Bugzilla – Attachment 107172 Details for
Bug 25672
Administrators should be able to restrict client-side plugin upload to trusted sources
Home
|
New
|
Browse
|
Search
|
[?]
|
Reports
|
Help
|
New Account
|
Log In
[x]
|
Forgot Password
Login:
[x]
[patch]
Bug 25672: use enable_plugin_browser_upload flag to control plugin upload
Bug-25672-use-enablepluginbrowserupload-flag-to-co.patch (text/plain), 7.22 KB, created by
Martin Renvoize (ashimema)
on 2020-07-22 08:05:13 UTC
(
hide
)
Description:
Bug 25672: use enable_plugin_browser_upload flag to control plugin upload
Filename:
MIME Type:
Creator:
Martin Renvoize (ashimema)
Created:
2020-07-22 08:05:13 UTC
Size:
7.22 KB
patch
obsolete
>From 65fbfc5fb58a18f33bbf6ae916cf0782c73ca2b2 Mon Sep 17 00:00:00 2001 >From: David Cook <dcook@prosentient.com.au> >Date: Wed, 8 Jul 2020 11:53:54 +0000 >Subject: [PATCH] Bug 25672: use enable_plugin_browser_upload flag to control > plugin upload > >This patch adds a enable_plugin_browser_upload flag to koha-conf.xml, which >controls whether or not Koha intranet users can upload Koha plugins via >their browser. Like "enable_plugins", it defaults to 0 for new installs. > >This is useful when you want to provide Koha intranet users with plugins >that are pre-installed by administrators (by CLI) or restricting them >to plugins from a Github repo. See the following for more information: >Bug 23975 - Add ability to search and install plugins from GitHub >Bug 23191 - Administrators should be able to install plugins from the command line > >To test: >1) Apply the patch >2) Set <enable_plugins>1</enable_plugins> in koha-conf.xml >3) Add <enable_plugin_browser_upload>0</enable_plugin_browser_upload> in koha-conf.xml >4) restart_all (in koha-testing-docker) >5) Go to /cgi-bin/koha/plugins/plugins-home.pl and note that you don't see >an option to upload plugins >6) Go to /cgi-bin/koha/plugins/plugins-upload.pl and note that it says >"Plugin browser upload disabled!" and gives instructions on how to enable >browser upload > >Signed-off-by: Nicolas Legrand <nicolas.legrand@bulac.fr> >Signed-off-by: Martin Renvoize <martin.renvoize@ptfs-europe.com> >--- > debian/templates/koha-conf-site.xml.in | 1 + > etc/koha-conf.xml | 1 + > .../prog/en/modules/plugins/plugins-disabled.tt | 8 ++++++-- > .../prog/en/modules/plugins/plugins-home.tt | 2 ++ > plugins/plugins-home.pl | 1 + > plugins/plugins-upload.pl | 9 +++++++-- > 6 files changed, 18 insertions(+), 4 deletions(-) > >diff --git a/debian/templates/koha-conf-site.xml.in b/debian/templates/koha-conf-site.xml.in >index 4853018b1f..5008e29a53 100644 >--- a/debian/templates/koha-conf-site.xml.in >+++ b/debian/templates/koha-conf-site.xml.in >@@ -279,6 +279,7 @@ __END_SRU_PUBLICSERVER__ > <authorityservershadow>1</authorityservershadow> > <pluginsdir>__PLUGINS_DIR__</pluginsdir> <!-- This entry can be repeated to use multiple directories --> > <enable_plugins>0</enable_plugins> >+ <enable_plugin_browser_upload>0</enable_plugin_browser_upload> > <upload_path>__UPLOAD_PATH__</upload_path> > <tmp_path>__TMP_PATH__</tmp_path> > <intranetdir>/usr/share/koha/intranet/cgi-bin</intranetdir> >diff --git a/etc/koha-conf.xml b/etc/koha-conf.xml >index 2ffe624a8c..b31260e95f 100644 >--- a/etc/koha-conf.xml >+++ b/etc/koha-conf.xml >@@ -92,6 +92,7 @@ __PAZPAR2_TOGGLE_XML_POST__ > <authorityservershadow>1</authorityservershadow> > <pluginsdir>__PLUGINS_DIR__</pluginsdir> <!-- This entry can be repeated to use multiple directories --> > <enable_plugins>0</enable_plugins> >+ <enable_plugin_browser_upload>0</enable_plugin_browser_upload> > <upload_path></upload_path> > <tmp_path></tmp_path> > <intranetdir>__INTRANET_CGI_DIR__</intranetdir> >diff --git a/koha-tmpl/intranet-tmpl/prog/en/modules/plugins/plugins-disabled.tt b/koha-tmpl/intranet-tmpl/prog/en/modules/plugins/plugins-disabled.tt >index b17d140b82..78a0b7f46e 100644 >--- a/koha-tmpl/intranet-tmpl/prog/en/modules/plugins/plugins-disabled.tt >+++ b/koha-tmpl/intranet-tmpl/prog/en/modules/plugins/plugins-disabled.tt >@@ -1,5 +1,5 @@ > [% INCLUDE 'doc-head-open.inc' %] >-<title>Koha › Tools › Plugins › Upload Plugin >+<title>Koha › Tools › Plugins › Plugins Disabled > </title> > [% INCLUDE 'doc-head-close.inc' %] > [% INCLUDE 'calendar.inc' %] >@@ -17,9 +17,13 @@ > <div class="container-fluid"> > <div class="row"> > <div class="col-sm-6 col-sm-offset-3 col-md-6 col-md-offset-3"> >+ [% IF ( browser_upload_enabled.defined ) && ( browser_upload_enabled == 0 ) %] >+ <h1>Plugin browser upload disabled!