View | Details | Raw Unified | Return to bug 37146
Collapse All | Expand All

(-)a/Koha/FrameworkPlugin.pm (-1 / +10 lines)
Lines 111-116 Koha::FrameworkPlugin - Facilitate use of plugins in MARC/items editor Link Here
111
=cut
111
=cut
112
112
113
use Modern::Perl;
113
use Modern::Perl;
114
use Cwd qw//;
114
115
115
use base qw(Class::Accessor);
116
use base qw(Class::Accessor);
116
117
Lines 213-219 sub _load { Link Here
213
    my ( $rv, $file );
214
    my ( $rv, $file );
214
    return $self->_error( 'Plugin needs a name' ) if !$self->{name}; #2chk
215
    return $self->_error( 'Plugin needs a name' ) if !$self->{name}; #2chk
215
    $self->{path} //= _valuebuilderpath();
216
    $self->{path} //= _valuebuilderpath();
217
    #NOTE: Resolve symlinks and relative path components if present,
218
    #so the base will compare correctly lower down
219
    my $abs_base_path = Cwd::abs_path( $self->{path} );
216
    $file= $self->{path}. '/'. $self->{name};
220
    $file= $self->{path}. '/'. $self->{name};
221
    #NOTE: Resolve relative path components to prevent loading files outside the base path
222
    my $abs_file_path = Cwd::abs_path($file);
223
    if ( $abs_file_path !~ /^\Q$abs_base_path\E/ ) {
224
        warn "Attempt to load $file ($abs_file_path) in framework plugin!";
225
        return $self->_error('File not found');
226
    }
217
    return $self->_error( 'File not found' ) if !-e $file;
227
    return $self->_error( 'File not found' ) if !-e $file;
218
228
219
    # undefine oldschool subroutines before defining them again
229
    # undefine oldschool subroutines before defining them again
220
- 

Return to bug 37146