oqapi/webgui
2
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

fix 11779 SQLReport can run arbitrary queries

Browse source
This commit is contained in:
Doug Bell 2010-08-11 14:48:38 -05:00
parent 02121fb7a9
commit 0957759fa9
3 changed files with 9 additions and 0 deletions
Download patch file Download diff file Expand all files Collapse all files

3
lib/WebGUI/DatabaseLink.pm
View file

@ -383,6 +383,9 @@ sub queryIsAllowed {
my $self = shift;
my $query = shift;
# Remove all comments before checking validity
$query =~ s{/[*].*?[*]/}{}g;
my ($firstWord) = $query =~ /(\w+)/;
$firstWord = lc $firstWord;
return isIn($firstWord, split(/\s+/, lc $self->{_databaseLink}{allowedKeywords})) ? 1 : 0;