Attachment 166624 Details for Bug 36818 – Bug: 36818 Escape characters in file names uploaded

[patch] Bug: 36818 Escape characters in file names uploaded

Bug-36818-Escape-characters-in-file-names-uploaded.patch (text/plain), 1.44 KB, created by Martin Renvoize (ashimema) on 2024-05-13 10:16:58 UTC

(hide)

Description:

Filename:

MIME Type:

Creator: Martin Renvoize (ashimema)

Created: 2024-05-13 10:16:58 UTC

Size: 1.44 KB

patch

obsolete

>From 93c3042dddff5bf9462d61c2b86788eb38b6ed7a Mon Sep 17 00:00:00 2001
>From: Chris Cormack <chris@bigballofwax.co.nz>
>Date: Wed, 8 May 2024 22:41:43 +0000
>Subject: [PATCH] Bug: 36818 Escape characters in file names uploaded
>
>To test:
>1/ create a file named something like 'execute`curl blog.bigballofwax.co.nz`.zip'
>   Where the domain is one you can watch the logs from
>2/ Upload this file as a cover image
>3/ Check /var/lib/koha/sitename/tmp/koha_sitename/ and see unescaped filenames
>4/ Choose process, check the logs of the webserver see the connection has been made
>5/ Apply the patch
>5/ Repeat 2 & 3 and see the filename is now escaped
>6/ Choose process and check no errors but no no remote execution occurs
>7/ Test uploading actual zip file and images still works
>
>Signed-off-by: Amit Gupta <amit.gupta@informaticsglobal.com>
>Signed-off-by: Martin Renvoize <martin.renvoize@ptfs-europe.com>
>---
> Koha/Uploader.pm | 1 +
> 1 file changed, 1 insertion(+)
>
>diff --git a/Koha/Uploader.pm b/Koha/Uploader.pm
>index 8fbb06a14c9..39aee036b95 100644
>--- a/Koha/Uploader.pm
>+++ b/Koha/Uploader.pm
>@@ -264,6 +264,7 @@ sub _dir {
> sub _hook {
>     my ( $self, $filename, $buffer, $bytes_read, $data ) = @_;
>     $filename= Encode::decode_utf8( $filename ); # UTF8 chars in filename
>+    $filename =~ s/[^A-Za-z0-9\-\.]//g;
>     $self->_compute( $filename, $buffer );
>     my $fh = $self->_fh( $filename ) // $self->_create_file( $filename );
>     print $fh $buffer if $fh;
>-- 
>2.45.0

Actions: View | Diff | Splinter Review

Attachments on bug 36818: 166426 | 166444 | 166477 | 166621 | 166623 | 166624