From b1ddd2f5acf0f98382e55b8fbd2b6863e6163226 Mon Sep 17 00:00:00 2001 From: Marcel de Rooy Date: Wed, 25 Jan 2017 15:32:01 +0100 Subject: [PATCH] Bug 17989: Final changes Content-Type: text/plain; charset=utf-8 [1] The template sco/printslip.tt is in the regular modules directory. Should not be prefixed with a slash. [2] Script svc/members/search gets its template path from a URL parameter. When you git grep json_template, you will have an idea what values it should receive. Test plan: [1] Go intranet home page. Search for patrons in the combo box. Results? [2] Try the URL /cgi-bin/koha/svc/members/search. Should trigger a 500 error with Bad template path in the logs. [3] Try to find another occurrence just like the one corrected in sco/printslip.pl where an absolute path is passed to gettemplate or get_template_and_user. I already tried several regex variations while git grepping template_name, but you may still find one.. Signed-off-by: Marcel de Rooy --- opac/sco/printslip.pl | 2 +- svc/members/search | 10 +++++++--- 2 files changed, 8 insertions(+), 4 deletions(-) diff --git a/opac/sco/printslip.pl b/opac/sco/printslip.pl index b85b8f5..e94077d 100755 --- a/opac/sco/printslip.pl +++ b/opac/sco/printslip.pl @@ -45,7 +45,7 @@ my $error = $input->param('error'); # patrons still need to be able to print receipts my ( $template, $loggedinuser, $cookie ) = get_template_and_user( { - template_name => "/sco/printslip.tt", + template_name => "sco/printslip.tt", query => $input, type => "opac", } diff --git a/svc/members/search b/svc/members/search index 3276cf8..477a7d2 100755 --- a/svc/members/search +++ b/svc/members/search @@ -28,11 +28,15 @@ use Koha::DateUtils qw( output_pref dt_from_string ); use Koha::Patrons; my $input = new CGI; - -exit unless $input->param('template_path'); +my $template_path = $input->param('template_path'); +if( !$template_path || $template_path =~ /^\/|\.\./ ) { + # Do not allow absolute paths here + warn 'Bad template path'; + exit; +} my ($template, $user, $cookie) = get_template_and_user({ - template_name => scalar $input->param('template_path'), + template_name => $template_path, query => $input, type => "intranet", authnotrequired => 0, -- 2.1.4