]> git.evergreen-ils.org Git - evergreen/pines.git/commit
LP#2023222: prevent open-ils.fielder.$IDLCLASS from invoking function transforms
authorGalen Charlton <gmc@equinoxOLI.org>
Wed, 7 Jun 2023 18:26:16 +0000 (14:26 -0400)
committerChris Sharp <csharp@georgialibraries.org>
Mon, 24 Jul 2023 15:58:57 +0000 (11:58 -0400)
commit790b6e6bd1651f30795a4cdad287b29426a632e0
treee65da29c84352c9590656303882acf6360a8547a
parentcad1d1f15888daf55ed3feb54fed041461e1f7e5
LP#2023222: prevent open-ils.fielder.$IDLCLASS from invoking function transforms

This patch adds some argument checking to the family of
open-ils.fielder.$IDLCLASS[.atomic] methods to prevent
JSON query funcion transforms from being invoked. This
is needed to prevent unauthenticated callers from invoking
arbitrary stored procedures.

This is a security patch that closes down a pathway
towards remote, unauthenticated SQL injection attacks.

Signed-off-by: Galen Charlton <gmc@equinoxOLI.org>
Signed-off-by: Jason Stephenson <jason@sigio.com>
Signed-off-by: Galen Charlton <gmc@equinoxOLI.org>
Open-ILS/src/perlmods/lib/OpenILS/Application/Fielder.pm