Attachment 169719 Details for Bug 37323 – Bug 37323: Escape characters in patron image picture upload

[patch] Bug 37323: Escape characters in patron image picture upload

Bug-37323-Escape-characters-in-patron-image-pictur.patch (text/plain), 1.47 KB, created by Nick Clemens (kidclamp) on 2024-07-26 13:40:54 UTC

(hide)

Description:

Filename:

MIME Type:

Creator: Nick Clemens (kidclamp)

Created: 2024-07-26 13:40:54 UTC

Size: 1.47 KB

patch

obsolete

>From a24093e8123a541f7502c3fd6792ac93be186ee1 Mon Sep 17 00:00:00 2001
>From: Amit Gupta <amit.gupta@informaticsglobal.com>
>Date: Thu, 11 Jul 2024 23:13:06 +0530
>Subject: [PATCH] Bug 37323: Escape characters in patron image picture upload
>
>To Test
>1. Create a file name for example: test.zip`curl xxxxtesting.informaticsglobal.com`.zip
>   where the domain is one you can watch the logs from.
>2. Go to Tools and click on Upload patron images choose option zip file and upload the file.
>3. Check /var/log/apache2/access.log and see the curl with the IP
>   "xx.xxx.xx.xxx - - [11/Jul/2024:23:10:33 +0530] "GET / HTTP/1.1" 200 267 "-" "curl/7.68.0"
>4. Apply the patch
>5. Repeat 2 and 3 step and check no error is coming for the Remote execution error.
>6. Test uploading actual zip file and images still works.
>
>Signed-off-by: Chris Cormack <chris@bigballofwax.co.nz>
>Signed-off-by: David Cook <dcook@prosentient.com.au>
>Signed-off-by: Nick Clemens <nick@bywatersolutions.com>
>---
> tools/picture-upload.pl | 1 +
> 1 file changed, 1 insertion(+)
>
>diff --git a/tools/picture-upload.pl b/tools/picture-upload.pl
>index 2383fba8859..4d6597fdee1 100755
>--- a/tools/picture-upload.pl
>+++ b/tools/picture-upload.pl
>@@ -89,6 +89,7 @@ if ( ( $op eq 'cud-Upload' ) && ($uploadfile || $uploadfiletext) ) {
> 
>     my $dirname = File::Temp::tempdir( CLEANUP => 1 );
>     my $filesuffix;
>+    $uploadfilename =~ s/[^A-Za-z0-9\-\.]//g;
>     if ( $uploadfilename =~ m/(\..+)$/i ) {
>         $filesuffix = $1;
>     }
>-- 
>2.39.2

Actions: View | Diff | Splinter Review

Attachments on bug 37323: 168779 | 168856 | 168857 | 169170 | 169171 | 169175 | 169176 | 169637 | 169638 | 169639 | 169719 | 169720 | 169721