Attachment #174104 for bug #22223

View | Details | Raw Unified | Return to bug 22223
Collapse All | Expand All




package Koha::Template::Plugin::SafeURL;

# This file is part of Koha.
#
# Koha is free software; you can redistribute it and/or modify it
# under the terms of the GNU General Public License as published by
# the Free Software Foundation; either version 3 of the License, or
# (at your option) any later version.
#
# Koha is distributed in the hope that it will be useful, but
# WITHOUT ANY WARRANTY; without even the implied warranty of
# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
# GNU General Public License for more details.
#
# You should have received a copy of the GNU General Public License
# along with Koha; if not, see <http://www.gnu.org/licenses>.

use Modern::Perl;
use URI;
use base 'Template::Plugin::Filter';

sub init {
    my $self = shift;
    my $name = 'safe_url';
    $self->{_DYNAMIC} = 1;
    $self->install_filter($name);
    return $self;
}

sub filter {
    my ( $self, $text, $args, $config ) = @_;
    my $uri = URI->new($text);
    if ($uri) {
        return $uri;
    }

    #NOTE: If it isn't a real URL, just return a safe fragment
    return '#';
}

1;

=head1 NAME

Koha::Template::Plugin::SafeURL - TT Plugin for filtering whole URLs

=head1 SYNOPSIS

[% USE SafeURL %]

[% $url | safe_url %]

This filter parses the text as a URL and returns the object which
is stringified in a safe format.

=head1 METHODS

=head2 init

This method installs the filter name and declares it as a dynamic filter

=head2 filter

Returns a stringified version of a Perl URL object

=cut




[% USE TablesSettings %]
[% USE AuthorisedValues %]
[% USE KohaPlugins %]
[% USE SafeURL %]
[% SET TagsShowEnabled = ( ( Koha.Preference( 'TagsEnabled' ) == 1 ) && TagsShowOnDetail ) %]
[% SET TagsInputEnabled = ( ( Koha.Preference( 'opacuserlogin' ) == 1 ) && ( Koha.Preference( 'TagsEnabled' ) == 1 ) && TagsInputOnDetail ) %]
[% SET CoverImagePlugins = KohaPlugins.get_plugins_opac_cover_images %]

                                [% IF trackclicks == 'track' || trackclicks == 'anonymous' %]
                                    <a target="[% target_attr | html %]" rel="[% rel_attr | html %]" href="/cgi-bin/koha/tracklinks.pl?uri=[% uri | uri %]&amp;biblionumber=[% biblio.biblionumber | html %]&amp;itemnumber=[% ITEM_RESULT.itemnumber | html %]" property="url">[% uri | html %]</a>
                                [% ELSE %]
                                    <a target="[% target_attr | html %]" rel="[% rel_attr | html %]" href="[% uri | safe_url %]" property="url">[% uri | html %]</a>
                                [% END %]
                            [% END %]
                        [% ELSE %]
                            [% IF trackclicks == 'track' || trackclicks == 'anonymous' %]
                                <a target="[% target_attr | html %]" rel="[% rel_attr | html %]" href="/cgi-bin/koha/tracklinks.pl?uri=[% ITEM_RESULT.uri | uri %]&amp;biblionumber=[% biblio.biblionumber | html %]&amp;itemnumber=[% ITEM_RESULT.itemnumber | html %]" property="url">
                            [% ELSE %]
                                <a target="[% target_attr | html %]" rel="[% rel_attr | html %]" href="[% ITEM_RESULT.uri | safe_url %]" property="url">
                            [% END %]
                                [% IF Koha.Preference('URLLinkText') %][% Koha.Preference('URLLinkText') | html %][% ELSE %]Link to resource[% END %]
                            </a>




#!/usr/bin/perl

# This file is part of Koha.
#
# Koha is free software; you can redistribute it and/or modify it
# under the terms of the GNU General Public License as published by
# the Free Software Foundation; either version 3 of the License, or
# (at your option) any later version.
#
# Koha is distributed in the hope that it will be useful, but
# WITHOUT ANY WARRANTY; without even the implied warranty of
# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
# GNU General Public License for more details.
#
# You should have received a copy of the GNU General Public License
# along with Koha; if not, see <http://www.gnu.org/licenses>.

