5 Commits

Include renames

Author	SHA1	Message	Date
dc	d494606ebd	fix: validate request inputs and add admin gates to public services ... Security fixes for the input-validation gaps in the public download and metadata services, plus missing in-code admin gates: - mpe_accesscheck: validate base_table (LIBDS) and access_level before they reach the authorisation query, and escape embedded quotes in the SQL literals (defence in depth for direct macro callers) - getrawdata: validate table (LIBDS / format-catalog form), filter (integer) and type before they are used; read all inputs with symget in a data step so macro content cannot execute at a resolution boundary - getdiffs: validate libds, table and stp_diffs_csv before the access check and the staging-file stream path - getcols, getcolvals, validatefilter: read the IWANT inputs with symget in a data step and validate (LIBDS / SAS name) before use - admin dirlist, refreshlibs, refreshcatalog, exportconfig: require membership of the DC administrators group (the admin folder prefix is not an access control) - admin dirlist: read parent with symget and reject macro characters Tests (all proven RED on the vulnerable services first, then GREEN on the fix): getrawdata.test.1, getdiffs.test, getcols.test, getcolvals.test.4, validatefilter.test.1, dirlist.test, refreshcatalog.test.1	2026-09-21 16:06:59 +00:00
allan	b0fc3eb5af	chore: update comment	2026-03-31 17:09:17 +01:00
allan	d9980e866d	fix: quote CSV char values. Closes #215	2026-03-31 17:04:46 +01:00
allan	f6d7d6f90c	fix: export unregistered formats ... Closes #158	2025-06-10 09:41:18 +01:00
Mihajlo Medjedovic	f268de21a3	init	2023-07-13 13:44:05 +02:00