View | Details | Raw Unified | Return to bug 14408
Collapse All | Expand All

(-)a/C4/Auth.pm (-2 / +2 lines)
Lines 157-164 sub get_template_and_user { Link Here
157
    my ( $user, $cookie, $sessionID, $flags );
157
    my ( $user, $cookie, $sessionID, $flags );
158
158
159
    C4::Context->interface( $in->{type} );
159
    C4::Context->interface( $in->{type} );
160
    
160
161
    my $safe_chars = 'a-zA-Z_\-\/';
161
    my $safe_chars = 'a-zA-Z0-9_\-\/';
162
    die "bad template path" unless $in->{'template_name'} =~ m/^[$safe_chars]+.tt?$/ig; #sanitize input
162
    die "bad template path" unless $in->{'template_name'} =~ m/^[$safe_chars]+.tt?$/ig; #sanitize input
163
163
164
    $in->{'authnotrequired'} ||= 0;
164
    $in->{'authnotrequired'} ||= 0;
(-)a/t/db_dependent/Auth.t (-2 / +12 lines)
Lines 8-14 use Modern::Perl; Link Here
8
use CGI qw ( -utf8 );
8
use CGI qw ( -utf8 );
9
use Test::MockModule;
9
use Test::MockModule;
10
use List::MoreUtils qw/all any none/;
10
use List::MoreUtils qw/all any none/;
11
use Test::More tests => 11;
11
use Test::More tests => 12;
12
use Test::Warn;
12
use Test::Warn;
13
use C4::Members;
13
use C4::Members;
14
use Koha::AuthUtils qw/hash_password/;
14
use Koha::AuthUtils qw/hash_password/;
Lines 127-132 $dbh->{RaiseError} = 1; Link Here
127
        };
127
        };
128
        like ( $@, qr(^bad template path), 'The file $template_name should not be accessible' );
128
        like ( $@, qr(^bad template path), 'The file $template_name should not be accessible' );
129
    }
129
    }
130
    ( $template, $loggedinuser, $cookies ) = get_template_and_user(
131
        {
132
            template_name   => 'errors/500.tt',
133
            query           => $query,
134
            type            => "intranet",
135
            authnotrequired => 1,
136
            flagsrequired   => { catalogue => 1 },
137
        }
138
    );
139
    my $file_exists = ( -f $template->{filename} ) ? 1 : 0;
140
    is ( $file_exists, 1, 'The file errors/500.tt should be accessible (contains integers)' );
130
}
141
}
131
142
132
# Check that there is always an OPACBaseURL set.
143
# Check that there is always an OPACBaseURL set.
133
- 

Return to bug 14408