Fix sort_by not being filtered in search form

[noobpk]

Check sort_by value before query

Check the sort_by value in the request with the default table before entering the query.
Fix bug Time-Based Blind SQL Injection

• Disclosure: https://huntr.dev/bounties/668789af-8781-461c-99bb-d159e5a1d877/

[glensc]

rebased, added changelog myself. enabled auto merge

ps: fixed "Disclosure" typo in your commit message.

[glensc]

Damn, the PR is buggy. should have tested it locally.

Notice: Undefined variable: default_sort_by_options in eventum-3.10.7-18-g9b1e14f15/lib/eventum/class.search.php on line 377

Warning: in_array() expects parameter 2 to be array, null given in eventum-3.10.7-18-g9b1e14f15/lib/eventum/class.search.php on line 377

[glensc]

However, the $sort_by was previously escaped by DB_Helper::escapeString():

• https://github.com/eventum/eventum/blob/v3.10.7/lib/eventum/class.search.php#L367-L372

are you saying the method is not escaping properly?

[glensc]

Also, this fix completely disables searching by custom fields:

• https://github.com/eventum/eventum/blob/v3.10.7/lib/eventum/class.search.php#L369

[glensc]

And resetting the $sort_by = '' will totally crash the application with 500 error because then the SQL is built with order column but not value:

ORDER BY desc, iss_id DESC

• https://github.com/eventum/eventum/blob/v3.10.7/lib/eventum/class.search.php#L378

[glensc]

@noobpk where or how did you obtain what to fill as $sort_by whitelisted values?

[glensc]

ok. there's dropdown for sort_by, let's go with that:

<label>Sort By<br />
  | <select name="sort_by">
  | <option value="last_action_date" >Last Action Date</option>
  | <option value="pri_rank" >Priority</option>
  | <option value="iss_id" >Issue ID</option>
  | <option value="sta_rank" >Status</option>
  | <option value="iss_summary" >Summary</option>
  | </select>
  | </label>

[glensc]

New fix:

• Fix invalid input for advanced search sort_by #1255

so far the injected SQL is not appearing in the query log.

[noobpk]

Damn, the PR is buggy. should have tested it locally.

Notice: Undefined variable: default_sort_by_options in eventum-3.10.7-18-g9b1e14f15/lib/eventum/class.search.php on line 377

Warning: in_array() expects parameter 2 to be array, null given in eventum-3.10.7-18-g9b1e14f15/lib/eventum/class.search.php on line 377

ops!! sorry about that. my mistake :((

[glensc]

ops!! sorry about that. my mistake :((

well. the whole thing was untested. see other notes as well. had to re-do the whole fix