Bugzilla – Attachment 24975 Details for
Bug 11662
member-picupload.pl can write to arbitrary files on the server
Home
|
New
|
Browse
|
Search
|
[?]
|
Reports
|
Help
|
New Account
|
Log In
[x]
|
Forgot Password
Login:
[x]
[patch]
[PASSED QA] Bug 11662: remove disused member-picupload.pl
PASSED-QA-Bug-11662-remove-disused-member-picuploa.patch (text/plain), 3.39 KB, created by
Katrin Fischer
on 2014-02-01 16:32:37 UTC
(
hide
)
Description:
[PASSED QA] Bug 11662: remove disused member-picupload.pl
Filename:
MIME Type:
Creator:
Katrin Fischer
Created:
2014-02-01 16:32:37 UTC
Size:
3.39 KB
patch
obsolete
>From c53fd4cc16428e202a85a58c5ccfb087fd158573 Mon Sep 17 00:00:00 2001 >From: Galen Charlton <gmc@esilibrary.com> >Date: Sat, 1 Feb 2014 02:11:38 +0000 >Subject: [PATCH] [PASSED QA] Bug 11662: remove disused member-picupload.pl > >This script is no longer used, and in addition has problematic >handling of its parameters that could lead to writing to >arbitrary files on the server. > >To test: > >[1] Verify that member-picupload.pl is no longer referred > to in the codebase after applying this patch. >[2] Verify that there are no regressions in patron > photo management. > >Signed-off-by: Galen Charlton <gmc@esilibrary.com> >Signed-off-by: Chris Cormack <chris@bigballofwax.co.nz> >Signed-off-by: Katrin Fischer <Katrin.Fischer.83@web.de> >Found no regressions in removing this script. >--- > members/member-picupload.pl | 77 --------------------------------------------- > 1 file changed, 77 deletions(-) > delete mode 100755 members/member-picupload.pl > >diff --git a/members/member-picupload.pl b/members/member-picupload.pl >deleted file mode 100755 >index 75bbea4..0000000 >--- a/members/member-picupload.pl >+++ /dev/null >@@ -1,77 +0,0 @@ >-#!/usr/bin/perl >- >- >-# script to upload a picture to a borrowerimages directory. >-# checks to see if its either displaying the upload form >-# or doing the actual upload. >-# written by Waylon Robertson (genjimoto@sourceforge) 2005/08/22 >- >- >-# Copyright 2000-2002 Katipo Communications >-# >-# This file is part of Koha. >-# >-# Koha is free software; you can redistribute it and/or modify it under the >-# terms of the GNU General Public License as published by the Free Software >-# Foundation; either version 2 of the License, or (at your option) any later >-# version. >-# >-# Koha is distributed in the hope that it will be useful, but WITHOUT ANY >-# WARRANTY; without even the implied warranty of MERCHANTABILITY or FITNESS FOR >-# A PARTICULAR PURPOSE. See the GNU General Public License for more details. >-# >-# You should have received a copy of the GNU General Public License along >-# with Koha; if not, write to the Free Software Foundation, Inc., >-# 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301 USA. >- >-use strict; >-use warnings; >- >-use C4::Auth; >-use C4::Context; >-use C4::Output; >-use CGI; >- >- >-my $input = new CGI; >-my $name = $input->param('name'); >-my $borrowernumber = $input->param('borrowernumber'); >-my $photo = $input->param('photo'); >- >-my $template_name; >-my $htdocs = C4::Context->config('intrahtdocs'); >-my $upload_dir = $htdocs."/borrowerimages"; >-if($photo eq ""){ >- $template_name = "members/member-picupload.tmpl"; >-} else { >- $template_name = "members/moremember.tmpl"; >-} >- >-my ($template, $loggedinuser, $cookie) >- = get_template_and_user({template_name => $template_name, >- query => $input, >- type => "intranet", >- authnotrequired => 0, >- flagsrequired => {borrowers => 1}, >- debug => 1, >- }); >-if ($photo){ >- >- my $filename=$borrowernumber.'.jpg'; >- my $upload_filehandle = $input->upload("photo"); >- open (my $upload_fh, '>', "$upload_dir/$filename"); >- binmode $upload_fh; >- while ( <$upload_filehandle> ) >- { >- print $upload_fh; >- } >- close $upload_fh; >-} >-else { >- $template->param( >- borrowernumber => $borrowernumber, >- name => $name >- ); >- output_html_with_http_headers $input, $cookie, $template->output; >-} >-print $input->redirect("http://intranet/cgi-bin/koha/members/moremember.pl?borrowernumber=$borrowernumber"); >-- >1.8.3.2
You cannot view the attachment while viewing its details because your browser does not support IFRAMEs.
View the attachment on a separate page
.
View Attachment As Diff
View Attachment As Raw
Actions:
View
|
Diff
|
Splinter Review
Attachments on
bug 11662
:
24968
|
24971
| 24975