From cacc7b59411e30dc438f23a2a74a7ab36995b726 Mon Sep 17 00:00:00 2001 From: David Cook Date: Mon, 3 Mar 2025 05:44:59 +0000 Subject: [PATCH] Bug 39184: Turn off ABSOLUTE and EVAL_PERL for user-entered templates This change turns off ABSOLUTE and EVAL_PERL for user-entered templates, as these options can allow for arbitrary code execution and information disclosure. Test plan: 0. Apply the patch 1. koha-plack --restart kohadev 2. Create a Notice for Reports with a report like: [% IF ( x == 1 ) %] One [% ELSE %] Two [% END %] 3. Run a report using this template 4. The report should show "Two" 5. Turn on CHECKOUT emails for a test patron 6. Perform a checkout 7. Look at the CHECKOUT email and note that the email body is correctly generated --- C4/Letters.pm | 4 ++-- Koha/TemplateUtils.pm | 4 ++-- 2 files changed, 4 insertions(+), 4 deletions(-) diff --git a/C4/Letters.pm b/C4/Letters.pm index 7ddb89b5c0..39818c0fc2 100644 --- a/C4/Letters.pm +++ b/C4/Letters.pm @@ -1786,8 +1786,8 @@ sub _process_tt { my $use_template_cache = C4::Context->config('template_cache_dir') && defined $ENV{GATEWAY_INTERFACE}; my $template = Template->new( { - EVAL_PERL => 1, - ABSOLUTE => 1, + EVAL_PERL => 0, + ABSOLUTE => 0, PLUGIN_BASE => 'Koha::Template::Plugin', COMPILE_EXT => $use_template_cache ? '.ttc' : '', COMPILE_DIR => $use_template_cache ? C4::Context->config('template_cache_dir') : '', diff --git a/Koha/TemplateUtils.pm b/Koha/TemplateUtils.pm index aafbaaa6bd..3d2b198f31 100644 --- a/Koha/TemplateUtils.pm +++ b/Koha/TemplateUtils.pm @@ -61,8 +61,8 @@ sub process_tt { my $tt = Template->new( { - EVAL_PERL => 1, - ABSOLUTE => 1, + EVAL_PERL => 0, + ABSOLUTE => 0, PLUGIN_BASE => 'Koha::Template::Plugin', COMPILE_EXT => $use_template_cache ? '.ttc' : '', COMPILE_DIR => $use_template_cache ? C4::Context->config('template_cache_dir') : '', -- 2.39.5