Wavyzz/dolibarr
2
0
Fork 1
mirror of https://github.com/Dolibarr/dolibarr.git synced 2026-01-08 18:12:53 +01:00
Code Issues Packages Projects Releases Wiki Activity

Fix protect use of sanitize to make sql injection

Browse Source
This commit is contained in:
ldestailleur
2025-03-06 03:29:54 +01:00
parent ca9763afc1
commit caead5de9f
5 changed files with 51 additions and 9 deletions
Download Patch File Download Diff File Expand all files Collapse all files

31
test/phpunit/FunctionsLibTest.php
View File

@@ -1925,13 +1925,36 @@ class FunctionsLibTest extends CommonClassTest
*/
public function testNaturalSearch()
{
global $db;
$s = natural_search("t.field", "abc def");
$this->assertEquals($s, " AND (t.field LIKE '%abc%' AND t.field LIKE '%def%')");
$this->assertEquals(" AND (t.field LIKE '%abc%' AND t.field LIKE '%def%')", $s);
$s = natural_search("t.field", "'abc def' ghi");
$this->assertEquals($s, " AND (t.field LIKE '%abc def%' AND t.field LIKE '%ghi%')");
$this->assertEquals(" AND (t.field LIKE '%abc def%' AND t.field LIKE '%ghi%')", $s);
$s = natural_search("t.field", "abc def,ghi", 3);
$this->assertEquals($s, " AND (t.field IN ('abc def','ghi'))");
$s = natural_search("t.field", "abc def,ghi", 3); // mode 3 is to provide a list of string separated with coma
$this->assertEquals(" AND (t.field IN ('abc def','ghi'))", $s);
$s = natural_search("t.field", "'ab\'c' def','ghi', 'jkl'", 3); // mode 3 is to provide a list of string separated with coma
$this->assertEquals(" AND (t.field IN ('abc def','ghi','jkl'))", $s);
$s = natural_search("t.field", "a,b", 3); // mode 3 is to provide a list of string separated with coma
$this->assertEquals(" AND (t.field IN ('a','b'))", $s);
$s = natural_search("t.field", "A'@%B", 3); // mode 3 is to provide a list of string separated with coma
$this->assertEquals(" AND (t.field IN ('AB'))", $s);
/*
$s = $db->sanitize("a,b", 1);
var_dump($s);
$s = $db->sanitize("'a',b", 1);
var_dump($s);
$s = $db->sanitize("'a'b',c", 1);
var_dump($s);
*/
//$s = natural_search("t.field", "KØB", 3); // mode 3 is to provide a list of string separated with coma
//$this->assertEquals(" AND (t.field IN ('KØB'))", $s);
}
}