Bugzilla – Attachment 153925 Details for
Bug 25672
Administrators should be able to restrict client-side plugin upload to trusted sources
Home
|
New
|
Browse
|
Search
|
[?]
|
Reports
|
Help
|
New Account
|
Log In
[x]
|
Forgot Password
Login:
[x]
[patch]
Bug 25672: WIP - Convert to restricting to repo only
Bug-25672-WIP---Convert-to-restricting-to-repo-onl.patch (text/plain), 4.96 KB, created by
Martin Renvoize (ashimema)
on 2023-07-26 14:35:26 UTC
(
hide
)
Description:
Bug 25672: WIP - Convert to restricting to repo only
Filename:
MIME Type:
Creator:
Martin Renvoize (ashimema)
Created:
2023-07-26 14:35:26 UTC
Size:
4.96 KB
patch
obsolete
>From bd94b7da9212282dea60dbb6f22ee56086931e42 Mon Sep 17 00:00:00 2001 >From: Martin Renvoize <martin.renvoize@ptfs-europe.com> >Date: Tue, 25 Jul 2023 15:46:34 +0100 >Subject: [PATCH] Bug 25672: WIP - Convert to restricting to repo only > >I think instead of a plain on/off switch we should use it in combination >with the plugin_repo's and set it to restrict to only those repos' (i.e. >disable uploads entirely if no repo's are listed, or just allow those >repo's when there are) >--- > plugins/plugins-upload.pl | 54 +++++++++++++++++++++++++++------------ > 1 file changed, 38 insertions(+), 16 deletions(-) > >diff --git a/plugins/plugins-upload.pl b/plugins/plugins-upload.pl >index 1fe6b3b041..32f9716154 100755 >--- a/plugins/plugins-upload.pl >+++ b/plugins/plugins-upload.pl >@@ -24,27 +24,33 @@ use Mojo::UserAgent; > use File::Temp; > > use C4::Context; >-use C4::Auth qw( get_template_and_user ); >+use C4::Auth qw( get_template_and_user ); > use C4::Output qw( output_html_with_http_headers ); > use C4::Members; > use Koha::Logger; > use Koha::Plugins; > >-my $plugins_enabled = C4::Context->config("enable_plugins"); >-my $browser_upload_enabled = C4::Context->config('enable_plugin_browser_upload'); >+my $plugins_enabled = C4::Context->config("enable_plugins"); >+my $plugins_restricted = C4::Context->config('enable_plugin_browser_upload'); > > my $input = CGI->new; > > my ( $template, $loggedinuser, $cookie ) = get_template_and_user( >- { template_name => ($plugins_enabled && $browser_upload_enabled) ? "plugins/plugins-upload.tt" : "plugins/plugins-disabled.tt", >+ { >+ template_name => $plugins_enabled ? "plugins/plugins-upload.tt" : "plugins/plugins-disabled.tt", > query => $input, > type => "intranet", >- flagsrequired => { plugins => 'manage' }, >+ flagsrequired => { plugins => 'manage' }, > } > ); > >-if ($plugins_enabled){ >- $template->param( browser_upload_enabled => $browser_upload_enabled ); >+if ($plugins_enabled) { >+ $template->param( restricted => $plugins_restricted ); >+} >+ >+# Exit early if uploads are not enabled >+if ( !$ ) { >+ output_html_with_http_headers $input, $cookie, $template->output; > } > > my $uploadfilename = $input->param('uploadfile'); >@@ -56,7 +62,7 @@ my ( $tempfile, $tfh ); > > my %errors; > >-if ($plugins_enabled && $browser_upload_enabled) { >+if ($plugins_enabled) { > if ( ( $op eq 'Upload' ) && ( $uploadfile || $uploadlocation ) ) { > my $plugins_dir = C4::Context->config("pluginsdir"); > $plugins_dir = ref($plugins_dir) eq 'ARRAY' ? $plugins_dir->[0] : $plugins_dir; >@@ -67,22 +73,38 @@ if ($plugins_enabled && $browser_upload_enabled) { > $filesuffix = $1 if $uploadfilename =~ m/(\..