From 7f932ff6833f92cc6445bf580a6dbbb13d1e5aaa Mon Sep 17 00:00:00 2001 From: Andreas Jonsson Date: Thu, 7 Mar 2024 09:12:25 +0000 Subject: [PATCH] Bug 36244: Do template toolkit processing first To avoid injection of template toolkit code from database fields that are controlled by untrusted sources. Test plan: * review subtest 'Template toolkit syntax in parameters' in t/db_dependent/Letters.t * Run the unit test: prove t/db_dependent/Letters.t Signed-off-by: Jonathan Druart Signed-off-by: Marcel de Rooy Signed-off-by: Kyle M Hall --- C4/Letters.pm | 38 +++++++++++++++++++------------------- 1 file changed, 19 insertions(+), 19 deletions(-) diff --git a/C4/Letters.pm b/C4/Letters.pm index 6b19fc72523..1e4e817e03e 100644 --- a/C4/Letters.pm +++ b/C4/Letters.pm @@ -597,6 +597,25 @@ sub GetPreparedLetter { return; my $want_librarian = $params{want_librarian}; + $letter->{content} = _process_tt( + { + content => $letter->{content}, + tables => $tables, + loops => $loops, + substitute => $substitute, + lang => $lang + } + ); + + $letter->{title} = _process_tt( + { + content => $letter->{title}, + tables => $tables, + loops => $loops, + substitute => $substitute, + } + ); + if (%$substitute) { while ( my ($token, $val) = each %$substitute ) { $val //= q{}; @@ -667,25 +686,6 @@ sub GetPreparedLetter { } } - $letter->{content} = _process_tt( - { - content => $letter->{content}, - tables => $tables, - loops => $loops, - substitute => $substitute, - lang => $lang - } - ); - - $letter->{title} = _process_tt( - { - content => $letter->{title}, - tables => $tables, - loops => $loops, - substitute => $substitute, - } - ); - $letter->{content} =~ s/<<\S*>>//go; #remove any stragglers return $letter; -- 2.34.1