Uploaded image for project: 'CiviCRM'
  1. CiviCRM
  2. CRM-19641

French custom_group title can cause SQL error in CiviCase

    Details

    • Type: Bug
    • Status: Done/Fixed
    • Priority: Trivial
    • Resolution: Fixed/Completed
    • Affects Version/s: 4.6.23, 4.7.13
    • Fix Version/s: 4.6.24, 4.7.14
    • Component/s: None
    • Security Level: Security - Published
    • Labels:
      None
    • Versioning Impact:
      Patch (backwards-compatible bug fixes)
    • Documentation Required?:
      None
    • Funding Source:
      Contributed Code
    • Verified?:
      No

      Description

      How to reproduce:

      • create a custom group for Activities, with title: L'activité
      • add a field in that group
      • in a Case, add an activity, enter a value in that custom field (shouldn't be necessary, but that's what I tested)
      • in the Case list of Activities (at the bottom of the screen), click on the "view" link for that activity (it opens a popup to view the activity).

      The popup will cause a network error, because of an SQL error.

      This is a potential security issue, but the attacker needs full admin permissions to manage custom fields (it could affect a SaaS provider, for example).

        Attachments

          Activity

            People

            • Assignee:
              yashodha Yashodha Chaku
              Reporter:
              mlutfy Mathieu Lutfy
            • Votes:
              0 Vote for this issue
              Watchers:
              3 Start watching this issue

              Dates

              • Created:
                Updated:
                Resolved: