[Koha-bugs] [Bug 7955] Statistics tab in patron module

[bugzilla-daemon at bugs.koha-community.org]

http://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=7955

Paul Poulain <paul.poulain at biblibre.com> changed:

           What    |Removed                     |Added
----------------------------------------------------------------------------
             Status|Signed Off                  |Failed QA

--- Comment #24 from Paul Poulain <paul.poulain at biblibre.com> ---
QA comment (and some discussion with joubu)

(In reply to comment #9)
> construct_query: This routine is not very clear. Note also that you do not
> check the contents of the pref: column whatever can be put into the pref and
> will just be copied over. So it is somehwat error sensitive (not even
> talking about security issues).

Anyone who can set systempreferences can completely break Koha anyway. So I
don't think it's a necessity to add some sanity check.
The way the follow-up patch is made look quite ugly to me, it would be better
to check if we've only letters, numbers, - and _ as column names.

And, imo, we don't need any check at all in fact. Marcel, your opinion on that
?

-- 
You are receiving this mail because:
You are watching all bug changes.