Bugzilla – Attachment 163384 Details for
Bug 36244
Template toolkit syntax not escaped in letter templates
Home
|
New
|
Browse
|
Search
|
[?]
|
Reports
|
Help
|
New Account
|
Log In
[x]
|
Forgot Password
Login:
[x]
[patch]
Bug 36244: [22.05] Do template toolkit processing first
Bug-36244-Do-template-toolkit-processing-first.patch (text/plain), 2.17 KB, created by
Jonathan Druart
on 2024-03-19 08:48:54 UTC
(
hide
)
Description:
Bug 36244: [22.05] Do template toolkit processing first
Filename:
MIME Type:
Creator:
Jonathan Druart
Created:
2024-03-19 08:48:54 UTC
Size:
2.17 KB
patch
obsolete
>From 7f932ff6833f92cc6445bf580a6dbbb13d1e5aaa Mon Sep 17 00:00:00 2001 >From: Andreas Jonsson <andreas.jonsson@kreablo.se> >Date: Thu, 7 Mar 2024 09:12:25 +0000 >Subject: [PATCH] Bug 36244: Do template toolkit processing first > >To avoid injection of template toolkit code >from database fields that are controlled by >untrusted sources. > >Test plan: > >* review subtest 'Template toolkit syntax in > parameters' in t/db_dependent/Letters.t >* Run the unit test: > prove t/db_dependent/Letters.t > >Signed-off-by: Jonathan Druart <jonathan.druart@bugs.koha-community.org> > >Signed-off-by: Marcel de Rooy <m.de.rooy@rijksmuseum.nl> > >Signed-off-by: Kyle M Hall <kyle@bywatersolutions.com> >--- > C4/Letters.pm | 38 +++++++++++++++++++------------------- > 1 file changed, 19 insertions(+), 19 deletions(-) > >diff --git a/C4/Letters.pm b/C4/Letters.pm >index 6b19fc72523..1e4e817e03e 100644 >--- a/C4/Letters.pm >+++ b/C4/Letters.pm >@@ -597,6 +597,25 @@ sub GetPreparedLetter { > return; > my $want_librarian = $params{want_librarian}; > >+ $letter->{content} = _process_tt( >+ { >+ content => $letter->{content}, >+ tables => $tables, >+ loops => $loops, >+ substitute => $substitute, >+ lang => $lang >+ } >+ ); >+ >+ $letter->{title} = _process_tt( >+ { >+ content => $letter->{title}, >+ tables => $tables, >+ loops => $loops, >+ substitute => $substitute, >+ } >+ ); >+ > if (%$substitute) { > while ( my ($token, $val) = each %$substitute ) { > $val //= q{}; >@@ -667,25 +686,6 @@ sub GetPreparedLetter { > } > } > >- $letter->{content} = _process_tt( >- { >- content => $letter->{content}, >- tables => $tables, >- loops => $loops, >- substitute => $substitute, >- lang => $lang >- } >- ); >- >- $letter->{title} = _process_tt( >- { >- content => $letter->{title}, >- tables => $tables, >- loops => $loops, >- substitute => $substitute, >- } >- ); >- > $letter->{content} =~ s/<<\S*>>//go; #remove any stragglers > > return $letter; >-- >2.34.1
You cannot view the attachment while viewing its details because your browser does not support IFRAMEs.
View the attachment on a separate page
.
View Attachment As Diff
View Attachment As Raw
Actions:
View
|
Diff
|
Splinter Review
Attachments on
bug 36244
:
162866
|
162867
|
162868
|
162871
|
162872
|
162876
|
162877
|
162908
|
162909
|
162910
|
163255
|
163256
|
163257
|
163383
| 163384 |
163385