Attachment #65278 for bug #17989

View | Details | Raw Unified | Return to bug 17989
Collapse All | Expand All




    my $htdocs = C4::Context->config($is_intranet ? 'intrahtdocs' : 'opachtdocs');
    my ($theme, $lang, $availablethemes) = themelanguage($htdocs, $tmplbase, $interface, $query);
    $lang //= 'en';
    $theme //= '';
    my $filename = "$htdocs/$theme/$lang/modules/$tmplbase";

    return ($htdocs, $theme, $lang, $filename);


sub badtemplatecheck {
    my ( $template ) = @_;
    if( !$template || $template !~ m/^[a-zA-Z0-9_\-\/]+\.(tt|pref)$/ ) {
        # This also includes two dots
        Koha::Exceptions::NoPermission->throw( 'bad template path' );
    } else {
        # Check allowed dirs
        my $dirs = C4::Context->config("pluginsdir");
        $dirs = [ $dirs ] if !ref($dirs);
        unshift @$dirs, C4::Context->config('opachtdocs'), C4::Context->config('intrahtdocs');
        my $found = 0;
        foreach my $dir ( @$dirs ) {
            $dir .= '/' if $dir !~ m/\/$/;
            $found++ if $template =~ m/^$dir/;
            last if $found;
        }
        Koha::Exceptions::NoPermission->throw( 'bad template path' ) if !$found;
    }
}

sub gettemplate {




    return;
};

subtest 'Testing gettemplate/badtemplatecheck' => sub {
    plan tests => 7;

    my $cgi = CGI->new;
    my $template;
    warning_like { eval { $template = C4::Templates::gettemplate( '/etc/passwd', 'opac', $cgi, 1 ) }; warn $@ if $@; } qr/bad template/, 'Bad template check';
    is( $template ? $template->output: '', '', 'Check output' );

    # Test a few more bad paths to gettemplate triggering badtemplatecheck
    warning_like { eval { C4::Templates::gettemplate( '../topsecret.tt', 'opac', $cgi, 1 ) }; warn $@ if $@; } qr/bad template/, 'No safe chars';
    warning_like { eval { C4::Templates::gettemplate( '/noaccess/topsecret.tt', 'opac', $cgi, 1 ) }; warn $@ if $@; } qr/bad template/, 'Directory not allowed';
    warning_like { eval { C4::Templates::gettemplate( C4::Context->config('intrahtdocs') . '2/prog/en/modules/about.tt', 'intranet', $cgi, 1 ) }; warn $@ if $@; } qr/bad template/, 'Directory not allowed too';

    # Allow templates from /tmp
    t::lib::Mocks::mock_config( 'pluginsdir', [ '/tmp' ] );
    warning_like { eval { C4::Templates::badtemplatecheck( '/tmp/about.tt' ) }; warn $@ if $@; } undef, 'No warn on template from plugin dir';
    # Refuse wrong extension
    warning_like { eval { C4::Templates::badtemplatecheck( '/tmp/about.tmpl' ) }; warn $@ if $@; } qr/bad template/, 'Warn on bad extension';
};

