Magic-Mirror/gecko-dev
1
0
Fork 0
mirror of https://github.com/mozilla/gecko-dev.git synced 2025-01-19 17:38:36 +00:00
Code Issues Actions Packages Projects Releases Wiki Activity

Bug 322734: sanitize sort order input

Browse Source 
r=timeless
This commit is contained in:
justdave%bugzilla.org 2006-01-09 02:25:47 +00:00
parent 95aafef07d
commit 51097effbd
1 changed files with 18 additions and 10 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

28
webtools/despot/despot.cgi
View File

@ -527,17 +527,7 @@ sub ListSomething {
}
}
print h1("List of $tablename");
my $sortorder = $defaultsortorder;
if (defined $F::sortorder) {
# XXX this *absolutely* needs sanitization
# sort order is going to be a list of column names
# comma separated list of things that match stuff in the select part
# may or may not have " asc" or " desc" on the end of it
$sortorder = $F::sortorder;
}
my $query = $::db->prepare("SHOW COLUMNS FROM $tablename");
$query->execute();
my @allcols = ();
@ -546,6 +536,24 @@ sub ListSomething {
push(@allcols, $row[0]);
}
my $sortorder = $defaultsortorder;
if (defined $F::sortorder) {
$sortorder = $F::sortorder;
my @sortorder = ();
my @passedsortorder = split(",",$sortorder);
foreach my $column (@passedsortorder) {
my $dir = "";
if ($column =~ m/(\S+)( ASC| DESC)$/i) {
($column, $dir) = ($1, $2);
}
if (!grep {$column eq $_} @allcols) {
die "Invalid sort order passed";
}
push @sortorder, $column.$dir;
}
$sortorder = join(",",@sortorder);
}
my $hiddencols = "";
if (defined @F::showcolumns) {
@cols = @F::showcolumns;