Bugzilla – Attachment 24976 Details for
Bug 11660
tools/pdfViewer.pl is vulnerable to displaying the contents of an arbitrary file on the server
Home
|
New
|
Browse
|
Search
|
[?]
|
Reports
|
Help
|
New Account
|
Log In
[x]
|
Forgot Password
Login:
[x]
[patch]
[PASSED QA] Bug 11660: remove disused tools/pdfViewer.pl
PASSED-QA-Bug-11660-remove-disused-toolspdfViewerp.patch (text/plain), 2.25 KB, created by
Katrin Fischer
on 2014-02-01 16:37:52 UTC
(
hide
)
Description:
[PASSED QA] Bug 11660: remove disused tools/pdfViewer.pl
Filename:
MIME Type:
Creator:
Katrin Fischer
Created:
2014-02-01 16:37:52 UTC
Size:
2.25 KB
patch
obsolete
>From f18259f75897979d21a00aa1b3fe358035685acc Mon Sep 17 00:00:00 2001 >From: Chris Cormack <chris@bigballofwax.co.nz> >Date: Sat, 1 Feb 2014 14:18:23 +1300 >Subject: [PATCH] [PASSED QA] Bug 11660: remove disused tools/pdfViewer.pl > >tools/pdfViewer.pl can be used to read artibrary files on the system. > >It is actually an unused file, so leaving it around serves no purpose >and is dangerous. > >Signed-off-by: Galen Charlton <gmc@esilibrary.com> >Signed-off-by: Katrin Fischer <Katrin.Fischer.83@web.de> >No regressions found. >--- > tools/pdfViewer.pl | 42 ------------------------------------------ > 1 file changed, 42 deletions(-) > delete mode 100755 tools/pdfViewer.pl > >diff --git a/tools/pdfViewer.pl b/tools/pdfViewer.pl >deleted file mode 100755 >index 8e6a98f..0000000 >--- a/tools/pdfViewer.pl >+++ /dev/null >@@ -1,42 +0,0 @@ >-#!/usr/bin/perl >- >-# script to show a PDF file. >-# written 07/04 >-# by Veleda Matias - matias_veleda@hotmail.com - Physics Library UNLP Argentina and >-# Castañeda Sebastian - seba3c@yahoo.com.ar - Physics Library UNLP Argentina and >- >-# This file is part of Koha. >-# >-# Koha is free software; you can redistribute it and/or modify it under the >-# terms of the GNU General Public License as published by the Free Software >-# Foundation; either version 2 of the License, or (at your option) any later >-# version. >-# >-# Koha is distributed in the hope that it will be useful, but WITHOUT ANY >-# WARRANTY; without even the implied warranty of MERCHANTABILITY or FITNESS FOR >-# A PARTICULAR PURPOSE. See the GNU General Public License for more details. >-# >-# You should have received a copy of the GNU General Public License along with >-# Koha; if not, write to the Free Software Foundation, Inc., 59 Temple Place, >-# Suite 330, Boston, MA 02111-1307 USA >- >- >- >-use strict; >-#use warnings; FIXME - Bug 2505 >-use C4::Context; >-use CGI; >- >-# This script take a pdf filename as a parameter and output it to the browser. >-my $cgi = new CGI; >-my $filename = "barcodes.pdf"; >-my $tmpFileName = $cgi->param('tmpFileName'); >-print "Content-Disposition: attachment; filename = $filename\n\n"; >-print $cgi->header(-type => 'application/pdf'), >- $cgi->start_html(-title=>"Codify to PDF"); >-open FH, "<$tmpFileName"; >-while (<FH>) { >- print; >-} >-close FH; >-print $cgi->end_html(); >-- >1.8.3.2
You cannot view the attachment while viewing its details because your browser does not support IFRAMEs.
View the attachment on a separate page
.
View Attachment As Diff
View Attachment As Raw
Actions:
View
|
Diff
|
Splinter Review
Attachments on
bug 11660
:
24967
|
24969
| 24976