From 2eaf4cc857cf582b7592c5426d65554926494d17 Mon Sep 17 00:00:00 2001
From: Chris Cormack <chrisc@catalyst.net.nz>
Date: Fri, 19 Jun 2015 09:07:44 +1200
Subject: [PATCH] Bug 14408 Path traversal vulnerability

/cgi-bin/koha/svc/virtualshelves/search
/cgi-bin/koha/svc/members/search

Are vulnerable

To test:
1/ Hit /cgi-bin/koha/svc/members/search?template_path=members/tables/members_results.tt
  Notice you get a valid JSON response
2/ Hit
/search?template_path=..%2f..%2f..%2f..%2f..%2f..%2f..%2f..%2f..%2f..%2f..%2f..%2f..%2f..%2f..%2f..%2fetc%2fpasswd
  (You may have add more ..%2f or remove them to get the correct path)
  Notice you can see the contents of the /etc/passwd file
3/ Apply patch
4/ Hit the first url again, notice it still works
5/ Hit the second url notice it now errors with a file not found

Repeat for the other script also
---
 svc/members/search        | 4 +++-
 svc/virtualshelves/search | 4 +++-
 2 files changed, 6 insertions(+), 2 deletions(-)

diff --git a/svc/members/search b/svc/members/search
index 6343e2e..caf4682 100755
--- a/svc/members/search
+++ b/svc/members/search
@@ -29,9 +29,11 @@ use Koha::DateUtils qw( output_pref dt_from_string );
 my $input = new CGI;
 
 exit unless $input->param('template_path');
+my $template_path= $input->param('template_path');
+ $template_path =~ s/[^a-zA-Z_-]*//; #sanitzie
 
 my ($template, $user, $cookie) = get_template_and_user({
-    template_name   => $input->param('template_path'),
+    template_name   => $template_path,
     query           => $input,
     type            => "intranet",
     authnotrequired => 0,
diff --git a/svc/virtualshelves/search b/svc/virtualshelves/search
index ef1448c..b33b03e 100755
--- a/svc/virtualshelves/search
+++ b/svc/virtualshelves/search
@@ -12,8 +12,10 @@ my $input = new CGI;
 
 exit unless $input->param('template_path');
 
+my $template_path= $input->param('template_path');
+ $template_path =~ s/[^a-zA-Z_-]*//; #sanitzie
 my ($template, $user, $cookie) = get_template_and_user({
-    template_name   => $input->param('template_path'),
+    template_name   => $template_path,
     query           => $input,
     type            => "intranet",
     authnotrequired => 0,
-- 
2.1.4