]> git.koha-community.org Git - koha.git/commit
Bug 27715: Sanitize order by DT params
authorJonathan Druart <jonathan.druart@bugs.koha-community.org>
Thu, 18 Feb 2021 14:49:40 +0000 (15:49 +0100)
committerFridolin Somers <fridolin.somers@biblibre.com>
Tue, 23 Feb 2021 13:35:08 +0000 (14:35 +0100)
commit0d1e5ea69b70292c89f827adaefc286fff8318a7
treebdfcaa7f946d02f30940cee256da73d430eb6d8f
parent55d40c1618b5cba80ca0fcc72cbcec0a49a3513c
Bug 27715: Sanitize order by DT params

We are not on the safe side when we build the ORDER BY clause from the
DataTables parameters.

I've started to limit the columns by using Koha::Objects->columns, but
for instance for the patron search we need (at least) the columns from
the branches, categories and members tables.
It seems easier, and still safe, to use a regex.

Signed-off-by: Martin Renvoize <martin.renvoize@ptfs-europe.com>
Signed-off-by: Joonas Kylmälä <joonas.kylmala@helsinki.fi>
Signed-off-by: Marcel de Rooy <m.de.rooy@rijksmuseum.nl>
Signed-off-by: Fridolin Somers <fridolin.somers@biblibre.com>
C4/Utils/DataTables.pm