From 2bca270fa5fe67d679121625924b1dc711f441f3 Mon Sep 17 00:00:00 2001
From: Chris Cormack <chris@bigballofwax.co.nz>
Date: Wed, 8 May 2024 22:41:43 +0000
Subject: [PATCH] Bug: 36818 Escape characters in file names uploaded

To test:
1/ create a file named something like 'execute`curl blog.bigballofwax.co.nz`.zip'
   Where the domain is one you can watch the logs from
2/ Upload this file as a cover image
3/ Check /var/lib/koha/sitename/tmp/koha_sitename/ and see unescaped filenames
4/ Choose process, check the logs of the webserver see the connection has been made
5/ Apply the patch
5/ Repeat 2 & 3 and see the filename is now escaped
6/ Choose process and check no errors but no no remote execution occurs
7/ Test uploading actual zip file and images still works
---
 Koha/Uploader.pm | 1 +
 1 file changed, 1 insertion(+)

diff --git a/Koha/Uploader.pm b/Koha/Uploader.pm
index 8fbb06a14c9..39aee036b95 100644
--- a/Koha/Uploader.pm
+++ b/Koha/Uploader.pm
@@ -264,6 +264,7 @@ sub _dir {
 sub _hook {
     my ( $self, $filename, $buffer, $bytes_read, $data ) = @_;
     $filename= Encode::decode_utf8( $filename ); # UTF8 chars in filename
+    $filename =~ s/[^A-Za-z0-9\-\.]//g;
     $self->_compute( $filename, $buffer );
     my $fh = $self->_fh( $filename ) // $self->_create_file( $filename );
     print $fh $buffer if $fh;
-- 
2.39.2