Attachment #66317 for bug #17989

View | Details | Raw Unified | Return to bug 17989
Collapse All | Expand All

Lines 161-170 sub get_template_and_user { Link Here

(-)a/C4/Auth.pm (-3 / +2 lines)
161		161
162	C4::Context->interface( $in->{type} );	162	C4::Context->interface( $in->{type} );
163		163
164	my $safe_chars = 'a-zA-Z0-9_\-\/';
165	die "bad template path" unless $in->{'template_name'} =~ m/^[$safe_chars]+\.tt$/ig; #sanitize input
166
167	$in->{'authnotrequired'} \|\|= 0;	164	$in->{'authnotrequired'} \|\|= 0;
		165
		166	# the following call includes a bad template check; might croak
168	my $template = C4::Templates::gettemplate(	167	my $template = C4::Templates::gettemplate(
169	$in->{'template_name'},	168	$in->{'template_name'},
170	$in->{'type'},	169	$in->{'type'},




use C4::Context;

use Koha::Cache::Memory::Lite;
use Koha::Exceptions;

__PACKAGE__->mk_accessors(qw( theme activethemes preferredtheme lang filename htdocs interface vars));


    return ($htdocs, $theme, $lang, $filename);
}

=head2 badtemplatecheck

    badtemplatecheck( $template_path );

    The sub will throw an exception if the template path is not allowed.

    Note: At this moment the sub is actually a helper routine for
    sub gettemplate.

=cut

sub badtemplatecheck {
    my ( $template ) = @_;
    Koha::Exceptions::NoPermission->throw( 'bad template path' )
        unless $template =~ m/^[a-zA-Z0-9_\-\/]+\.(tt|pref)$/;
}

sub gettemplate {
    my ( $tmplbase, $interface, $query, $is_plugin ) = @_;
    ($query) or warn "no query in gettemplate";
    die "bad template path" unless $tmplbase =~ m/^[a-zA-Z0-9_\-\/]+\.(tt|pref)$/; # Will be extended on bug 17989
    my $path = C4::Context->preference('intranet_includes') || 'includes';
    my ($htdocs, $theme, $lang, $filename)
       =  _get_template_file($tmplbase, $interface, $query);
    $filename = $tmplbase if ( $is_plugin );
    badtemplatecheck( $filename ); # single trip for bad templates
    my $template = C4::Templates->new($interface, $filename, $tmplbase, $query);

# NOTE: Commenting these out rather than deleting them so that those who need

Lines 28-33 use Exception::Class ( Link Here

(-)a/Koha/Exceptions.pm (-1 / +4 lines)
28	isa => 'Koha::Exceptions::Exception',	28	isa => 'Koha::Exceptions::Exception',
29	description => 'One or more parameters are wrong',	29	description => 'One or more parameters are wrong',
30	},	30	},
		31	'Koha::Exceptions::NoPermission' => {
		32	isa => 'Koha::Exceptions::Exception',
		33	description => 'You do not have permission for this action',
		34	},
31	'Koha::Exceptions::CannotAddLibraryLimit' => {	35	'Koha::Exceptions::CannotAddLibraryLimit' => {
32	isa => 'Koha::Exceptions::Exception',	36	isa => 'Koha::Exceptions::Exception',
33	description => 'General problem adding a library limit'	37	description => 'General problem adding a library limit'
34	-

Return to bug 17989

Lines 37-42 use C4::Languages qw(getTranslatedLanguages get_bidi regex_lang_subtags language Link Here

(-)a/C4/Templates.pm (-2 / +18 lines)
37	use C4::Context;	37	use C4::Context;
38		38
39	use Koha::Cache::Memory::Lite;	39	use Koha::Cache::Memory::Lite;
		40	use Koha::Exceptions;
40		41
41	__PACKAGE__->mk_accessors(qw( theme activethemes preferredtheme lang filename htdocs interface vars));	42	__PACKAGE__->mk_accessors(qw( theme activethemes preferredtheme lang filename htdocs interface vars));
42		43
Lines 167-181 sub _get_template_file { Link Here
167	return ($htdocs, $theme, $lang, $filename);	168	return ($htdocs, $theme, $lang, $filename);
168	}	169	}
169		170
		171	=head2 badtemplatecheck
		172
		173	badtemplatecheck( $template_path );
		174
		175	The sub will throw an exception if the template path is not allowed.
		176
		177	Note: At this moment the sub is actually a helper routine for
		178	sub gettemplate.
		179
		180	=cut
		181
		182	sub badtemplatecheck {
		183	my ( $template ) = @_;
		184	Koha::Exceptions::NoPermission->throw( 'bad template path' )
		185	unless $template =~ m/^[a-zA-Z0-9_\-\/]+\.(tt\|pref)$/;
		186	}
170		187
171	sub gettemplate {	188	sub gettemplate {
172	my ( $tmplbase, $interface, $query, $is_plugin ) = @_;	189	my ( $tmplbase, $interface, $query, $is_plugin ) = @_;
173	($query) or warn "no query in gettemplate";	190	($query) or warn "no query in gettemplate";
174	die "bad template path" unless $tmplbase =~ m/^[a-zA-Z0-9_\-\/]+\.(tt\|pref)$/; # Will be extended on bug 17989
175	my $path = C4::Context->preference('intranet_includes') \|\| 'includes';
176	my ($htdocs, $theme, $lang, $filename)	191	my ($htdocs, $theme, $lang, $filename)
177	= _get_template_file($tmplbase, $interface, $query);	192	= _get_template_file($tmplbase, $interface, $query);
178	$filename = $tmplbase if ( $is_plugin );	193	$filename = $tmplbase if ( $is_plugin );
		194	badtemplatecheck( $filename ); # single trip for bad templates
179	my $template = C4::Templates->new($interface, $filename, $tmplbase, $query);	195	my $template = C4::Templates->new($interface, $filename, $tmplbase, $query);
180		196
181	# NOTE: Commenting these out rather than deleting them so that those who need	197	# NOTE: Commenting these out rather than deleting them so that those who need