Attachment 66321 Details for Bug 17989 – [SIGNED-OFF] Bug 17989: Final changes

[patch] [SIGNED-OFF] Bug 17989: Final changes

SIGNED-OFF-Bug-17989-Final-changes.patch (text/plain), 2.40 KB, created by Josef Moravec on 2017-08-22 10:58:39 UTC

(hide)

Description:

Filename:

MIME Type:

Creator: Josef Moravec

Created: 2017-08-22 10:58:39 UTC

Size: 2.40 KB

patch

obsolete

>From 06fb677a4ec3b1c0c3cb7948ec1aafb6e23cc5dc Mon Sep 17 00:00:00 2001
>From: Marcel de Rooy <m.de.rooy@rijksmuseum.nl>
>Date: Wed, 25 Jan 2017 15:32:01 +0100
>Subject: [PATCH] [SIGNED-OFF] Bug 17989: Final changes
>
>[1] The template sco/printslip.tt is in the regular modules directory.
>Should not be prefixed with a slash.
>[2] Script svc/members/search gets its template path from a URL parameter.
>When you git grep json_template, you will have an idea what values it
>should receive.
>
>Test plan:
>[1] Go intranet home page. Search for patrons in the combo box. Results?
>[2] Try the URL /cgi-bin/koha/svc/members/search. Should trigger a 500
>    error with Bad template path in the logs.
>[3] Try to find another occurrence just like the one corrected in
>    sco/printslip.pl where an absolute path is passed to gettemplate or
>    get_template_and_user. I already tried several regex variations
>    while git grepping template_name, but you may still find one..
>
>Signed-off-by: Marcel de Rooy <m.de.rooy@rijksmuseum.nl>
>
>Signed-off-by: Josef Moravec <josef.moravec@gmail.com>
>---
> opac/sco/printslip.pl |  2 +-
> svc/members/search    | 10 +++++++---
> 2 files changed, 8 insertions(+), 4 deletions(-)
>
>diff --git a/opac/sco/printslip.pl b/opac/sco/printslip.pl
>index b85b8f5..e94077d 100755
>--- a/opac/sco/printslip.pl
>+++ b/opac/sco/printslip.pl
>@@ -45,7 +45,7 @@ my $error = $input->param('error');
> # patrons still need to be able to print receipts
> my ( $template, $loggedinuser, $cookie ) = get_template_and_user(
>     {
>-        template_name   => "/sco/printslip.tt",
>+        template_name   => "sco/printslip.tt",
>         query           => $input,
>         type            => "opac",
>     }
>diff --git a/svc/members/search b/svc/members/search
>index 3276cf8..477a7d2 100755
>--- a/svc/members/search
>+++ b/svc/members/search
>@@ -28,11 +28,15 @@ use Koha::DateUtils qw( output_pref dt_from_string );
> use Koha::Patrons;
> 
> my $input = new CGI;
>-
>-exit unless $input->param('template_path');
>+my $template_path = $input->param('template_path');
>+if( !$template_path || $template_path =~ /^\/|\.\./ ) {
>+    # Do not allow absolute paths here
>+    warn 'Bad template path';
>+    exit;
>+}
> 
> my ($template, $user, $cookie) = get_template_and_user({
>-    template_name   => scalar $input->param('template_path'),
>+    template_name   => $template_path,
>     query           => $input,
>     type            => "intranet",
>     authnotrequired => 0,
>-- 
>2.1.4

Actions: View | Diff | Splinter Review

Attachments on bug 17989: 65277 | 65278 | 65279 | 65280 | 65281 | 66272 | 66273 | 66274 | 66275 | 66276 | 66317 | 66318 | 66319 | 66320 | 66321 | 67514 | 67515 | 67516 | 67517 | 67518 | 68654 | 68667 | 68668 | 68669 | 68670 | 68671 | 68672 | 68842 | 68843