Mailing List Archive

lookup_query in table editor
Hello All

I have a lookup query that I am trying to add into table-editor
here is my query:
[perl tables=products interpolate=1]
my ($ary,$index_hash,$name_ary) = $Db{product_codes}->query("SELECT
distinct category FROM products_codes WHERE owner = '[data session
username]' ORDER BY category ASC");
$Tmp->{category} = {
mv_results => $ary,
mv_field_names => $name_ary,
};
return;
[/perl][loop object=`$Tmp->{category}` prefix=cat]
[cat-code]
[/loop]
I can loop the results as expected with [loop object=`$Tmp->{category}`
prefix=cat]
[cat-code]
[/loop]
But adding the resultant set into table editor I am having issues with
[table-editor
auto_secure=1
form_name=item_editor
mv_data_table=products_code
widget.category=combo
filter.category=nullselect
override.category=|[loop object=`$Tmp->{category}`
prefix=cat][cat-code][/loop]|
override.owner=`$Session->{username}`
hidden.owner=`$Session->{username}`
override.company=`$Values->{company}`
hidden.company=`$Values->{company}`
]

I've even tried using: lookup_query.category=`select distinct category from
products_codes where owner='$Session->{username}'`

If I try lookup_query.category=`select distinct category from
products_codes where owner='bob'`
the list populates

I am on IC 5.12
i am sure the issue is with interpolation but getting the list to show up
correctly I am having a bugger of a time trying fo figure out.

Any direction would be helpful

Thank you


--
J. Scott Andreas
Ph:541-729-6090
email: scott@tildaworks.com
Re: lookup_query in table editor [ In reply to ]
On Mon, 12 Apr 2021, Scott Andreas wrote:

> I've even tried using: lookup_query.category=`select distinct category from
> products_codes where owner='$Session->{username}'`
>
> If I try lookup_query.category=`select distinct category from
> products_codes where owner='bob'`
> the list populates

The `...` quoting style is for Perl code snippets, so shouldn't have
unquoted regular strings and code mixed.

You could try:

lookup_query.category="select distinct category from products_codes where owner='[data session username]'"

If you do that, make sure you can't ever have a valid username with a ' in
it or you'll have an SQL injection vulnerability there.

It shouldn't be vulnerable to direct query or form injection since the
session username is vetted first, but if a user can create a username with
a ' then you've got a problem.

Jon


--
Jon Jensen
End Point Corporation
https://www.endpoint.com/
_______________________________________________
interchange-users mailing list
interchange-users@interchangecommerce.org
https://www.interchangecommerce.org/mailman/listinfo/interchange-users
Re: lookup_query in table editor [ In reply to ]
On 4/13/21 5:28 PM, Jon Jensen wrote:
> On Mon, 12 Apr 2021, Scott Andreas wrote:
>
>> I've even tried using: lookup_query.category=`select distinct category from
>> products_codes where owner='$Session->{username}'`
>>
>> If I try lookup_query.category=`select distinct category from
>> products_codes where owner='bob'`
>> the list populates
>
> The `...` quoting style is for Perl code snippets, so shouldn't have unquoted regular strings and code mixed.
>
> You could try:
>
> lookup_query.category="select distinct category from products_codes where owner='[data session username]'"
>
> If you do that, make sure you can't ever have a valid username with a '
in it or you'll have an SQL injection
> vulnerability there.
>
> It shouldn't be vulnerable to direct query or form injection since the session username is vetted first, but if a user
> can create a username with a ' then you've got a problem.
>
> Jon
>
>

Using table-editor inside a custom usertag is probably less awkward and allows you to add verification of
the parameters.

The basic rule we are using is if you think the ITL is going to hurt, wrap it into an usertag.

Regards
Racke

--
Ecommerce and Linux consulting + Perl and web application programming.
Debian and Sympa administration. Provisioning with Ansible.