Attachment 169638 Details for Bug 37323 – Bug 37323: Don't allow symlinks in link files in zip and validate filepaths

[patch] Bug 37323: Don't allow symlinks in link files in zip and validate filepaths

Bug-37323-Dont-allow-symlinks-in-link-files-in-zip.patch (text/plain), 1.83 KB, created by David Cook on 2024-07-26 03:28:23 UTC

(hide)

Description:

Filename:

MIME Type:

Creator: David Cook

Created: 2024-07-26 03:28:23 UTC

Size: 1.83 KB

patch

obsolete

>From e41eef32d2883241c60cd2af49f3e5ba33dbbfc3 Mon Sep 17 00:00:00 2001
>From: Chris Cormack <chris@bigballofwax.co.nz>
>Date: Thu, 18 Jul 2024 23:57:32 +0000
>Subject: [PATCH] Bug 37323: Don't allow symlinks in link files in zip and
> validate filepaths
>
>Test plan:
>0. Apply patch and restart/reload Koha
>1. Test that uploading a patron image still works, in single file format and as a zip
>
>Work as suggested
>
>Signed-off-by: Amit Gupta <amit.gupta@informaticsglobal.com>
>Signed-off-by: David Cook <dcook@prosentient.com.au>
>---
> tools/picture-upload.pl | 12 ++++++++----
> 1 file changed, 8 insertions(+), 4 deletions(-)
>
>diff --git a/tools/picture-upload.pl b/tools/picture-upload.pl
>index 4d6597fdee..f5e579a691 100755
>--- a/tools/picture-upload.pl
>+++ b/tools/picture-upload.pl
>@@ -25,6 +25,8 @@ use File::Temp;
> use CGI qw ( -utf8 );
> use GD;
> use MIME::Base64;
>+use Cwd;
>+
> use C4::Context;
> use C4::Auth qw( get_template_and_user );
> use C4::Output qw( output_and_exit output_html_with_http_headers );
>@@ -213,13 +215,15 @@ sub handle_dir {
>         my $dir_h;
>         opendir $dir_h, $dir;
>         while ( my $filename = readdir $dir_h ) {
>-            $file = "$dir/$filename"
>-              if ( $filename =~ m/datalink\.txt/i
>-                || $filename =~ m/idlink\.txt/i );
>+
>+              if ( ($filename =~ m/datalink\.txt/i
>+                || $filename =~ m/idlink\.txt/i ) && ( -e "$dir/$filename" && !-l "$dir/$filename")) {
>+                  $file = Cwd::abs_path("$dir/$filename");
>+              }
>         }
>         my $fh;
>         unless ( open( $fh, '<', $file ) ) {
>-            warn "Opening $dir/$file failed!";
>+            warn "Opening $file failed!";
>             $direrrors{'OPNLINK'} = $file;
>             # This error is fatal to the import of this directory contents
>             # so bail and return the error to the caller
>-- 
>2.39.2

Actions: View | Diff | Splinter Review

Attachments on bug 37323: 168779 | 168856 | 168857 | 169170 | 169171 | 169175 | 169176 | 169637 | 169638 | 169639 | 169719 | 169720 | 169721