fix 11779 SQLReport can run arbitrary queries

docs/changelog/7.x.x.txt

@@ -1,5 +1,6 @@
 7.9.12
  - webgui.org homepage gives 404  (#11778)
+ - fixed #11779: SQLReport can run arbitrary queries
 
 7.9.11
  - fixed #11755: New cart does not update shipping methods correctly

lib/WebGUI/DatabaseLink.pm

@@ -383,6 +383,9 @@ sub queryIsAllowed {
 	my $self  = shift;
 	my $query = shift;
 
+    # Remove all comments before checking validity
+    $query =~ s{/[*].*?[*]/}{}g;
+
     my ($firstWord) = $query =~ /(\w+)/;
     $firstWord = lc $firstWord;
     return isIn($firstWord, split(/\s+/, lc $self->{_databaseLink}{allowedKeywords})) ? 1 : 0;

t/DatabaseLink.t

@@ -156,6 +156,11 @@ my $queries = [
         expect  => 1,
         comment => '... parenthesized',
     },
+    {
+        query   => '/* SELECT */ DELETE FROM users',
+        expect  => 0,
+        comment => 'Initial comment with valid keyword',
+    },
 ];
 
 plan tests => 14