Attachment 59632 Details for Bug 18010 – Bug 18010: Remove potential exposure from gettemplate

[patch] Bug 18010: Remove potential exposure from gettemplate

Bug-18010-Remove-potential-exposure-from-gettempla.patch (text/plain), 1.93 KB, created by Marcel de Rooy on 2017-01-29 15:23:19 UTC

(hide)

Description:

Filename:

MIME Type:

Creator: Marcel de Rooy

Created: 2017-01-29 15:23:19 UTC

Size: 1.93 KB

patch

obsolete

>From 655fc1d4d5e01ef8eb4e82ce087c5209f9c1a3f2 Mon Sep 17 00:00:00 2001
>From: Marcel de Rooy <m.de.rooy@rijksmuseum.nl>
>Date: Sun, 29 Jan 2017 15:40:14 +0100
>Subject: [PATCH] Bug 18010: Remove potential exposure from gettemplate
>Content-Type: text/plain; charset=utf-8
>
>A similar bad template check from C4::Auth::get_template_and_user
>should be applied in C4::Templates::gettemplate.
>
>Before this patch it would be possible to expose files like:
>my $template = C4::Templates::gettemplate(
>    '/etc/passwd', 'intranet', CGI::new, 1
>);
>print $template->output;
>
>Note that the is_plugin flag in the above call is the culprit. This patch
>provides a quick security fix without touching get_template_and_user, and
>can be backported to stable branches.
>I will provide an enhanced and centralized check on report 17989, also
>removing the is_plugin flag.
>
>Note: We allow .pref here too for use in admin/preferences.pl.
>
>Test plan:
>[1] Run t/db_dependent/Auth.t (triggering get_template_and_user and
>    gettemplate).
>[2] Run t/db_dependent/Templates.t again (see first test plan).
>    The tests should no longer fail.
>[3] Open a page on opac or intranet.
>[4] Open a systempreferences tab.
>[5] Add a book to the cart and send it ([opac-]sendbasket uses gettemplate).
>
>Signed-off-by: Marcel de Rooy <m.de.rooy@rijksmuseum.nl>
>---
> C4/Templates.pm | 1 +
> 1 file changed, 1 insertion(+)
>
>diff --git a/C4/Templates.pm b/C4/Templates.pm
>index eebff11..21ba7d7 100644
>--- a/C4/Templates.pm
>+++ b/C4/Templates.pm
>@@ -171,6 +171,7 @@ sub _get_template_file {
> sub gettemplate {
>     my ( $tmplbase, $interface, $query, $is_plugin ) = @_;
>     ($query) or warn "no query in gettemplate";
>+    die "bad template path" unless $tmplbase =~ m/^[a-zA-Z0-9_\-\/]+\.(tt|pref)$/; # Will be extended on bug 17989
>     my $path = C4::Context->preference('intranet_includes') || 'includes';
>     my ($htdocs, $theme, $lang, $filename)
>        =  _get_template_file($tmplbase, $interface, $query);
>-- 
>2.1.4

Actions: View | Diff | Splinter Review

Attachments on bug 18010: 59631 | 59632 | 60418 | 60419 | 61340 | 61341 | 61344 | 61345