Bug 40719

Summary: Explicit turn off RELATIVE file paths for plugins for user-entered templates
Product: Koha Reporter: Kyle M Hall (khall) <kyle>
Component: NoticesAssignee: Kyle M Hall (khall) <kyle>
Status: Signed Off --- QA Contact: Testopia <testopia>
Severity: enhancement    
Priority: P5 - low    
Version: unspecified   
Hardware: All   
OS: All   
GIT URL: Initiative type: ---
Sponsorship status: --- Crowdfunding goal: 0
Patch complexity: Trivial patch Documentation contact:
Documentation submission: Text to go in the release notes:
Version(s) released in:
Circulation function:
Attachments: Bug 40719: Explicitly disable off RELATIVE file paths for plugins for user-entered templates
Bug 40719: Explicitly disable off RELATIVE file paths for plugins for user-entered templates
Bug 40719: Explicitly disable off RELATIVE file paths for plugins for user-entered templates

Description Kyle M Hall (khall) 2025-08-28 11:34:33 UTC
In bug 39184 we set EVAL_PERL and ABSOLUTE to 0, which is the default. RELATIVE also defaults to 0. For security we should probably specify that as well in case the default is changed somehow.
Comment 1 Kyle M Hall (khall) 2025-08-28 11:35:54 UTC
Created attachment 185848 [details] [review]
Bug 40719: Explicitly disable off RELATIVE file paths for plugins for user-entered templates

In bug 39184 we set EVAL_PERL and ABSOLUTE to 0, which is the default. RELATIVE also defaults to 0. For security we should probably specify that as well in case the default is changed somehow.

Test Plan:
1) Apply this patch
2) Generate some notices
3) No change should be noted!
Comment 2 Noah Tremblay 2025-09-04 19:06:12 UTC
Created attachment 186179 [details] [review]
Bug 40719: Explicitly disable off RELATIVE file paths for plugins for user-entered templates

In bug 39184 we set EVAL_PERL and ABSOLUTE to 0, which is the default. RELATIVE also defaults to 0. For security we should probably specify that as well in case the default is changed somehow.

Test Plan:
1) Apply this patch
2) Generate some notices
3) No change should be noted!

Signed-off-by: noah <noah@inlibro.com>
Comment 3 Noah Tremblay 2025-09-04 19:06:43 UTC
Created attachment 186180 [details] [review]
Bug 40719: Explicitly disable off RELATIVE file paths for plugins for user-entered templates

In bug 39184 we set EVAL_PERL and ABSOLUTE to 0, which is the default. RELATIVE also defaults to 0. For security we should probably specify that as well in case the default is changed somehow.

Test Plan:
1) Apply this patch
2) Generate some notices
3) No change should be noted!

Signed-off-by: noah <noah@inlibro.com>