Bug 11662

Summary: member-picupload.pl can write to arbitrary files on the server
Product: Koha Reporter: Galen Charlton <gmcharlt>
Component: Architecture, internals, and plumbingAssignee: Galen Charlton <gmcharlt>
Status: CLOSED FIXED QA Contact: Testopia <testopia>
Severity: critical    
Priority: P1 - high    
Version: master   
Hardware: All   
OS: All   
Change sponsored?: --- Patch complexity: Trivial patch
Text to go in the release notes:
Version(s) released in:
Attachments: bug 11662: remove disused member-picupload.pl
bug 11662: remove disused member-picupload.pl
[PASSED QA] Bug 11662: remove disused member-picupload.pl

Comment 1 Galen Charlton 2014-02-01 02:15:06 UTC Comment hidden (obsolete)
Comment 2 Chris Cormack 2014-02-01 03:25:47 UTC Comment hidden (obsolete)
Comment 3 Katrin Fischer 2014-02-01 16:32:37 UTC
Created attachment 24975 [details] [review]
[PASSED QA] Bug 11662: remove disused member-picupload.pl

This script is no longer used, and in addition has problematic
handling of its parameters that could lead to writing to
arbitrary files on the server.

To test:

[1] Verify that member-picupload.pl is no longer referred
    to in the codebase after applying this patch.
[2] Verify that there are no regressions in patron
    photo management.

Signed-off-by: Galen Charlton <gmc@esilibrary.com>
Signed-off-by: Chris Cormack <chris@bigballofwax.co.nz>
Signed-off-by: Katrin Fischer <Katrin.Fischer.83@web.de>
Found no regressions in removing this script.
Comment 4 Galen Charlton 2014-02-07 01:43:00 UTC
Pushed to master.
Comment 5 Galen Charlton 2014-02-07 02:05:50 UTC
Included in the following releases: 3.8.23, 3.10.13, 3.12.10, and 3.14.3.