]> git.koha-community.org Git - koha.git/commit
Bug 17901: Fix possible SQL injection in shelf editing
authorJonathan Druart <jonathan.druart@bugs.koha-community.org>
Fri, 13 Jan 2017 16:03:41 +0000 (17:03 +0100)
committerKatrin Fischer <katrin.fischer.83@web.de>
Mon, 30 Jan 2017 14:40:38 +0000 (15:40 +0100)
commitb98f3daaa6c69ca22715313b316b77d8fb390006
tree8d26e35d7e528403834593b0f8a7041f5b713be4
parent5060e0a230173048596be5b4ea9b5890d7bb5585
Bug 17901: Fix possible SQL injection in shelf editing

It has been reported that
/cgi-bin/koha/opac-shelves.pl?op=edit&referer=view&shelfnumber=146&owner=4&shelfname=testX&sortfield=titleaaaaaa\`&category=1

Could lead to SQL injection
Actually it explodes because the generated SQL query is not correctly formated.

However it would be good to limit the possible values for sortfield.

This vulnerability has been reported by MDSec.

Signed-off-by: Mirko Tietgen <mirko@abunchofthings.net>
Signed-off-by: Marcel de Rooy <m.de.rooy@rijksmuseum.nl>
Signed-off-by: Kyle M Hall <kyle@bywatersolutions.com>
(cherry picked from commit 45cffd874c62c7b090390c5fb3c955c31f524608)
Signed-off-by: Katrin Fischer <katrin.fischer.83@web.de>
opac/opac-shelves.pl
virtualshelves/shelves.pl