View | Details | Raw Unified | Return to bug 23290
Collapse All | Expand All

(-)a/Koha/XSLT/Security.pm (-1 / +1 lines)
Lines 144-150 sub set_parser_options { Link Here
144
    my ($self, $parser) = @_;
144
    my ($self, $parser) = @_;
145
    my $conf = $self->{_options};
145
    my $conf = $self->{_options};
146
146
147
    if( $conf->{expand_entities} ) {
147
    if( $conf->{expand_entities_unsafe} ) { # NOT recommended
148
        _set_option($parser, 'expand_entities', 1);
148
        _set_option($parser, 'expand_entities', 1);
149
    } else {
149
    } else {
150
        # If not explicitly set, we should disable expanding for security
150
        # If not explicitly set, we should disable expanding for security
(-)a/t/db_dependent/Koha/XSLT/Security.t (-3 / +2 lines)
Lines 25-31 use Test::Warn; Link Here
25
use Koha::XSLT::Base;
25
use Koha::XSLT::Base;
26
use t::lib::Mocks;
26
use t::lib::Mocks;
27
27
28
t::lib::Mocks::mock_config( 'koha_xslt_security', { expand_entities => 1 } );
28
t::lib::Mocks::mock_config( 'koha_xslt_security', { expand_entities_unsafe => 1 } );
29
my $engine=Koha::XSLT::Base->new;
29
my $engine=Koha::XSLT::Base->new;
30
30
31
my $secret_file = mytempfile('Big secret');
31
my $secret_file = mytempfile('Big secret');
Lines 44-50 my $xslt_file = mytempfile($xslt); Link Here
44
my $output= $engine->transform( "<ignored/>", $xslt_file );
44
my $output= $engine->transform( "<ignored/>", $xslt_file );
45
like($output, qr/Big secret/, 'external entity got through');
45
like($output, qr/Big secret/, 'external entity got through');
46
46
47
t::lib::Mocks::mock_config( 'koha_xslt_security', { expand_entities => 0 } );
47
t::lib::Mocks::mock_config( 'koha_xslt_security', { expand_entities_unsafe => 0 } );
48
$engine=Koha::XSLT::Base->new;
48
$engine=Koha::XSLT::Base->new;
49
$output= $engine->transform( "<ignored/>", $xslt_file );
49
$output= $engine->transform( "<ignored/>", $xslt_file );
50
unlike($output, qr/Big secret/, 'external entity did not get through');
50
unlike($output, qr/Big secret/, 'external entity did not get through');
51
- 

Return to bug 23290