Bugzilla – Attachment 178889 Details for
Bug 39184
Server-side template injection leading to remote code execution
Home
|
New
|
Browse
|
Search
|
[?]
|
Reports
|
Help
|
New Account
|
Log In
[x]
|
Forgot Password
Login:
[x]
[patch]
Bug 39184: Turn off ABSOLUTE and EVAL_PERL for user-entered templates
Bug-39184-Turn-off-ABSOLUTE-and-EVALPERL-for-user-.patch (text/plain), 2.20 KB, created by
David Cook
on 2025-03-03 05:48:51 UTC
(
hide
)
Description:
Bug 39184: Turn off ABSOLUTE and EVAL_PERL for user-entered templates
Filename:
MIME Type:
Creator:
David Cook
Created:
2025-03-03 05:48:51 UTC
Size:
2.20 KB
patch
obsolete
>From cacc7b59411e30dc438f23a2a74a7ab36995b726 Mon Sep 17 00:00:00 2001 >From: David Cook <dcook@prosentient.com.au> >Date: Mon, 3 Mar 2025 05:44:59 +0000 >Subject: [PATCH] Bug 39184: Turn off ABSOLUTE and EVAL_PERL for user-entered > templates > >This change turns off ABSOLUTE and EVAL_PERL for user-entered templates, >as these options can allow for arbitrary code execution and information >disclosure. > >Test plan: >0. Apply the patch >1. koha-plack --restart kohadev >2. Create a Notice for Reports with a report like: >[% IF ( x == 1 ) %] >One >[% ELSE %] >Two >[% END %] >3. Run a report using this template >4. The report should show "Two" >5. Turn on CHECKOUT emails for a test patron >6. Perform a checkout >7. Look at the CHECKOUT email and note that the email body >is correctly generated >--- > C4/Letters.pm | 4 ++-- > Koha/TemplateUtils.pm | 4 ++-- > 2 files changed, 4 insertions(+), 4 deletions(-) > >diff --git a/C4/Letters.pm b/C4/Letters.pm >index 7ddb89b5c0..39818c0fc2 100644 >--- a/C4/Letters.pm >+++ b/C4/Letters.pm >@@ -1786,8 +1786,8 @@ sub _process_tt { > my $use_template_cache = C4::Context->config('template_cache_dir') && defined $ENV{GATEWAY_INTERFACE}; > my $template = Template->new( > { >- EVAL_PERL => 1, >- ABSOLUTE => 1, >+ EVAL_PERL => 0, >+ ABSOLUTE => 0, > PLUGIN_BASE => 'Koha::Template::Plugin', > COMPILE_EXT => $use_template_cache ? '.ttc' : '', > COMPILE_DIR => $use_template_cache ? C4::Context->config('template_cache_dir') : '', >diff --git a/Koha/TemplateUtils.pm b/Koha/TemplateUtils.pm >index aafbaaa6bd..3d2b198f31 100644 >--- a/Koha/TemplateUtils.pm >+++ b/Koha/TemplateUtils.pm >@@ -61,8 +61,8 @@ sub process_tt { > > my $tt = Template->new( > { >- EVAL_PERL => 1, >- ABSOLUTE => 1, >+ EVAL_PERL => 0, >+ ABSOLUTE => 0, > PLUGIN_BASE => 'Koha::Template::Plugin', > COMPILE_EXT => $use_template_cache ? '.ttc' : '', > COMPILE_DIR => $use_template_cache ? C4::Context->config('template_cache_dir') : '', >-- >2.39.5
You cannot view the attachment while viewing its details because your browser does not support IFRAMEs.
View the attachment on a separate page
.
View Attachment As Diff
View Attachment As Raw
Actions:
View
|
Diff
|
Splinter Review
Attachments on
bug 39184
:
178889
|
180292
|
182510