Attachment 159221 Details for Bug 35291 – Bug 35291: Don't allow symlinks for link files in cover image ZIP

[patch] Bug 35291: Don't allow symlinks for link files in cover image ZIP

Bug-35291-Dont-allow-symlinks-for-link-files-in-co.patch (text/plain), 1.96 KB, created by Tomás Cohen Arazi (tcohen) on 2023-11-23 23:49:11 UTC

(hide)

Description:

Filename:

MIME Type:

Creator: Tomás Cohen Arazi (tcohen)

Created: 2023-11-23 23:49:11 UTC

Size: 1.96 KB

patch

obsolete

>From efa325f5948c22a63a71f588e5a03fb6aac1d3d6 Mon Sep 17 00:00:00 2001
>From: David Cook <dcook@prosentient.com.au>
>Date: Thu, 9 Nov 2023 00:23:45 +0000
>Subject: [PATCH] Bug 35291: Don't allow symlinks for link files in cover image
> ZIP
>
>There's no reason to allow symlinks for link files in cover image
>ZIP files. Preventing their use prevents someone from uploading
>a symlink pointing to an existing file on the Koha server.
>
>Test plan:
>0. Apply patch and restart/reload Koha
>1. Create a PNG cover image
>2. Create a datalink.txt file that contains something like the
>following:
>29,Untitled.PNG
>3. Turn on "LocalCoverImages" system preference
>4. Upload via http://localhost:8081/cgi-bin/koha/tools/upload-cover-image.pl
>5. Go to http://localhost:8081/cgi-bin/koha/catalogue/detail.pl?biblionumber=29
>6. Note the cover image has been uploaded
>
>Signed-off-by: Nick Clemens <nick@bywatersolutions.com>
>Signed-off-by: Aleisha Amohia <aleishaamohia@hotmail.com>
>Signed-off-by: Tomas Cohen Arazi <tomascohen@theke.io>
>---
> tools/upload-cover-image.pl | 11 ++++++-----
> 1 file changed, 6 insertions(+), 5 deletions(-)
>
>diff --git a/tools/upload-cover-image.pl b/tools/upload-cover-image.pl
>index ff32d0889c3..bf43928b582 100755
>--- a/tools/upload-cover-image.pl
>+++ b/tools/upload-cover-image.pl
>@@ -158,11 +158,12 @@ if ($fileID) {
>             }
>             foreach my $dir (@directories) {
>                 my $file;
>-                if ( -e "$dir/idlink.txt" ) {
>-                    $file = "$dir/idlink.txt";
>-                }
>-                elsif ( -e "$dir/datalink.txt" ) {
>-                    $file = "$dir/datalink.txt";
>+                my $idlink   = "$dir/idlink.txt";
>+                my $datalink = "$dir/datalink.txt";
>+                if ( -e $idlink && !-l $idlink ) {
>+                    $file = $idlink;
>+                } elsif ( -e $datalink && !-l $datalink ) {
>+                    $file = $datalink;
>                 }
>                 else {
>                     next;
>-- 
>2.43.0

Actions: View | Diff | Splinter Review

Attachments on bug 35291: 158664 | 158684 | 158685 | 158686 | 159151 | 159152 | 159153 | 159215 | 159216 | 159217 | 159218 | 159220 | 159221 | 159222 | 159223