[Bug 39259] New: SQL reports should allow Common Table Expressions
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=39259 Bug ID: 39259 Summary: SQL reports should allow Common Table Expressions Change sponsored?: --- Product: Koha Version: Main Hardware: All OS: All Status: NEW Severity: minor Priority: P5 - low Component: Reports Assignee: koha-bugs@lists.koha-community.org Reporter: schodkowy.omegi-0r@icloud.com QA Contact: testopia@bugs.koha-community.org Common table expression in MySQL is a syntax like this: WITH cte1 AS (SELECT a, b FROM table1), cte2 AS (SELECT c, d FROM table2) SELECT b, d FROM cte1 JOIN cte2 WHERE cte1.a = cte2.c; However, in Koha/Koha/Report.pm, there's func is_sql_valid: } elsif ( $sql !~ /^\s*SELECT\b\s*/i ) { push @errors, { queryerr => 'Missing SELECT' }; } It should be changed to SELECT|WITH, otherwise it won't allow these nice queries, instead having you to do an ugly workaround like this: SELECT * FROM ( WITH cte1 AS (SELECT a, b FROM table1), cte2 AS (SELECT c, d FROM table2) SELECT b, d FROM cte1 JOIN cte2 WHERE cte1.a = cte2.c ) AS dt; -- You are receiving this mail because: You are the assignee for the bug. You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=39259 David Cook <dcook@prosentient.com.au> changed: What |Removed |Added ---------------------------------------------------------------------------- CC| |dcook@prosentient.com.au --- Comment #1 from David Cook <dcook@prosentient.com.au> --- I'm not sure that will work because it would allow the following: WITH ... SELECT ... WITH ... UPDATE ... WITH ... DELETE ... -- You are receiving this mail because: You are the assignee for the bug. You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=39259 --- Comment #2 from David Cook <dcook@prosentient.com.au> --- As you noted on Mattermost, I think SQL reports really should have a dedicated read-only user, so that permissions can be managed ultimately by the DB rather than Koha. -- You are receiving this mail because: You are watching all bug changes. You are the assignee for the bug.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=39259 --- Comment #3 from David Cook <dcook@prosentient.com.au> --- Actually, now you've gotten me thinking about ways to try to bypass the system... -- You are receiving this mail because: You are the assignee for the bug. You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=39259 Mathieu Saby <mathsabypro@gmail.com> changed: What |Removed |Added ---------------------------------------------------------------------------- CC| |mathsabypro@gmail.com -- You are receiving this mail because: You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=39259 --- Comment #4 from Mathieu Saby <mathsabypro@gmail.com> --- I have just discover CTE... It would be nice to be able to use them in Koha reports -- You are receiving this mail because: You are watching all bug changes. You are the assignee for the bug.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=39259 --- Comment #5 from David Cook <dcook@prosentient.com.au> --- Reports security really needs an overhaul... -- You are receiving this mail because: You are the assignee for the bug. You are watching all bug changes.
participants (1)
-
bugzilla-daemon@bugs.koha-community.org