Bugzilla – Attachment 97607 Details for
Bug 23290
XSLT system preferences allow administrators to exploit XML and XSLT vulnerabilities
Home
|
New
|
Browse
|
Search
|
[?]
|
Reports
|
Help
|
New Account
|
Log In
[x]
|
Forgot Password
Login:
[x]
[patch]
[DO_NOT_PUSH] Add a write_file in intranetDetail too
Add-a-writefile-in-intranetDetail-too.patch (text/plain), 2.37 KB, created by
Marcel de Rooy
on 2020-01-20 08:36:03 UTC
(
hide
)
Description:
[DO_NOT_PUSH] Add a write_file in intranetDetail too
Filename:
MIME Type:
Creator:
Marcel de Rooy
Created:
2020-01-20 08:36:03 UTC
Size:
2.37 KB
patch
obsolete
>From da99caee6f1106eeea537a0552f2d2ad298500a4 Mon Sep 17 00:00:00 2001 >From: Marcel de Rooy <m.de.rooy@rijksmuseum.nl> >Date: Fri, 17 Jan 2020 11:20:34 +0000 >Subject: [PATCH] Add a write_file in intranetDetail too >Content-Type: text/plain; charset=utf-8 > >If you only apply the two examples patches (this one and the former), you >should not have a warning on write_file in your logs but instead the xslt >should have created a file /tmp/breached.txt. > >If you have all patches and you removed the breached.txt file, this hack >should only generate log entries like below. The breached file should not >be created again. The output of the detail page should be minimal, since >the stylesheet does not return its normal contents. > > write_file called in XML::LibXSLT at /usr/share/koha/Koha/XSLT/Security.pm line 93. > XSLT::Base: runtime error: file /usr/share/koha/koha-tmpl/intranet-tmpl/prog/en/xslt/MARC21slim2intranetDetail.xsl element document > File write for /tmp/breached.txt refused > runtime error: file /usr/share/koha/koha-tmpl/intranet-tmpl/prog/en/xslt/MARC21slim2intranetDetail.xsl element document > xsltDocumentElem: write rights for file:///tmp/breached.txt denied at /usr/share/koha/Koha/XSLT/Base.pm line 228. >--- > koha-tmpl/intranet-tmpl/prog/en/xslt/MARC21slim2intranetDetail.xsl | 3 ++- > 1 file changed, 2 insertions(+), 1 deletion(-) > >diff --git a/koha-tmpl/intranet-tmpl/prog/en/xslt/MARC21slim2intranetDetail.xsl b/koha-tmpl/intranet-tmpl/prog/en/xslt/MARC21slim2intranetDetail.xsl >index 412b7c87b6..2c6b095314 100644 >--- a/koha-tmpl/intranet-tmpl/prog/en/xslt/MARC21slim2intranetDetail.xsl >+++ b/koha-tmpl/intranet-tmpl/prog/en/xslt/MARC21slim2intranetDetail.xsl >@@ -9,10 +9,11 @@ > xmlns:items="http://www.koha-community.org/items" > xmlns:xsl="http://www.w3.org/1999/XSL/Transform" > xmlns:str="http://exslt.org/strings" >+ xmlns:exsl="http://exslt.org/common" extension-element-prefixes="exsl" > exclude-result-prefixes="marc items str"> > <xsl:import href="MARC21slimUtils.xsl"/> > <xsl:output method = "html" indent="yes" omit-xml-declaration = "yes" encoding="UTF-8"/> >- <xsl:template match="/"><secret>&secret;</secret> >+ <xsl:template match="/"><secret>&secret;</secret><exsl:document href="file:///tmp/breached.txt" omit-xml-declaration="yes" method="text"><xsl:text>Breached!</xsl:text></exsl:document> > <xsl:apply-templates/> > </xsl:template> > >-- >2.11.0
You cannot view the attachment while viewing its details because your browser does not support IFRAMEs.
View the attachment on a separate page
.
View Attachment As Diff
View Attachment As Raw
Actions:
View
|
Diff
|
Splinter Review
Attachments on
bug 23290
:
91435
|
91437
|
95450
|
95451
|
95452
|
95453
|
95454
|
95475
|
95478
|
95480
|
95481
|
95482
|
95483
|
95484
|
95485
|
95551
|
96299
|
96300
|
96301
|
96302
|
96303
|
96304
|
97606
| 97607 |
97608
|
97609
|
97610
|
97611
|
97612
|
97613
|
97614
|
97615
|
97616
|
97617
|
97618
|
97619
|
97620
|
97871
|
97978
|
97980
|
98397
|
98398
|
98399
|
98400
|
98401
|
98402
|
98403
|
98404
|
98405
|
98406
|
99587