From b1ddd2f5acf0f98382e55b8fbd2b6863e6163226 Mon Sep 17 00:00:00 2001
From: Marcel de Rooy <m.de.rooy@rijksmuseum.nl>
Date: Wed, 25 Jan 2017 15:32:01 +0100
Subject: [PATCH] Bug 17989: Final changes
Content-Type: text/plain; charset=utf-8

[1] The template sco/printslip.tt is in the regular modules directory.
Should not be prefixed with a slash.
[2] Script svc/members/search gets its template path from a URL parameter.
When you git grep json_template, you will have an idea what values it
should receive.

Test plan:
[1] Go intranet home page. Search for patrons in the combo box. Results?
[2] Try the URL /cgi-bin/koha/svc/members/search. Should trigger a 500
    error with Bad template path in the logs.
[3] Try to find another occurrence just like the one corrected in
    sco/printslip.pl where an absolute path is passed to gettemplate or
    get_template_and_user. I already tried several regex variations
    while git grepping template_name, but you may still find one..

Signed-off-by: Marcel de Rooy <m.de.rooy@rijksmuseum.nl>
---
 opac/sco/printslip.pl |  2 +-
 svc/members/search    | 10 +++++++---
 2 files changed, 8 insertions(+), 4 deletions(-)

diff --git a/opac/sco/printslip.pl b/opac/sco/printslip.pl
index b85b8f5..e94077d 100755
--- a/opac/sco/printslip.pl
+++ b/opac/sco/printslip.pl
@@ -45,7 +45,7 @@ my $error = $input->param('error');
 # patrons still need to be able to print receipts
 my ( $template, $loggedinuser, $cookie ) = get_template_and_user(
     {
-        template_name   => "/sco/printslip.tt",
+        template_name   => "sco/printslip.tt",
         query           => $input,
         type            => "opac",
     }
diff --git a/svc/members/search b/svc/members/search
index 3276cf8..477a7d2 100755
--- a/svc/members/search
+++ b/svc/members/search
@@ -28,11 +28,15 @@ use Koha::DateUtils qw( output_pref dt_from_string );
 use Koha::Patrons;
 
 my $input = new CGI;
-
-exit unless $input->param('template_path');
+my $template_path = $input->param('template_path');
+if( !$template_path || $template_path =~ /^\/|\.\./ ) {
+    # Do not allow absolute paths here
+    warn 'Bad template path';
+    exit;
+}
 
 my ($template, $user, $cookie) = get_template_and_user({
-    template_name   => scalar $input->param('template_path'),
+    template_name   => $template_path,
     query           => $input,
     type            => "intranet",
     authnotrequired => 0,
-- 
2.1.4