TribeHR/ad_hoc_reporting — pull request #13 by ianring (2013-07-03 20:20:11+00:00)
Title: sanitize logical operator

Experimentally, I found that if the operator in a Cake find() condition is not a valid logical operator (like "OMFG" instead of "OR"), Cake uses it as a column name in the WHERE clause.
I expected that this would be a classic SQL injection hole. But it appears that Cake actually does some sanitation on the string... I couldn't break the SQL query using the typical injection tricks like "'; SHOW tables" or "' OR 1=1" etc.

So. While this isn't strictly a SQL injection vulnerability, it is an opportunity where someone fiddling with the form contents could produce a SQL error. To wit, putting "OMFG" into the form caused a "Column not found" error.

This PR simply constrains the value to "AND" or "OR".

Ternary operator does a nice job on this. If there were > 2 possibilities, I would have reached for a switch/case instead.