1;
- 

Return to bug 17989

Lines 163-168 sub _get_template_file { Link Here

(-)a/C4/Templates.pm (-2 / +17 lines)
163	my $htdocs = C4::Context->config($is_intranet ? 'intrahtdocs' : 'opachtdocs');	163	my $htdocs = C4::Context->config($is_intranet ? 'intrahtdocs' : 'opachtdocs');
164	my ($theme, $lang, $availablethemes) = themelanguage($htdocs, $tmplbase, $interface, $query);	164	my ($theme, $lang, $availablethemes) = themelanguage($htdocs, $tmplbase, $interface, $query);
165	$lang //= 'en';	165	$lang //= 'en';
		166	$theme //= '';
166	my $filename = "$htdocs/$theme/$lang/modules/$tmplbase";	167	my $filename = "$htdocs/$theme/$lang/modules/$tmplbase";
167		168
168	return ($htdocs, $theme, $lang, $filename);	169	return ($htdocs, $theme, $lang, $filename);
Lines 181-188 sub _get_template_file { Link Here
181		182
182	sub badtemplatecheck {	183	sub badtemplatecheck {
183	my ( $template ) = @_;	184	my ( $template ) = @_;
184	Koha::Exceptions::NoPermission->throw( 'bad template path' )	185	if( !$template \|\| $template !~ m/^[a-zA-Z0-9_\-\/]+\.(tt\|pref)$/ ) {
185	unless $template =~ m/^[a-zA-Z0-9_\-\/]+\.(tt\|pref)$/;	186	# This also includes two dots
		187	Koha::Exceptions::NoPermission->throw( 'bad template path' );
		188	} else {
		189	# Check allowed dirs
		190	my $dirs = C4::Context->config("pluginsdir");
		191	$dirs = [ $dirs ] if !ref($dirs);
		192	unshift @$dirs, C4::Context->config('opachtdocs'), C4::Context->config('intrahtdocs');
		193	my $found = 0;
		194	foreach my $dir ( @$dirs ) {
		195	$dir .= '/' if $dir !~ m/\/$/;
		196	$found++ if $template =~ m/^$dir/;
		197	last if $found;
		198	}
		199	Koha::Exceptions::NoPermission->throw( 'bad template path' ) if !$found;
		200	}
186	}	201	}
187		202
188	sub gettemplate {	203	sub gettemplate {

Lines 97-108 subtest 'Testing themelanguage' => sub { Link Here

(-)a/t/db_dependent/Templates.t (-4 / +15 lines)
97	return;	97	return;
98	};	98	};
99		99
100	subtest 'Testing gettemplate' => sub {	100	subtest 'Testing gettemplate/badtemplatecheck' => sub {
101	plan tests => 2;	101	plan tests => 7;
102		102
		103	my $cgi = CGI->new;
103	my $template;	104	my $template;
104	warning_like { eval { $template = C4::Templates::gettemplate( '/etc/passwd', 'opac', CGI->new, 1 ) }; warn $@ if $@; } qr/bad template/, 'Bad template check';	105	warning_like { eval { $template = C4::Templates::gettemplate( '/etc/passwd', 'opac', $cgi, 1 ) }; warn $@ if $@; } qr/bad template/, 'Bad template check';
105	is( $template ? $template->output: '', '', 'Check output' );	106	is( $template ? $template->output: '', '', 'Check output' );
		107
		108	# Test a few more bad paths to gettemplate triggering badtemplatecheck
		109	warning_like { eval { C4::Templates::gettemplate( '../topsecret.tt', 'opac', $cgi, 1 ) }; warn $@ if $@; } qr/bad template/, 'No safe chars';
		110	warning_like { eval { C4::Templates::gettemplate( '/noaccess/topsecret.tt', 'opac', $cgi, 1 ) }; warn $@ if $@; } qr/bad template/, 'Directory not allowed';
		111	warning_like { eval { C4::Templates::gettemplate( C4::Context->config('intrahtdocs') . '2/prog/en/modules/about.tt', 'intranet', $cgi, 1 ) }; warn $@ if $@; } qr/bad template/, 'Directory not allowed too';
		112
		113	# Allow templates from /tmp
		114	t::lib::Mocks::mock_config( 'pluginsdir', [ '/tmp' ] );
		115	warning_like { eval { C4::Templates::badtemplatecheck( '/tmp/about.tt' ) }; warn $@ if $@; } undef, 'No warn on template from plugin dir';
		116	# Refuse wrong extension
		117	warning_like { eval { C4::Templates::badtemplatecheck( '/tmp/about.tmpl' ) }; warn $@ if $@; } qr/bad template/, 'Warn on bad extension';
106	};	118	};
107		119
108	1;	120	1;
109	-