]> git.evergreen-ils.org Git - Evergreen.git/commit
LP#2023222: prevent open-ils.fielder.$IDLCLASS from invoking function transforms
authorGalen Charlton <gmc@equinoxOLI.org>
Wed, 7 Jun 2023 18:26:16 +0000 (14:26 -0400)
committerGalen Charlton <gmc@equinoxOLI.org>
Thu, 20 Jul 2023 21:44:05 +0000 (17:44 -0400)
commitb8598303a833747eecb63598307d3dd629e6ba76
tree321c2ddc577dc3008de0d094f0b3ddfb88e37c2a
parent3a26a03309ced30903b89cf5481d0993e3e7dc39
LP#2023222: prevent open-ils.fielder.$IDLCLASS from invoking function transforms

This patch adds some argument checking to the family of
open-ils.fielder.$IDLCLASS[.atomic] methods to prevent
JSON query funcion transforms from being invoked. This
is needed to prevent unauthenticated callers from invoking
arbitrary stored procedures.

This is a security patch that closes down a pathway
towards remote, unauthenticated SQL injection attacks.

Signed-off-by: Galen Charlton <gmc@equinoxOLI.org>
Signed-off-by: Jason Stephenson <jason@sigio.com>
Signed-off-by: Galen Charlton <gmc@equinoxOLI.org>
Open-ILS/src/perlmods/lib/OpenILS/Application/Fielder.pm