Bugzilla – Attachment 40493 Details for
Bug 14408
Path traversal vulnerabilty
Home
|
New
|
Browse
|
Search
|
[?]
|
Reports
|
Help
|
New Account
|
Log In
[x]
|
Forgot Password
Login:
[x]
[patch]
[PASSED QA] Bug 14408: Allow integers in template paths
PASSED-QA-Bug-14408-Allow-integers-in-template-pat.patch (text/plain), 1.97 KB, created by
Katrin Fischer
on 2015-06-22 20:32:17 UTC
(
hide
)
Description:
[PASSED QA] Bug 14408: Allow integers in template paths
Filename:
MIME Type:
Creator:
Katrin Fischer
Created:
2015-06-22 20:32:17 UTC
Size:
1.97 KB
patch
obsolete
>From 4a47ec4fc78df878b26f87c8d19d32a0b7e892fd Mon Sep 17 00:00:00 2001 >From: Jonathan Druart <jonathan.druart@koha-community.org> >Date: Mon, 22 Jun 2015 10:24:51 +0200 >Subject: [PATCH] [PASSED QA] Bug 14408: Allow integers in template paths > >Signed-off-by: Jonathan Druart <jonathan.druart@koha-community.org> > >Signed-off-by: Katrin Fischer <katrin.fischer.83@web.de> >--- > C4/Auth.pm | 2 +- > t/db_dependent/Auth.t | 13 ++++++++++++- > 2 files changed, 13 insertions(+), 2 deletions(-) > >diff --git a/C4/Auth.pm b/C4/Auth.pm >index 1f1b734..c917cdb 100644 >--- a/C4/Auth.pm >+++ b/C4/Auth.pm >@@ -158,7 +158,7 @@ sub get_template_and_user { > > C4::Context->interface( $in->{type} ); > >- my $safe_chars = 'a-zA-Z_\-\/'; >+ my $safe_chars = 'a-zA-Z0-9_\-\/'; > die "bad template path" unless $in->{'template_name'} =~ m/^[$safe_chars]+.tt?$/ig; #sanitize input > > $in->{'authnotrequired'} ||= 0; >diff --git a/t/db_dependent/Auth.t b/t/db_dependent/Auth.t >index 8513240..43e1aa8 100644 >--- a/t/db_dependent/Auth.t >+++ b/t/db_dependent/Auth.t >@@ -8,7 +8,7 @@ use Modern::Perl; > use CGI qw ( -utf8 ); > use Test::MockModule; > use List::MoreUtils qw/all any none/; >-use Test::More tests => 11; >+use Test::More tests => 12; > use Test::Warn; > use C4::Members; > use Koha::AuthUtils qw/hash_password/; >@@ -127,6 +127,17 @@ $dbh->{RaiseError} = 1; > }; > like ( $@, qr(^bad template path), 'The file $template_name should not be accessible' ); > } >+ ( $template, $loggedinuser, $cookies ) = get_template_and_user( >+ { >+ template_name => 'errors/500.tt', >+ query => $query, >+ type => "intranet", >+ authnotrequired => 1, >+ flagsrequired => { catalogue => 1 }, >+ } >+ ); >+ my $file_exists = ( -f $template->{filename} ) ? 1 : 0; >+ is ( $file_exists, 1, 'The file errors/500.tt should be accessible (contains integers)' ); > } > > # Check that there is always an OPACBaseURL set. >-- >1.9.1
You cannot view the attachment while viewing its details because your browser does not support IFRAMEs.
View the attachment on a separate page
.
View Attachment As Diff
View Attachment As Raw
Actions:
View
|
Diff
|
Splinter Review
Attachments on
bug 14408
:
40271
|
40336
|
40347
|
40348
|
40374
|
40375
|
40386
|
40387
|
40443
|
40445
|
40446
|
40447
|
40491
|
40492
| 40493 |
40564
|
40610