Bugzilla – Attachment 189978 Details for
Bug 27286
Patron picture-upload.pl allows arbitrary file extension during upload
Home
|
New
|
Browse
|
Search
|
[?]
|
Reports
|
Help
|
New Account
|
Log In
[x]
|
Forgot Password
Login:
[x]
[patch]
Bug 27286: Patron picture-upload.pl allows arbitrary file extension during upload
Bug-27286-Patron-picture-uploadpl-allows-arbitrary.patch (text/plain), 3.59 KB, created by
Saiful Amin
on 2025-11-26 18:45:03 UTC
(
hide
)
Description:
Bug 27286: Patron picture-upload.pl allows arbitrary file extension during upload
Filename:
MIME Type:
Creator:
Saiful Amin
Created:
2025-11-26 18:45:03 UTC
Size:
3.59 KB
patch
obsolete
>From 48f3a4f24baea58ffa613d78a54da2cf6e0526b2 Mon Sep 17 00:00:00 2001 >From: Saiful Amin <saiful@semanticconsulting.com> >Date: Wed, 26 Nov 2025 18:43:30 +0000 >Subject: [PATCH] Bug 27286: Patron picture-upload.pl allows arbitrary file > extension during upload > >This patch introduces strict validation for filenames in the patron >image upload tool. It addresses VAPT security concerns regarding >"double extension" attacks (e.g., image.php.jpg or archive.php.zip). > >The patch ensures that: >1. Filenames containing more than one period are rejected. >2. Only strictly allowed extensions (zip, png, gif, jpg, jpeg, xpm) are accepted. > >Test Plan: > >1. Pre-patch check: > a. Go to Tools -> Upload patron images. > b. Rename an image file to 'test.php.jpg'. > c. Upload this file. > d. Observe that the upload is accepted, but the filename itself is not > flagged as invalid. > e. Create a valid file named 'test.php.zip' (with valid content). > f. Upload this file. > g. Result: The upload proceeds. > >2. Apply the patch. > >3. Verify rejection (images): > a. Go to Tools -> Upload patron images. > b. Attempt to upload 'test.php.jpg'. > c. Result: The tool stops immediately with a "BADFILENAME" error message. > d. Attempt to upload 'test.v1.jpg' (valid image, extra dot). > e. Result: The tool stops immediately with a "BADFILENAME" error message. > >4. Verify rejection (zip): > a. Attempt to upload 'archive.php.zip'. > b. Result: The tool stops immediately with a "BADFILENAME" error message. > >5. Verify valid upload: > a. Attempt to upload 'patron.jpg' (standard valid file). > b. Result: Upload succeeds. > c. Attempt to upload 'patrons.zip' (standard valid zip). > d. Result: Upload succeeds and files are unpacked. > >6. Sign-off. >--- > .../intranet-tmpl/prog/en/modules/tools/picture-upload.tt | 5 +++++ > tools/picture-upload.pl | 6 ++++++ > 2 files changed, 11 insertions(+) > >diff --git a/koha-tmpl/intranet-tmpl/prog/en/modules/tools/picture-upload.tt b/koha-tmpl/intranet-tmpl/prog/en/modules/tools/picture-upload.tt >index de2cb82..0a654c8 100644 >--- a/koha-tmpl/intranet-tmpl/prog/en/modules/tools/picture-upload.tt >+++ b/koha-tmpl/intranet-tmpl/prog/en/modules/tools/picture-upload.tt >@@ -136,6 +136,11 @@ > <li><strong>This script is not able to create/write to the necessary temporary directory.</strong></li> > [% ELSIF ( ERROR.EMPTYUPLOAD ) %] > <li><strong>The upload file appears to be empty.</strong></li> >+ [% ELSIF ( ERROR.BADFILENAME ) %] >+ <li> >+ <strong>The uploaded filename is invalid. >+ Filenames must have exactly one extension and no other periods (e.g. "patron.jpg", not "patron.v1.jpg").</strong> >+ </li> > [% ELSIF ( ERROR.OPNLINK ) %] > <li > ><strong>Cannot open [% ERROR.OPNLINK | html %] to read.<br />Please verify that it exists.</strong></li >diff --git a/tools/picture-upload.pl b/tools/picture-upload.pl >index 3b2f42f..607e34b 100755 >--- a/tools/picture-upload.pl >+++ b/tools/picture-upload.pl >@@ -97,6 +97,12 @@ if ( ( $op eq 'cud-Upload' ) && ( $uploadfile || $uploadfiletext ) ) { > my $dirname = File::Temp::tempdir( CLEANUP => 1 ); > my $filesuffix; > $uploadfilename =~ s/[^A-Za-z0-9\-\.]//g; >+ >+ # Fix bug 27286 >+ if ( $uploadfilename !~ /^[^\.]+\.(png|gif|jpe?g|xpm|zip)$/i ) { >+ $errors{'BADFILENAME'} = 1; >+ } >+ > if ( $uploadfilename =~ m/(\..+)$/i ) { > $filesuffix = $1; > } >-- >2.39.5
You cannot view the attachment while viewing its details because your browser does not support IFRAMEs.
View the attachment on a separate page
.
View Attachment As Diff
View Attachment As Raw
Actions:
View
|
Diff
|
Splinter Review
Attachments on
bug 27286
:
114546
|
189978
|
190027