View | Details | Raw Unified | Return to bug 17989
Collapse All | Expand All

(-)a/C4/Templates.pm (-2 / +17 lines)
Lines 163-168 sub _get_template_file { Link Here
163
    my $htdocs = C4::Context->config($is_intranet ? 'intrahtdocs' : 'opachtdocs');
163
    my $htdocs = C4::Context->config($is_intranet ? 'intrahtdocs' : 'opachtdocs');
164
    my ($theme, $lang, $availablethemes) = themelanguage($htdocs, $tmplbase, $interface, $query);
164
    my ($theme, $lang, $availablethemes) = themelanguage($htdocs, $tmplbase, $interface, $query);
165
    $lang //= 'en';
165
    $lang //= 'en';
166
    $theme //= '';
166
    my $filename = "$htdocs/$theme/$lang/modules/$tmplbase";
167
    my $filename = "$htdocs/$theme/$lang/modules/$tmplbase";
167
168
168
    return ($htdocs, $theme, $lang, $filename);
169
    return ($htdocs, $theme, $lang, $filename);
Lines 181-188 sub _get_template_file { Link Here
181
182
182
sub badtemplatecheck {
183
sub badtemplatecheck {
183
    my ( $template ) = @_;
184
    my ( $template ) = @_;
184
    Koha::Exceptions::NoPermission->throw( 'bad template path' )
185
    if( !$template || $template !~ m/^[a-zA-Z0-9_\-\/]+\.(tt|pref)$/ ) {
185
        unless $template =~ m/^[a-zA-Z0-9_\-\/]+\.(tt|pref)$/;
186
        # This also includes two dots
187
        Koha::Exceptions::NoPermission->throw( 'bad template path' );
188
    } else {
189
        # Check allowed dirs
190
        my $dirs = C4::Context->config("pluginsdir");
191
        $dirs = [ $dirs ] if !ref($dirs);
192
        unshift @$dirs, C4::Context->config('opachtdocs'), C4::Context->config('intrahtdocs');
193
        my $found = 0;
194
        foreach my $dir ( @$dirs ) {
195
            $dir .= '/' if $dir !~ m/\/$/;
196
            $found++ if $template =~ m/^$dir/;
197
            last if $found;
198
        }
199
        Koha::Exceptions::NoPermission->throw( 'bad template path' ) if !$found;
200
    }
186
}
201
}
187
202
188
sub gettemplate {
203
sub gettemplate {
(-)a/t/db_dependent/Templates.t (-4 / +15 lines)
Lines 97-107 subtest 'Testing themelanguage' => sub { Link Here
97
    return;
97
    return;
98
};
98
};
99
99
100
subtest 'Testing gettemplate' => sub {
100
subtest 'Testing gettemplate/badtemplatecheck' => sub {
101
    plan tests => 2;
101
    plan tests => 7;
102
102
103
    my $cgi = CGI->new;
103
    my $template;
104
    my $template;
104
    warning_like { eval { $template = C4::Templates::gettemplate( '/etc/passwd', 'opac', CGI->new, 1 ) }; warn $@ if $@; } qr/bad template/, 'Bad template check';
105
    warning_like { eval { $template = C4::Templates::gettemplate( '/etc/passwd', 'opac', $cgi, 1 ) }; warn $@ if $@; } qr/bad template/, 'Bad template check';
105
    is( $template ? $template->output: '', '', 'Check output' );
106
    is( $template ? $template->output: '', '', 'Check output' );
107
108
    # Test a few more bad paths to gettemplate triggering badtemplatecheck
109
    warning_like { eval { C4::Templates::gettemplate( '../topsecret.tt', 'opac', $cgi, 1 ) }; warn $@ if $@; } qr/bad template/, 'No safe chars';
110
    warning_like { eval { C4::Templates::gettemplate( '/noaccess/topsecret.tt', 'opac', $cgi, 1 ) }; warn $@ if $@; } qr/bad template/, 'Directory not allowed';
111
    warning_like { eval { C4::Templates::gettemplate( C4::Context->config('intrahtdocs') . '2/prog/en/modules/about.tt', 'intranet', $cgi, 1 ) }; warn $@ if $@; } qr/bad template/, 'Directory not allowed too';
112
113
    # Allow templates from /tmp
114
    t::lib::Mocks::mock_config( 'pluginsdir', [ '/tmp' ] );
115
    warning_like { eval { C4::Templates::badtemplatecheck( '/tmp/about.tt' ) }; warn $@ if $@; } undef, 'No warn on template from plugin dir';
116
    # Refuse wrong extension
117
    warning_like { eval { C4::Templates::badtemplatecheck( '/tmp/about.tmpl' ) }; warn $@ if $@; } qr/bad template/, 'Warn on bad extension';
106
};
118
};
107
119
108
- 

Return to bug 17989