From c349abb321c4dd542145eb1424d80d6ddc80bbd7 Mon Sep 17 00:00:00 2001 From: Kyle M Hall Date: Thu, 28 Aug 2025 07:34:39 -0400 Subject: [PATCH] Bug 40719: Explicitly disable off RELATIVE file paths for plugins for user-entered templates In bug 39184 we set EVAL_PERL and ABSOLUTE to 0, which is the default. RELATIVE also defaults to 0. For security we should probably specify that as well in case the default is changed somehow. Test Plan: 1) Apply this patch 2) Generate some notices 3) No change should be noted! Signed-off-by: noah Signed-off-by: David Cook --- C4/Letters.pm | 1 + 1 file changed, 1 insertion(+) diff --git a/C4/Letters.pm b/C4/Letters.pm index c2f540c0723..26d866d7f04 100644 --- a/C4/Letters.pm +++ b/C4/Letters.pm @@ -1804,6 +1804,7 @@ sub _process_tt { { EVAL_PERL => 0, ABSOLUTE => 0, + RELATIVE => 0, PLUGIN_BASE => 'Koha::Template::Plugin', COMPILE_EXT => $use_template_cache ? '.ttc' : '', COMPILE_DIR => $use_template_cache ? C4::Context->config('template_cache_dir') : '', -- 2.39.5