Summary: | member-picupload.pl can write to arbitrary files on the server | ||
---|---|---|---|
Product: | Koha | Reporter: | Galen Charlton <gmcharlt> |
Component: | Architecture, internals, and plumbing | Assignee: | Galen Charlton <gmcharlt> |
Status: | CLOSED FIXED | QA Contact: | Testopia <testopia> |
Severity: | critical | ||
Priority: | P1 - high | ||
Version: | Main | ||
Hardware: | All | ||
OS: | All | ||
Change sponsored?: | --- | Patch complexity: | Trivial patch |
Documentation contact: | Documentation submission: | ||
Text to go in the release notes: | Version(s) released in: | ||
Attachments: |
bug 11662: remove disused member-picupload.pl
bug 11662: remove disused member-picupload.pl [PASSED QA] Bug 11662: remove disused member-picupload.pl |
Comment 1
Galen Charlton
2014-02-01 02:15:06 UTC
Comment hidden (obsolete)
Created attachment 24971 [details] [review] bug 11662: remove disused member-picupload.pl This script is no longer used, and in addition has problematic handling of its parameters that could lead to writing to arbitrary files on the server. To test: [1] Verify that member-picupload.pl is no longer referred to in the codebase after applying this patch. [2] Verify that there are no regressions in patron photo management. Signed-off-by: Galen Charlton <gmc@esilibrary.com> Signed-off-by: Chris Cormack <chris@bigballofwax.co.nz> Created attachment 24975 [details] [review] [PASSED QA] Bug 11662: remove disused member-picupload.pl This script is no longer used, and in addition has problematic handling of its parameters that could lead to writing to arbitrary files on the server. To test: [1] Verify that member-picupload.pl is no longer referred to in the codebase after applying this patch. [2] Verify that there are no regressions in patron photo management. Signed-off-by: Galen Charlton <gmc@esilibrary.com> Signed-off-by: Chris Cormack <chris@bigballofwax.co.nz> Signed-off-by: Katrin Fischer <Katrin.Fischer.83@web.de> Found no regressions in removing this script. Pushed to master. Included in the following releases: 3.8.23, 3.10.13, 3.12.10, and 3.14.3. |