Jonathan Druart a70980d825 Bug 17900: Fix possible SQL injection in patron cards template editing ... To recreate: /cgi-bin/koha/patroncards/edit-template.pl?op=edit&element_id=23%20and%201%3d2+union+all+select+1,user(),@@version+--%20 Look at the Profile dropdown list. To fix this problem and to make sure it does not appears anywhere else in the label and patroncards modules, I have refactored the way the queries are built in C4::Creators::Lib Now all of the subroutine takes a hashref in parameters with a 'fields' and 'filters' parameters. From these 2 parameters the new internal subroutine _build_query will build the query and use placeholders. Test plan: 1/ Make sure you do not recreate the vulnerability with this patch applied. 2/ With decent data in the labels and patroncards modules, compare all the different view (undef the New and Manage button groups) with and without this patch applied. => You should not see any differences. This vulnerability has been reported by MDSec. Signed-off-by: Chris Cormack <chris@bigballofwax.co.nz> Signed-off-by: Marcel de Rooy <m.de.rooy@rijksmuseum.nl> Signed-off-by: Kyle M Hall <kyle@bywatersolutions.com>		2017-01-30 11:19:55 +00:00
..
Acquisition	Bug 14778: Remove t/Acquisition/Invoices.t	2015-10-23 12:01:19 -03:00
Biblio	Bug 17641: Fix t/Biblio/Isbd.t	2016-11-16 14:02:30 +00:00
Budgets
Circulation	Bug 17557: Koha::Patrons - Move GetAge to ->set_age (and remove SetAge)	2016-12-16 11:57:38 +00:00
db_dependent	Bug 17900: Fix possible SQL injection in patron cards template editing	2017-01-30 11:19:55 +00:00
edi_testfiles	Bug 7736: Support Ordering via Edifact EDI messages	2016-04-01 20:03:17 +00:00
External	Bug 16636 [QA Followup] - Move tests to t/External	2016-06-10 18:02:14 +00:00
Koha	Bug 17302: [Follow-up] Make Normalize.pm undef-resistent	2016-09-25 14:04:54 +00:00
lib	Bug 17726: biblioitems.marc has been removed	2017-01-20 13:43:18 +00:00
Members	Bug 15690: Hardcoded 16 is uncool	2016-11-14 11:28:43 +00:00
Number	Bug 16768: Add tests for Swiss number format	2016-06-24 14:00:03 +00:00
Search
Serials	Bug 16289: Refactore code and add tests	2016-06-10 18:09:48 +00:00
SIP	Bug 15006: Centralize timeout logic and allow zero client timeout	2016-07-15 14:11:05 +00:00
00-checkdatabase-version.t
00-deprecated.t
00-load.t	Bug 17372: Standardize Elasticsearch paths	2016-10-11 01:07:03 +00:00
00-merge-conflict-markers.t
00-testcritic.t	Bug 15258: Prevent unused declared variables	2015-12-30 17:24:30 -07:00
00-valid-xml.t	Bug 16608 - Add xsd extension to t/00-valid-xml.t	2016-06-10 17:40:55 +00:00
Auth_with_shibboleth.t	Bug 17681: Exiisting typos might thow some feees when recieved	2016-12-16 11:29:33 +00:00
AuthoritiesMarc_MARC21.t
AuthoritiesMarc_UNIMARC.t
AuthUtils.t
Barcodes_annual.t
Barcodes_EAN13.t
Barcodes_hbyymmincr.t
Barcodes_incremental.t
Biblio.t	Bug 16169: Change prototype for C4::Biblio::TransformMarcToKoha	2016-04-07 00:04:21 +00:00
Biblio2.t	Bug 16556 - KohaToMarcMapped columns sharing same field with biblio(item)number are removed.	2016-09-15 13:42:35 +00:00
Bookseller.t
Boolean.t
Breeding.t
Budgets.t
Cache.t	Bug 16769: Uniformise calls to Koha::Cache->set_in_cache	2016-10-10 17:03:54 +00:00
Calendar.t	Bug 17189: Replace occurrences of 'use Koha::Cache'	2016-09-08 10:24:47 +00:00
Charset.t
Circulation_barcodedecode.t	Bug 15151: Avoid DB access to load C4::Members	2015-11-08 13:10:13 -03:00
