]> git.koha-community.org Git - koha.git/commit
Bug 27715: Use $dbh->quote_identifier to quote untrusted input
authorJoonas Kylmälä <joonas.kylmala@helsinki.fi>
Fri, 19 Feb 2021 12:18:15 +0000 (14:18 +0200)
committerFridolin Somers <fridolin.somers@biblibre.com>
Tue, 23 Feb 2021 13:35:08 +0000 (14:35 +0100)
commit9a03861c8fc67f11c72dd78f17abcbe58cf1740e
tree683683370a4578bf0d6511b4999a4e7ca5099faa
parente741e6c83bf205252db7e4114951ca25ab5f6567
Bug 27715: Use $dbh->quote_identifier to quote untrusted input

The sanitization using regex and \w class of characters might be
enough but given the vast number of unicode characters in \w and
possibility of in the future the database engines interpreting some of
those characters with special meaning it is better to wrap the column
identifier to quotes using $dbh->quote_identifier so it is only
interpreted as identifier and nothing else.

Signed-off-by: Martin Renvoize <martin.renvoize@ptfs-europe.com>
Signed-off-by: Marcel de Rooy <m.de.rooy@rijksmuseum.nl>
Signed-off-by: Fridolin Somers <fridolin.somers@biblibre.com>
C4/Utils/DataTables.pm
t/db_dependent/Utils/Datatables.t