (QA follow-up) Adjust three use statements 2022-06-08 11:40:32 -03:00
XSLT.pm Bug 33217: Tidy 2023-11-08 17:52:42 -03:00