Permalink
This commit does not belong to any branch on this repository, and may belong to a fork outside of the repository.
Browse files
Browse the repository at this point in the history
Bug 14521: SQL injection in local use system preferences
This patch fixes a SQL injection vulnerability in the local use system preferences. _TEST PLAN_ Before applying: 1) Go to Global System Preferences 2) Click on the "Local use" tab 3) Add a new preference with the value "') or '1' = '1' -- " (be sure to include the space at the end after the comment --). 4) When the page refreshes, you should now see about 99 other system preferences which shouldn't be showing up. 5) Apply the patch 6) Refresh the page 7) Note that you now only see a system preference for "') or '1' = '1' -- " and the other actual local use system preferences. Signed-off-by: Chris Cormack <chrisc@catalyst.net.nz> Signed-off-by: Jonathan Druart <jonathan.druart@bugs.koha-community.org> Signed-off-by: Tomas Cohen Arazi <tomascohen@unc.edu.ar> (cherry picked from commit a72262a) Signed-off-by: Chris Cormack <chrisc@catalyst.net.nz> Signed-off-by: Liz Rea <wizzyrea@gmail.com>
- Loading branch information