From f4c8954f1054ecade6c465ab7415e222d3f6574e Mon Sep 17 00:00:00 2001 From: David Cook Date: Mon, 3 Mar 2025 05:44:59 +0000 Subject: [PATCH] Bug 39184: Turn off ABSOLUTE and EVAL_PERL for user-entered templates Content-Type: text/plain; charset=utf-8 This change turns off ABSOLUTE and EVAL_PERL for user-entered templates, as these options can allow for arbitrary code execution and information disclosure. Test plan: 0. Apply the patch 1. koha-plack --restart kohadev 2. Create a Notice for Reports with a report like: [% IF ( x == 1 ) %] One [% ELSE %] Two [% END %] 3. Run a report using this template 4. The report should show "Two" 5. Turn on CHECKOUT emails for a test patron 6. Perform a checkout 7. Look at the CHECKOUT email and note that the email body is correctly generated Signed-off-by: Magnus Enger Would be good to have this fixed as the default. Signed-off-by: Marcel de Rooy The test plan should include PERL blocks or absolute paths! Tested those instead. Testing x==1 seems irrelevant. I tried:[% PERL %]print 1;[% END %] and [% INCLUDE /app/Dockerfile_1 %] --- C4/Letters.pm | 4 ++-- Koha/TemplateUtils.pm | 4 ++-- 2 files changed, 4 insertions(+), 4 deletions(-) diff --git a/C4/Letters.pm b/C4/Letters.pm index b7c6b0cedd..87c71d16d1 100644 --- a/C4/Letters.pm +++ b/C4/Letters.pm @@ -1810,8 +1810,8 @@ sub _process_tt { my $use_template_cache = C4::Context->config('template_cache_dir') && defined $ENV{GATEWAY_INTERFACE}; my $template = Template->new( { - EVAL_PERL => 1, - ABSOLUTE => 1, + EVAL_PERL => 0, + ABSOLUTE => 0, PLUGIN_BASE => 'Koha::Template::Plugin', COMPILE_EXT => $use_template_cache ? '.ttc' : '', COMPILE_DIR => $use_template_cache ? C4::Context->config('template_cache_dir') : '', diff --git a/Koha/TemplateUtils.pm b/Koha/TemplateUtils.pm index aafbaaa6bd..3d2b198f31 100644 --- a/Koha/TemplateUtils.pm +++ b/Koha/TemplateUtils.pm @@ -61,8 +61,8 @@ sub process_tt { my $tt = Template->new( { - EVAL_PERL => 1, - ABSOLUTE => 1, + EVAL_PERL => 0, + ABSOLUTE => 0, PLUGIN_BASE => 'Koha::Template::Plugin', COMPILE_EXT => $use_template_cache ? '.ttc' : '', COMPILE_DIR => $use_template_cache ? C4::Context->config('template_cache_dir') : '', -- 2.39.5