</h1> >+ <p>To enable Koha plugin browser upload, the flag enable_plugin_browser_upload must be set in the Koha configuration file</p> >+ [% ELSE %] > <h1>Plugins disabled!</h1> >- > <p>To enable Koha plugins, the flag enable_plugins must be set in the Koha configuration file</p> >+ [% END %] > </div> > </div> > >diff --git a/koha-tmpl/intranet-tmpl/prog/en/modules/plugins/plugins-home.tt b/koha-tmpl/intranet-tmpl/prog/en/modules/plugins/plugins-home.tt >index 1dff52810d..dec24c5904 100644 >--- a/koha-tmpl/intranet-tmpl/prog/en/modules/plugins/plugins-home.tt >+++ b/koha-tmpl/intranet-tmpl/prog/en/modules/plugins/plugins-home.tt >@@ -26,7 +26,9 @@ > > [% IF ( CAN_user_plugins_manage ) %] > <div class="btn-toolbar" id="toolbar"> >+ [% IF ( enable_browser_upload ) %] > <a href="/cgi-bin/koha/plugins/plugins-upload.pl" id="upload_plugin" class="btn btn-default"><i class="fa fa-upload"></i> Upload plugin</a> >+ [% END %] > > <div class="btn-group"> > <button class="btn btn-default dropdown-toggle" data-toggle="dropdown"><i class="fa fa-eye"></i> View plugins by class <span class="caret"></span></button> >diff --git a/plugins/plugins-home.pl b/plugins/plugins-home.pl >index e3335ab4bd..b8e7b469c3 100755 >--- a/plugins/plugins-home.pl >+++ b/plugins/plugins-home.pl >@@ -59,6 +59,7 @@ if ($plugins_enabled) { > }); > > $template->param( plugins => \@plugins, ); >+ $template->param( enable_browser_upload => C4::Context->config('enable_plugin_browser_upload') ); > > $template->param( can_search => C4::Context->config('plugin_repos') ? 1 : 0 ); > my @results; >diff --git a/plugins/plugins-upload.pl b/plugins/plugins-upload.pl >index 6ad52abccf..4070b8a265 100755 >--- a/plugins/plugins-upload.pl >+++ b/plugins/plugins-upload.pl >@@ -32,11 +32,12 @@ use C4::Debug; > use Koha::Plugins; > > my $plugins_enabled = C4::Context->config("enable_plugins"); >+my $browser_upload_enabled = C4::Context->config('enable_plugin_browser_upload'); > > my $input = new CGI; > > my ( $template, $loggedinuser, $cookie ) = get_template_and_user( >- { template_name => ($plugins_enabled) ? "plugins/plugins-upload.tt" : "plugins/plugins-disabled.tt", >+ { template_name => ($plugins_enabled && $browser_upload_enabled) ? "plugins/plugins-upload.tt" : "plugins/plugins-disabled.tt", > query => $input, > type => "intranet", > authnotrequired => 0, >@@ -45,6 +46,10 @@ my ( $template, $loggedinuser, $cookie ) = get_template_and_user( > } > ); > >+if ($plugins_enabled){ >+ $template->param( browser_upload_enabled => $browser_upload_enabled ); >+} >+ > my $uploadfilename = $input->param('uploadfile'); > my $uploadfile = $input->upload('uploadfile'); > my $uploadlocation = $input->param('uploadlocation'); >@@ -54,7 +59,7 @@ my ( $tempfile, $tfh ); > > my %errors; > >-if ($plugins_enabled) { >+if ($plugins_enabled && $browser_upload_enabled) { > if ( ( $op eq 'Upload' ) && ( $uploadfile || $uploadlocation ) ) { > my $plugins_dir = C4::Context->config("pluginsdir"); > $plugins_dir = ref($plugins_dir) eq 'ARRAY' ? $plugins_dir->[0] : $plugins_dir; >-- >2.20.1
You cannot view the attachment while viewing its details because your browser does not support IFRAMEs.
View the attachment on a separate page
.
View Attachment As Diff
View Attachment As Raw
Actions:
View
|
Diff
|
Splinter Review
Attachments on
bug 25672
:
106651
|
106671
|
106673
|
106674
|
107172
|
107173
|
107174
|
153824
|
153825
|
153826
|
153827
|
153925
|
154423
|
154424
|
154425
|
154426
|
154427
|
154453
|
154455
|
154464
|
154465
|
154466
|
154467
|
154468
|
154474
|
154475
|
154476
|
154477
|
154478
|
156715
|
156716
|
156717
|
156718
|
156719
|
156720
|
156734
|
156735
|
156736
|
156737
|
156738
|
156739
|
156740
|
157730
|
157810
|
157811
|
157812
|
157813
|
157814
|
157815
|
157816
|
157817
|
157836
|
157837
|
157838
|
157839
|
157840
|
157841
|
157842
|
157843
|
157846
|
157847
|
157848
|
157849
|
157850
|
157851
|
157852
|
157853