http://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=7955 Paul Poulain <paul.poulain@biblibre.com> changed: What |Removed |Added ---------------------------------------------------------------------------- Status|Signed Off |Failed QA --- Comment #24 from Paul Poulain <paul.poulain@biblibre.com> --- QA comment (and some discussion with joubu) (In reply to comment #9)
construct_query: This routine is not very clear. Note also that you do not check the contents of the pref: column whatever can be put into the pref and will just be copied over. So it is somehwat error sensitive (not even talking about security issues).
Anyone who can set systempreferences can completely break Koha anyway. So I don't think it's a necessity to add some sanity check. The way the follow-up patch is made look quite ugly to me, it would be better to check if we've only letters, numbers, - and _ as column names. And, imo, we don't need any check at all in fact. Marcel, your opinion on that ? -- You are receiving this mail because: You are watching all bug changes.