+)$/i; > ( $tfh, $tempfile ) = File::Temp::tempfile( SUFFIX => $filesuffix, UNLINK => 1 ); > >- $errors{'NOTKPZ'} = 1 if ( $uploadfilename !~ /\.kpz$/i ); >+ $errors{'NOTKPZ'} = 1 if ( $uploadfilename !~ /\.kpz$/i ); > $errors{'NOWRITETEMP'} = 1 unless ( -w $dirname ); > $errors{'NOWRITEPLUGINS'} = 1 unless ( -w $plugins_dir ); > >- if ( $uploadlocation ) { >- my $ua = Mojo::UserAgent->new(max_redirects => 5); >- my $tx = $ua->get($uploadlocation); >- $tx->result->content->asset->move_to($tempfile); >+ if ($uploadlocation) { >+ my $do_get = 1; >+ if ( $plugins_restricted ) { >+ my $repos = C4::Context->config('plugin_repos'); >+ >+ # Fix data structure if only one repo defined >+ if ( ref($repos->{repo}) eq 'HASH' ) { >+ $repos = { repo => [ $repos->{repo} ] }; >+ } >+ >+ $do_get = any { index($uploadlocation, $_->{org_name}) != -1 } @{ $repos->{repo} }; >+ } >+ >+ if ( $do_get ) { >+ my $ua = Mojo::UserAgent->new( max_redirects => 5 ); >+ my $tx = $ua->get($uploadlocation); >+ $tx->result->content->asset->move_to($tempfile); >+ } else { >+ $errors{'BLOCKED'} = 1; >+ } > } else { >- $errors{'EMPTYUPLOAD'} = 1 unless ( length($uploadfile) > 0 ); >+ $errors{'EMPTYUPLOAD'} = 1 unless ( length($uploadfile) > 0 ); > } > > if (%errors) { > $template->param( ERRORS => [ \%errors ] ); > } else { >- if ( $uploadfile ) { >+ if ($uploadfile && !$plugins_restricted) { > while (<$uploadfile>) { > print $tfh $_; > } >@@ -104,7 +126,7 @@ if ($plugins_enabled && $browser_upload_enabled) { > warn "Problem uploading file or no file uploaded."; > } > >- if ( ($uploadfile || $uploadlocation) && !%errors && !$template->param('ERRORS') ) { >+ if ( ( $uploadfile || $uploadlocation ) && !%errors && !$template->param('ERRORS') ) { > print $input->redirect("/cgi-bin/koha/plugins/plugins-home.pl"); > } else { > output_html_with_http_headers $input, $cookie, $template->output; >-- >2.41.0
You cannot view the attachment while viewing its details because your browser does not support IFRAMEs.
View the attachment on a separate page
.
View Attachment As Diff
View Attachment As Raw
Actions:
View
|
Diff
|
Splinter Review
Attachments on
bug 25672
:
106651
|
106671
|
106673
|
106674
|
107172
|
107173
|
107174
|
153824
|
153825
|
153826
|
153827
|
153925
|
154423
|
154424
|
154425
|
154426
|
154427
|
154453
|
154455
|
154464
|
154465
|
154466
|
154467
|
154468
|
154474
|
154475
|
154476
|
154477
|
154478
|
156715
|
156716
|
156717
|
156718
|
156719
|
156720
|
156734
|
156735
|
156736
|
156737
|
156738
|
156739
|
156740
|
157730
|
157810
|
157811
|
157812
|
157813
|
157814
|
157815
|
157816
|
157817
|
157836
|
157837
|
157838
|
157839
|
157840
|
157841
|
157842
|
157843
|
157846
|
157847
|
157848
|
157849
|
157850
|
157851
|
157852
|
157853