use Modern::Perl;

use Test::More tests => 2;
use Template;

subtest 'test double-encoding prevention' => sub {
    plan tests => 1;
    my $template = Template->new(
        {
            PLUGIN_BASE => 'Koha::Template::Plugin',
        }
    );

    my $tt = <<EOF;
[%- USE SafeURL %]
[%- 'http://koha-community.org?url=https%3A%2F%2Fkoha-community.org' | safe_url -%]
EOF

    my $output;
    $template->process( \$tt, {}, \$output );
    is( $output, 'http://koha-community.org?url=https%3A%2F%2Fkoha-community.org', 'URL is not double-encoded' );
};

subtest 'double quotes are escaped' => sub {
    plan tests => 1;
    my $template = Template->new(
        {
            PLUGIN_BASE => 'Koha::Template::Plugin',
        }
    );

    my $tt = <<EOF;
[%- USE SafeURL %]
[%- 'http://koha-community.org?url=https%3A%2F%2Fkoha-community.org"' | safe_url -%]
EOF

    my $output;
    $template->process( \$tt, {}, \$output );
    is( $output, 'http://koha-community.org?url=https%3A%2F%2Fkoha-community.org%22', 'double quotes are escaped' );
};

Return to bug 22223

Line 0 Link Here

(-)a/Koha/Template/Plugin/SafeURL.pm (+66 lines)
		1	package Koha::Template::Plugin::SafeURL;
		2
		3	# This file is part of Koha.
		4	#
		5	# Koha is free software; you can redistribute it and/or modify it
		6	# under the terms of the GNU General Public License as published by
		7	# the Free Software Foundation; either version 3 of the License, or
		8	# (at your option) any later version.
		9	#
		10	# Koha is distributed in the hope that it will be useful, but
		11	# WITHOUT ANY WARRANTY; without even the implied warranty of
		12	# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
		13	# GNU General Public License for more details.
		14	#
		15	# You should have received a copy of the GNU General Public License
		16	# along with Koha; if not, see <http://www.gnu.org/licenses>.
		17
		18	use Modern::Perl;
		19	use URI;
		20	use base 'Template::Plugin::Filter';
		21
		22	sub init {
		23	my $self = shift;
		24	my $name = 'safe_url';
		25	$self->{_DYNAMIC} = 1;
		26	$self->install_filter($name);
		27	return $self;
		28	}
		29
		30	sub filter {
		31	my ( $self, $text, $args, $config ) = @_;
		32	my $uri = URI->new($text);
		33	if ($uri) {
		34	return $uri;
		35	}
		36
		37	#NOTE: If it isn't a real URL, just return a safe fragment
		38	return '#';
		39	}
		40
		41	1;
		42
		43	=head1 NAME
		44
		45	Koha::Template::Plugin::SafeURL - TT Plugin for filtering whole URLs
		46
		47	=head1 SYNOPSIS
		48
		49	[% USE SafeURL %]
		50
		51	[% $url \| safe_url %]
		52
		53	This filter parses the text as a URL and returns the object which
		54	is stringified in a safe format.
		55
		56	=head1 METHODS
		57
		58	=head2 init
		59
		60	This method installs the filter name and declares it as a dynamic filter
		61
		62	=head2 filter
		63
		64	Returns a stringified version of a Perl URL object
65
66	=cut

