View | Details | Raw Unified | Return to bug 17989
Collapse All | Expand All

(-)a/C4/Auth.pm (-3 / +2 lines)
Lines 161-170 sub get_template_and_user { Link Here
161
161
162
    C4::Context->interface( $in->{type} );
162
    C4::Context->interface( $in->{type} );
163
163
164
    my $safe_chars = 'a-zA-Z0-9_\-\/';
165
    die "bad template path" unless $in->{'template_name'} =~ m/^[$safe_chars]+\.tt$/ig; #sanitize input
166
167
    $in->{'authnotrequired'} ||= 0;
164
    $in->{'authnotrequired'} ||= 0;
165
166
    # the following call includes a bad template check; might croak
168
    my $template = C4::Templates::gettemplate(
167
    my $template = C4::Templates::gettemplate(
169
        $in->{'template_name'},
168
        $in->{'template_name'},
170
        $in->{'type'},
169
        $in->{'type'},
(-)a/C4/Templates.pm (-2 / +18 lines)
Lines 37-42 use C4::Languages qw(getTranslatedLanguages get_bidi regex_lang_subtags language Link Here
37
use C4::Context;
37
use C4::Context;
38
38
39
use Koha::Cache::Memory::Lite;
39
use Koha::Cache::Memory::Lite;
40
use Koha::Exceptions;
40
41
41
__PACKAGE__->mk_accessors(qw( theme activethemes preferredtheme lang filename htdocs interface vars));
42
__PACKAGE__->mk_accessors(qw( theme activethemes preferredtheme lang filename htdocs interface vars));
42
43
Lines 167-181 sub _get_template_file { Link Here
167
    return ($htdocs, $theme, $lang, $filename);
168
    return ($htdocs, $theme, $lang, $filename);
168
}
169
}
169
170
171
=head2 badtemplatecheck
172
173
    badtemplatecheck( $template_path );
174
175
    The sub will throw an exception if the template path is not allowed.
176
177
    Note: At this moment the sub is actually a helper routine for
178
    sub gettemplate.
179
180
=cut
181
182
sub badtemplatecheck {
183
    my ( $template ) = @_;
184
    Koha::Exceptions::NoPermission->throw( 'bad template path' )
185
        unless $template =~ m/^[a-zA-Z0-9_\-\/]+\.(tt|pref)$/;
186
}
170
187
171
sub gettemplate {
188
sub gettemplate {
172
    my ( $tmplbase, $interface, $query, $is_plugin ) = @_;
189
    my ( $tmplbase, $interface, $query, $is_plugin ) = @_;
173
    ($query) or warn "no query in gettemplate";
190
    ($query) or warn "no query in gettemplate";
174
    die "bad template path" unless $tmplbase =~ m/^[a-zA-Z0-9_\-\/]+\.(tt|pref)$/; # Will be extended on bug 17989
175
    my $path = C4::Context->preference('intranet_includes') || 'includes';
176
    my ($htdocs, $theme, $lang, $filename)
191
    my ($htdocs, $theme, $lang, $filename)
177
       =  _get_template_file($tmplbase, $interface, $query);
192
       =  _get_template_file($tmplbase, $interface, $query);
178
    $filename = $tmplbase if ( $is_plugin );
193
    $filename = $tmplbase if ( $is_plugin );
194
    badtemplatecheck( $filename ); # single trip for bad templates
179
    my $template = C4::Templates->new($interface, $filename, $tmplbase, $query);
195
    my $template = C4::Templates->new($interface, $filename, $tmplbase, $query);
180
196
181
# NOTE: Commenting these out rather than deleting them so that those who need
197
# NOTE: Commenting these out rather than deleting them so that those who need
(-)a/Koha/Exceptions.pm (-1 / +4 lines)
Lines 28-33 use Exception::Class ( Link Here
28
        isa => 'Koha::Exceptions::Exception',
28
        isa => 'Koha::Exceptions::Exception',
29
        description => 'One or more parameters are wrong',
29
        description => 'One or more parameters are wrong',
30
    },
30
    },
31
    'Koha::Exceptions::NoPermission' => {
32
        isa => 'Koha::Exceptions::Exception',
33
        description => 'You do not have permission for this action',
34
    },
31
    'Koha::Exceptions::CannotAddLibraryLimit' => {
35
    'Koha::Exceptions::CannotAddLibraryLimit' => {
32
        isa => 'Koha::Exceptions::Exception',
36
        isa => 'Koha::Exceptions::Exception',
33
        description => 'General problem adding a library limit'
37
        description => 'General problem adding a library limit'
34
- 

Return to bug 17989