ClassSortRoutine.t
ClassSortRoutine_Dewey.t
ClassSortRoutine_Generic.t
ClassSortRoutine_LCC.t
ClassSource.t
Context.t	Bug 14751: [QA Follow-up] Unit tests for interface method	2016-03-02 04:21:26 +00:00
Contract.t
Creators.t	Bug 16622: some tests triggered by prove t fail for unset KOHA_CONF	2016-08-05 06:09:58 +00:00
DateUtils.t	Bug 17476: Add a way to bypass dt_from_string processing time for slow servers	2016-11-07 16:36:05 +00:00
Debug.t
dummy.t
Edifact.t	Bug 7736: Support Ordering via Edifact EDI messages	2016-04-01 20:03:17 +00:00
EdiInvoice.t	Bug 7736: Support Ordering via Edifact EDI messages	2016-04-01 20:03:17 +00:00
Ediorder.t	Bug 7736: Support Ordering via Edifact EDI messages	2016-04-01 20:03:17 +00:00
Ediordrsp.t	Bug 7736: Support Ordering via Edifact EDI messages	2016-04-01 20:03:17 +00:00
Form_MessagingPreferences.t
Heading.t
Images.t	Bug 15150: Make t/ tests skip if Test::DBIx::Class absent	2015-11-06 12:25:27 -03:00
ImportBatch.t	Bug 10407: Add two subtests to t/ImportBatch.t	2016-09-02 16:00:13 +00:00
Installer_PerlDependencies.t
Installer_PerlModules.t	Bug 17880 - Add test to check version number comparison	2017-01-20 13:47:26 +00:00
Installer_pm.t
ItemCirculationAlertPreference.t
Koha.t	Bug 14629 - [QA Followup] Pass invalid ISSN through GetVariationsOfISSN	2016-10-28 11:58:14 +00:00
Koha_Email.t
Koha_MetadataRecord.t	Bug 8064: Fix unit tests for createMergeHash	2015-11-09 15:08:57 -03:00
Koha_Template_Plugin_Cache.t
Koha_Template_Plugin_Koha.t
Koha_Util_FrameworkPlugin.t
Koha_Util_MARC.t	Bug 8064: Fix unit tests for createMergeHash	2015-11-09 15:08:57 -03:00
Labels.t
Labels_split_ccn.t
Labels_split_ddcn.t
Labels_split_lccn.t
Languages.t	Bug 16675: fix breakage of t/Languages.t	2016-06-10 17:03:10 +00:00
Letters.t	Bug 15150: Make t/ tests skip if Test::DBIx::Class absent	2015-11-06 12:25:27 -03:00
Log.t
Logger.t
Matcher.t	Bug 17318: Unit tests	2016-10-21 16:16:33 +00:00
Members_Attributes.t	Bug 12267: Remove borrower_attributes.password	2016-04-22 23:08:32 +00:00
Members_AttributeTypes.t	Bug 12267: Remove borrower_attributes.password	2016-04-22 23:08:32 +00:00
Members_Messaging.t
Message.t
NorwegianPatronDB.t
OpenLibrarySearch.t	Bug 16649: Make OpenLibrarySearch test pass even if launches offline	2016-06-10 17:05:03 +00:00
Output.t
Output_JSONStream.t
Overdues.t
Patron.t	Bug 17425 [QA Followup] - Remove superfluous tests	2016-10-21 18:15:50 +00:00
Patroncards.t
Patroncards_Batch.t
Patroncards_Layout.t
Patroncards_Lib.t
Patroncards_Patroncard.t
Patroncards_Profile.t
Patroncards_Template.t
perlcriticrc	Bug 15258: Prevent unused declared variables	2015-12-30 17:24:30 -07:00
Prices.t	Bug 13726: Make Koha::Acq::Bookseller using Koha::Object	2016-12-30 11:54:32 +00:00
Print.t
QueryParser.t
RecordProcessor.t	Bug 15871: Improve PerlCritic level for t/RecordProcessor.t	2016-03-03 22:02:50 +00:00
Ris.t	Bug 16668: Fix t/Ris.t tests	2016-06-10 16:59:20 +00:00
RotatingCollections.t
Scheduler.t
Scrubber.t
Search.t
Search_PazPar2.t
SimpleMARC.t
smolder_smoke_signal
SMS.t
SocialData.t	Bug 15150: Make t/ tests skip if Test::DBIx::Class absent	2015-11-06 12:25:27 -03:00
Stats.t
SuggestionEngine.t
SuggestionEngine_AuthorityFile.t
TmplToken.t
Token.t	Bug 17110: Add unit test for MaxAge parameter in Token.t	2016-09-09 13:40:41 +00:00
XSLT.t