Lines 7-12 Link Here

(-)a/koha-tmpl/opac-tmpl/bootstrap/en/modules/opac-detail.tt (-2 / +3 lines)
7	[% USE TablesSettings %]	7	[% USE TablesSettings %]
8	[% USE AuthorisedValues %]	8	[% USE AuthorisedValues %]
9	[% USE KohaPlugins %]	9	[% USE KohaPlugins %]
		10	[% USE SafeURL %]
10	[% SET TagsShowEnabled = ( ( Koha.Preference( 'TagsEnabled' ) == 1 ) && TagsShowOnDetail ) %]	11	[% SET TagsShowEnabled = ( ( Koha.Preference( 'TagsEnabled' ) == 1 ) && TagsShowOnDetail ) %]
11	[% SET TagsInputEnabled = ( ( Koha.Preference( 'opacuserlogin' ) == 1 ) && ( Koha.Preference( 'TagsEnabled' ) == 1 ) && TagsInputOnDetail ) %]	12	[% SET TagsInputEnabled = ( ( Koha.Preference( 'opacuserlogin' ) == 1 ) && ( Koha.Preference( 'TagsEnabled' ) == 1 ) && TagsInputOnDetail ) %]
12	[% SET CoverImagePlugins = KohaPlugins.get_plugins_opac_cover_images %]	13	[% SET CoverImagePlugins = KohaPlugins.get_plugins_opac_cover_images %]
Lines 1368-1381 Link Here
1368	[% IF trackclicks == 'track' \|\| trackclicks == 'anonymous' %]	1369	[% IF trackclicks == 'track' \|\| trackclicks == 'anonymous' %]
1369	<a target="[% target_attr \| html %]" rel="[% rel_attr \| html %]" href="/cgi-bin/koha/tracklinks.pl?uri=[% uri \| uri %]&biblionumber=[% biblio.biblionumber \| html %]&itemnumber=[% ITEM_RESULT.itemnumber \| html %]" property="url">[% uri \| html %]</a>	1370	<a target="[% target_attr \| html %]" rel="[% rel_attr \| html %]" href="/cgi-bin/koha/tracklinks.pl?uri=[% uri \| uri %]&biblionumber=[% biblio.biblionumber \| html %]&itemnumber=[% ITEM_RESULT.itemnumber \| html %]" property="url">[% uri \| html %]</a>
1370	[% ELSE %]	1371	[% ELSE %]
1371	<a target="[% target_attr \| html %]" rel="[% rel_attr \| html %]" href="[% uri \| url %]" property="url">[% uri \| html %]</a>	1372	<a target="[% target_attr \| html %]" rel="[% rel_attr \| html %]" href="[% uri \| safe_url %]" property="url">[% uri \| html %]</a>
1372	[% END %]	1373	[% END %]
1373	[% END %]	1374	[% END %]
1374	[% ELSE %]	1375	[% ELSE %]
1375	[% IF trackclicks == 'track' \|\| trackclicks == 'anonymous' %]	1376	[% IF trackclicks == 'track' \|\| trackclicks == 'anonymous' %]
1376	<a target="[% target_attr \| html %]" rel="[% rel_attr \| html %]" href="/cgi-bin/koha/tracklinks.pl?uri=[% ITEM_RESULT.uri \| uri %]&biblionumber=[% biblio.biblionumber \| html %]&itemnumber=[% ITEM_RESULT.itemnumber \| html %]" property="url">	1377	<a target="[% target_attr \| html %]" rel="[% rel_attr \| html %]" href="/cgi-bin/koha/tracklinks.pl?uri=[% ITEM_RESULT.uri \| uri %]&biblionumber=[% biblio.biblionumber \| html %]&itemnumber=[% ITEM_RESULT.itemnumber \| html %]" property="url">
1377	[% ELSE %]	1378	[% ELSE %]
1378	<a target="[% target_attr \| html %]" rel="[% rel_attr \| html %]" href="[% ITEM_RESULT.uri \| url %]" property="url">	1379	<a target="[% target_attr \| html %]" rel="[% rel_attr \| html %]" href="[% ITEM_RESULT.uri \| safe_url %]" property="url">
1379	[% END %]	1380	[% END %]
1380	[% IF Koha.Preference('URLLinkText') %][% Koha.Preference('URLLinkText') \| html %][% ELSE %]Link to resource[% END %]	1381	[% IF Koha.Preference('URLLinkText') %][% Koha.Preference('URLLinkText') \| html %][% ELSE %]Link to resource[% END %]
1381	</a>	1382	</a>

Line 0 Link Here

(-)a/t/Koha/Plugins/SafeURL.t (-1 / +57 lines)
0	-	1	#!/usr/bin/perl
		2
		3	# This file is part of Koha.
		4	#
		5	# Koha is free software; you can redistribute it and/or modify it
		6	# under the terms of the GNU General Public License as published by
		7	# the Free Software Foundation; either version 3 of the License, or
		8	# (at your option) any later version.
		9	#
		10	# Koha is distributed in the hope that it will be useful, but
		11	# WITHOUT ANY WARRANTY; without even the implied warranty of
		12	# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
		13	# GNU General Public License for more details.
		14	#
		15	# You should have received a copy of the GNU General Public License
		16	# along with Koha; if not, see <http://www.gnu.org/licenses>.
		17
		18	use Modern::Perl;
		19
		20	use Test::More tests => 2;
		21	use Template;
		22
		23	subtest 'test double-encoding prevention' => sub {
		24	plan tests => 1;
		25	my $template = Template->new(
		26	{
		27	PLUGIN_BASE => 'Koha::Template::Plugin',
		28	}
		29	);
		30
		31	my $tt = <<EOF;
		32	[%- USE SafeURL %]
		33	[%- 'http://koha-community.org?url=https%3A%2F%2Fkoha-community.org' \| safe_url -%]
		34	EOF
		35
		36	my $output;
		37	$template->process( \$tt, {}, \$output );
		38	is( $output, 'http://koha-community.org?url=https%3A%2F%2Fkoha-community.org', 'URL is not double-encoded' );
		39	};
		40
		41	subtest 'double quotes are escaped' => sub {
		42	plan tests => 1;
		43	my $template = Template->new(
		44	{
		45	PLUGIN_BASE => 'Koha::Template::Plugin',
		46	}
		47	);
		48
		49	my $tt = <<EOF;
		50	[%- USE SafeURL %]
		51	[%- 'http://koha-community.org?url=https%3A%2F%2Fkoha-community.org"' \| safe_url -%]
		52	EOF
		53
		54	my $output;
		55	$template->process( \$tt, {}, \$output );
		56	is( $output, 'http://koha-community.org?url=https%3A%2F%2Fkoha-community.org%22', 'double quotes are escaped' );
		57	};