|
Lines 111-116
Koha::FrameworkPlugin - Facilitate use of plugins in MARC/items editor
Link Here
|
| 111 |
=cut |
111 |
=cut |
| 112 |
|
112 |
|
| 113 |
use Modern::Perl; |
113 |
use Modern::Perl; |
|
|
114 |
use Cwd qw//; |
| 114 |
|
115 |
|
| 115 |
use base qw(Class::Accessor); |
116 |
use base qw(Class::Accessor); |
| 116 |
|
117 |
|
|
Lines 213-219
sub _load {
Link Here
|
| 213 |
my ( $rv, $file ); |
214 |
my ( $rv, $file ); |
| 214 |
return $self->_error( 'Plugin needs a name' ) if !$self->{name}; #2chk |
215 |
return $self->_error( 'Plugin needs a name' ) if !$self->{name}; #2chk |
| 215 |
$self->{path} //= _valuebuilderpath(); |
216 |
$self->{path} //= _valuebuilderpath(); |
|
|
217 |
#NOTE: Resolve symlinks and relative path components if present, |
| 218 |
#so the base will compare correctly lower down |
| 219 |
my $abs_base_path = Cwd::abs_path( $self->{path} ); |
| 216 |
$file= $self->{path}. '/'. $self->{name}; |
220 |
$file= $self->{path}. '/'. $self->{name}; |
|
|
221 |
#NOTE: Resolve relative path components to prevent loading files outside the base path |
| 222 |
my $abs_file_path = Cwd::abs_path($file); |
| 223 |
if ( $abs_file_path !~ /^\Q$abs_base_path\E/ ) { |
| 224 |
warn "Attempt to load $file ($abs_file_path) in framework plugin!"; |
| 225 |
return $self->_error('File not found'); |
| 226 |
} |
| 217 |
return $self->_error( 'File not found' ) if !-e $file; |
227 |
return $self->_error( 'File not found' ) if !-e $file; |
| 218 |
|
228 |
|
| 219 |
# undefine oldschool subroutines before defining them again |
229 |
# undefine oldschool subroutines before defining them again |
| 220 |
- |
|
|