Attachment 40447 Details for Bug 14408 – Bug 14408: Allow integers in template paths

[patch] Bug 14408: Allow integers in template paths

Bug-14408-Allow-integers-in-template-paths.patch (text/plain), 1.95 KB, created by Jonathan Druart on 2015-06-22 08:25:53 UTC

(hide)

Description:

Filename:

MIME Type:

Creator: Jonathan Druart

Created: 2015-06-22 08:25:53 UTC

Size: 1.95 KB

patch

obsolete

>From 84cb45c3e85ee2f491c49f063c7fef4b09d6418a Mon Sep 17 00:00:00 2001
>From: Jonathan Druart <jonathan.druart@koha-community.org>
>Date: Mon, 22 Jun 2015 10:24:51 +0200
>Subject: [PATCH] Bug 14408: Allow integers in template paths
>
>Signed-off-by: Jonathan Druart <jonathan.druart@koha-community.org>
>---
> C4/Auth.pm            |  4 ++--
> t/db_dependent/Auth.t | 13 ++++++++++++-
> 2 files changed, 14 insertions(+), 3 deletions(-)
>
>diff --git a/C4/Auth.pm b/C4/Auth.pm
>index c140318..c917cdb 100644
>--- a/C4/Auth.pm
>+++ b/C4/Auth.pm
>@@ -157,8 +157,8 @@ sub get_template_and_user {
>     my ( $user, $cookie, $sessionID, $flags );
> 
>     C4::Context->interface( $in->{type} );
>-    
>-    my $safe_chars = 'a-zA-Z_\-\/';
>+
>+    my $safe_chars = 'a-zA-Z0-9_\-\/';
>     die "bad template path" unless $in->{'template_name'} =~ m/^[$safe_chars]+.tt?$/ig; #sanitize input
> 
>     $in->{'authnotrequired'} ||= 0;
>diff --git a/t/db_dependent/Auth.t b/t/db_dependent/Auth.t
>index 8513240..43e1aa8 100644
>--- a/t/db_dependent/Auth.t
>+++ b/t/db_dependent/Auth.t
>@@ -8,7 +8,7 @@ use Modern::Perl;
> use CGI qw ( -utf8 );
> use Test::MockModule;
> use List::MoreUtils qw/all any none/;
>-use Test::More tests => 11;
>+use Test::More tests => 12;
> use Test::Warn;
> use C4::Members;
> use Koha::AuthUtils qw/hash_password/;
>@@ -127,6 +127,17 @@ $dbh->{RaiseError} = 1;
>         };
>         like ( $@, qr(^bad template path), 'The file $template_name should not be accessible' );
>     }
>+    ( $template, $loggedinuser, $cookies ) = get_template_and_user(
>+        {
>+            template_name   => 'errors/500.tt',
>+            query           => $query,
>+            type            => "intranet",
>+            authnotrequired => 1,
>+            flagsrequired   => { catalogue => 1 },
>+        }
>+    );
>+    my $file_exists = ( -f $template->{filename} ) ? 1 : 0;
>+    is ( $file_exists, 1, 'The file errors/500.tt should be accessible (contains integers)' );
> }
> 
> # Check that there is always an OPACBaseURL set.
>-- 
>2.1.0

Actions: View | Diff | Splinter Review

Attachments on bug 14408: 40271 | 40336 | 40347 | 40348 | 40374 | 40375 | 40386 | 40387 | 40443 | 40445 | 40446 | 40447 | 40491 | 40492 | 40493 | 40564 | 40610