Bug 27286 - Patron picture-upload.pl allows arbitrary file extension during upload
Summary: Patron picture-upload.pl allows arbitrary file extension during upload
Status: NEW
Alias: None
Product: Koha
Classification: Unclassified
Component: Patrons (show other bugs)
Version: Main
Hardware: All All
: P5 - low enhancement (vote)
Assignee: Bugs List
QA Contact: Testopia
URL:
Keywords:
Depends on:
Blocks:
 
Reported: 2020-12-21 07:20 UTC by Saiful Amin
Modified: 2023-07-01 15:03 UTC (History)
3 users (show)

See Also:
Change sponsored?: ---
Patch complexity: Small patch
Documentation contact:
Documentation submission:
Text to go in the release notes:
Version(s) released in:


Attachments
Double extension or wrong extension in picture file upload (143.37 KB, image/png)
2020-12-21 07:20 UTC, Saiful Amin
Details

Note You need to log in before you can comment on or make changes to this bug.
Description Saiful Amin 2020-12-21 07:20:38 UTC
Created attachment 114546 [details]
Double extension or wrong extension in picture file upload

The IT team has flagged two issues with the picture upload tool (Patron Images feature):
1. The tool allows upload of files with double extension.
2. The tool allows upload of files with arbitrary file extension.

In essence, the tool does not validate the image file restriction that is mentioned in the top of upload input tag which is:
"Only PNG, GIF, JPEG, XPM formats are supported."
Comment 1 Saiful Amin 2020-12-21 07:25:14 UTC
I have tested the following changes to fix both the issues. Need someone to test and approve (I don't have the full environment to submit the patch).

/usr/share/koha/intranet/cgi-bin/tools/picture-upload.pl
Line: 96++
 
    output_and_exit( $input, $cookie, $template, 'wrong_image_file_ext' )
        unless $uploadfilename =~ m/^[^\.]+\.(png|gif|jpg|jpeg|xpm)$/i;


/usr/share/koha/intranet/htdocs/intranet-tmpl/prog/en/includes/blocking_errors.inc

Line: 9++
    [% CASE 'wrong_image_file_ext' %]
        <div class="dialog message">Wrong image file extension or double extension in file name</div>
Comment 2 Katrin Fischer 2021-02-06 18:37:50 UTC
Resetting to NEW to make this a bit more visible!
Comment 3 Katrin Fischer 2023-07-01 15:03:54 UTC
When I use the tool, there is a note:
NOTE: Only PNG, GIF, JPEG, XPM formats are supported. Maximum image size is 2MB.
And if I try to upload a .txt it fails giving a nice error.

When I try the same on the patron record, the modal closes without any visible error.