]> git.koha-community.org Git - koha.git/commit
Bug 27715: Sanitize order by DT params
authorJonathan Druart <jonathan.druart@bugs.koha-community.org>
Thu, 18 Feb 2021 14:49:40 +0000 (15:49 +0100)
committerVictor Grousset/tuxayo <victor@tuxayo.net>
Tue, 23 Feb 2021 21:32:52 +0000 (22:32 +0100)
commitcdb6eb0f848b1d242d810e8857aebf1ebc94ea90
treed9de89fce7d2238347aab4c8799824c9867d3b3a
parent82180902d840f0055e0c96ab34e58ba4e03b1f6d
Bug 27715: Sanitize order by DT params

We are not on the safe side when we build the ORDER BY clause from the
DataTables parameters.

I've started to limit the columns by using Koha::Objects->columns, but
for instance for the patron search we need (at least) the columns from
the branches, categories and members tables.
It seems easier, and still safe, to use a regex.

Signed-off-by: Martin Renvoize <martin.renvoize@ptfs-europe.com>
Signed-off-by: Joonas Kylmälä <joonas.kylmala@helsinki.fi>
Signed-off-by: Marcel de Rooy <m.de.rooy@rijksmuseum.nl>
Signed-off-by: Victor Grousset/tuxayo <victor@tuxayo.net>
C4/Utils/DataTables.pm