Bug 322734: sanitize sort order input

r=timeless
This commit is contained in:
justdave%bugzilla.org 2006-01-09 02:25:47 +00:00
Родитель 95aafef07d
Коммит 51097effbd
1 изменённых файлов: 18 добавлений и 10 удалений

Просмотреть файл

@ -527,17 +527,7 @@ sub ListSomething {
} }
} }
print h1("List of $tablename"); print h1("List of $tablename");
my $sortorder = $defaultsortorder;
if (defined $F::sortorder) {
# XXX this *absolutely* needs sanitization
# sort order is going to be a list of column names
# comma separated list of things that match stuff in the select part
# may or may not have " asc" or " desc" on the end of it
$sortorder = $F::sortorder;
}
my $query = $::db->prepare("SHOW COLUMNS FROM $tablename"); my $query = $::db->prepare("SHOW COLUMNS FROM $tablename");
$query->execute(); $query->execute();
my @allcols = (); my @allcols = ();
@ -546,6 +536,24 @@ sub ListSomething {
push(@allcols, $row[0]); push(@allcols, $row[0]);
} }
my $sortorder = $defaultsortorder;
if (defined $F::sortorder) {
$sortorder = $F::sortorder;
my @sortorder = ();
my @passedsortorder = split(",",$sortorder);
foreach my $column (@passedsortorder) {
my $dir = "";
if ($column =~ m/(\S+)( ASC| DESC)$/i) {
($column, $dir) = ($1, $2);
}
if (!grep {$column eq $_} @allcols) {
die "Invalid sort order passed";
}
push @sortorder, $column.$dir;
}
$sortorder = join(",",@sortorder);
}
my $hiddencols = ""; my $hiddencols = "";
if (defined @F::showcolumns) { if (defined @F::showcolumns) {
@cols = @F::showcolumns; @cols = @F::showcolumns;