From 29d09d1b10c53e93b0b7ff029fc1b86d6366355b Mon Sep 17 00:00:00 2001 From: Saiful Amin Date: Wed, 26 Nov 2025 18:43:30 +0000 Subject: [PATCH] Bug 27286: Patron picture-upload.pl allows arbitrary file extension during upload This patch introduces strict validation for filenames in the patron image upload tool. It addresses VAPT security concerns regarding "double extension" attacks (e.g., image.php.jpg or archive.php.zip). The patch ensures that: 1. Filenames containing more than one period are rejected. 2. Only strictly allowed extensions (zip, png, gif, jpg, jpeg, xpm) are accepted. Test Plan: 1. Pre-patch check: a. Go to Tools -> Upload patron images. b. Rename an image file to 'test.php.jpg'. c. Upload this file. d. Observe that the upload is accepted, but the filename itself is not flagged as invalid. e. Create a valid file named 'test.php.zip' (with valid content). f. Upload this file. g. Result: The upload proceeds. 2. Apply the patch. 3. Verify rejection (images): a. Go to Tools -> Upload patron images. b. Attempt to upload 'test.php.jpg'. c. Result: The tool stops immediately with a "BADFILENAME" error message. d. Attempt to upload 'test.v1.jpg' (valid image, extra dot). e. Result: The tool stops immediately with a "BADFILENAME" error message. 4. Verify rejection (zip): a. Attempt to upload 'archive.php.zip'. b. Result: The tool stops immediately with a "BADFILENAME" error message. 5. Verify valid upload: a. Attempt to upload 'patron.jpg' (standard valid file). b. Result: Upload succeeds. c. Attempt to upload 'patrons.zip' (standard valid zip). d. Result: Upload succeeds and files are unpacked. 6. Sign-off. Signed-off-by: David Nind --- .../intranet-tmpl/prog/en/modules/tools/picture-upload.tt | 5 +++++ tools/picture-upload.pl | 6 ++++++ 2 files changed, 11 insertions(+) diff --git a/koha-tmpl/intranet-tmpl/prog/en/modules/tools/picture-upload.tt b/koha-tmpl/intranet-tmpl/prog/en/modules/tools/picture-upload.tt index de2cb82848..0a654c8eeb 100644 --- a/koha-tmpl/intranet-tmpl/prog/en/modules/tools/picture-upload.tt +++ b/koha-tmpl/intranet-tmpl/prog/en/modules/tools/picture-upload.tt @@ -136,6 +136,11 @@
  • This script is not able to create/write to the necessary temporary directory.
  • [% ELSIF ( ERROR.EMPTYUPLOAD ) %]
  • The upload file appears to be empty.
  • + [% ELSIF ( ERROR.BADFILENAME ) %] +
  • + The uploaded filename is invalid. + Filenames must have exactly one extension and no other periods (e.g. "patron.jpg", not "patron.v1.jpg"). +
  • [% ELSIF ( ERROR.OPNLINK ) %]
  • Cannot open [% ERROR.OPNLINK | html %] to read.
    Please verify that it exists.
  • 1 ); my $filesuffix; $uploadfilename =~ s/[^A-Za-z0-9\-\.]//g; + + # Fix bug 27286 + if ( $uploadfilename !~ /^[^\.]+\.(png|gif|jpe?g|xpm|zip)$/i ) { + $errors{'BADFILENAME'} = 1; + } + if ( $uploadfilename =~ m/(\..+)$/i ) { $filesuffix = $1; } -- 2.39.5