Bug 11662 - member-picupload.pl can write to arbitrary files on the server
Summary: member-picupload.pl can write to arbitrary files on the server
Status: CLOSED FIXED
Alias: None
Product: Koha
Classification: Unclassified
Component: Architecture, internals, and plumbing (show other bugs)
Version: master
Hardware: All All
: P1 - high critical (vote)
Assignee: Galen Charlton
QA Contact: Testopia
URL:
Keywords:
Depends on:
Blocks:
 
Reported: 2014-02-01 01:00 UTC by Galen Charlton
Modified: 2019-06-27 09:24 UTC (History)
0 users

See Also:
Change sponsored?: ---
Patch complexity: Trivial patch
Text to go in the release notes:
Version(s) released in:


Attachments
bug 11662: remove disused member-picupload.pl (3.22 KB, patch)
2014-02-01 02:15 UTC, Galen Charlton
Details | Diff | Splinter Review
bug 11662: remove disused member-picupload.pl (3.28 KB, patch)
2014-02-01 03:25 UTC, Chris Cormack
Details | Diff | Splinter Review
[PASSED QA] Bug 11662: remove disused member-picupload.pl (3.39 KB, patch)
2014-02-01 16:32 UTC, Katrin Fischer
Details | Diff | Splinter Review

Note You need to log in before you can comment on or make changes to this bug.
Comment 1 Galen Charlton 2014-02-01 02:15:06 UTC Comment hidden (obsolete)
Comment 2 Chris Cormack 2014-02-01 03:25:47 UTC Comment hidden (obsolete)
Comment 3 Katrin Fischer 2014-02-01 16:32:37 UTC
Created attachment 24975 [details] [review]
[PASSED QA] Bug 11662: remove disused member-picupload.pl

This script is no longer used, and in addition has problematic
handling of its parameters that could lead to writing to
arbitrary files on the server.

To test:

[1] Verify that member-picupload.pl is no longer referred
    to in the codebase after applying this patch.
[2] Verify that there are no regressions in patron
    photo management.

Signed-off-by: Galen Charlton <gmc@esilibrary.com>
Signed-off-by: Chris Cormack <chris@bigballofwax.co.nz>
Signed-off-by: Katrin Fischer <Katrin.Fischer.83@web.de>
Found no regressions in removing this script.
Comment 4 Galen Charlton 2014-02-07 01:43:00 UTC
Pushed to master.
Comment 5 Galen Charlton 2014-02-07 02:05:50 UTC
Included in the following releases: 3.8.23, 3.10.13, 3.12.10, and 3.14.3.