Bug 40719 - Explicit turn off RELATIVE file paths for plugins for user-entered templates
Summary: Explicit turn off RELATIVE file paths for plugins for user-entered templates
Status: Passed QA
Alias: None
Product: Koha
Classification: Unclassified
Component: Notices (show other bugs)
Version: unspecified
Hardware: All All
: P5 - low enhancement
Assignee: Kyle M Hall (khall)
QA Contact: David Cook
URL:
Keywords:
Depends on:
Blocks:
 
Reported: 2025-08-28 11:34 UTC by Kyle M Hall (khall)
Modified: 2026-01-16 00:53 UTC (History)
1 user (show)

See Also:
GIT URL:
Initiative type: ---
Sponsorship status: ---
Comma delimited list of Sponsors:
Crowdfunding goal: 0
Patch complexity: Trivial patch
Documentation contact:
Documentation submission:
Text to go in the release notes:
Version(s) released in:
Circulation function:


Attachments
Bug 40719: Explicitly disable off RELATIVE file paths for plugins for user-entered templates (1.12 KB, patch)
2025-08-28 11:35 UTC, Kyle M Hall (khall)
Details | Diff | Splinter Review
Bug 40719: Explicitly disable off RELATIVE file paths for plugins for user-entered templates (1.15 KB, patch)
2025-09-04 19:06 UTC, Noah Tremblay
Details | Diff | Splinter Review
Bug 40719: Explicitly disable off RELATIVE file paths for plugins for user-entered templates (1.15 KB, patch)
2025-09-04 19:06 UTC, Noah Tremblay
Details | Diff | Splinter Review
Bug 40719: Explicitly disable off RELATIVE file paths for plugins for user-entered templates (1.20 KB, patch)
2026-01-16 00:52 UTC, David Cook
Details | Diff | Splinter Review
Bug 40719: Explicitly turn off RELATIVE for TemplateUtils (1.72 KB, patch)
2026-01-16 00:52 UTC, David Cook
Details | Diff | Splinter Review

Note You need to log in before you can comment on or make changes to this bug.
Description Kyle M Hall (khall) 2025-08-28 11:34:33 UTC
In bug 39184 we set EVAL_PERL and ABSOLUTE to 0, which is the default. RELATIVE also defaults to 0. For security we should probably specify that as well in case the default is changed somehow.
Comment 1 Kyle M Hall (khall) 2025-08-28 11:35:54 UTC
Created attachment 185848 [details] [review]
Bug 40719: Explicitly disable off RELATIVE file paths for plugins for user-entered templates

In bug 39184 we set EVAL_PERL and ABSOLUTE to 0, which is the default. RELATIVE also defaults to 0. For security we should probably specify that as well in case the default is changed somehow.

Test Plan:
1) Apply this patch
2) Generate some notices
3) No change should be noted!
Comment 2 Noah Tremblay 2025-09-04 19:06:12 UTC
Created attachment 186179 [details] [review]
Bug 40719: Explicitly disable off RELATIVE file paths for plugins for user-entered templates

In bug 39184 we set EVAL_PERL and ABSOLUTE to 0, which is the default. RELATIVE also defaults to 0. For security we should probably specify that as well in case the default is changed somehow.

Test Plan:
1) Apply this patch
2) Generate some notices
3) No change should be noted!

Signed-off-by: noah <noah@inlibro.com>
Comment 3 Noah Tremblay 2025-09-04 19:06:43 UTC
Created attachment 186180 [details] [review]
Bug 40719: Explicitly disable off RELATIVE file paths for plugins for user-entered templates

In bug 39184 we set EVAL_PERL and ABSOLUTE to 0, which is the default. RELATIVE also defaults to 0. For security we should probably specify that as well in case the default is changed somehow.

Test Plan:
1) Apply this patch
2) Generate some notices
3) No change should be noted!

Signed-off-by: noah <noah@inlibro.com>
Comment 4 David Cook 2026-01-16 00:52:30 UTC
Created attachment 191538 [details] [review]
Bug 40719: Explicitly disable off RELATIVE file paths for plugins for user-entered templates

In bug 39184 we set EVAL_PERL and ABSOLUTE to 0, which is the default. RELATIVE also defaults to 0. For security we should probably specify that as well in case the default is changed somehow.

Test Plan:
1) Apply this patch
2) Generate some notices
3) No change should be noted!

Signed-off-by: noah <noah@inlibro.com>
Signed-off-by: David Cook <dcook@prosentient.com.au>
Comment 5 David Cook 2026-01-16 00:52:33 UTC
Created attachment 191539 [details] [review]
Bug 40719: Explicitly turn off RELATIVE for TemplateUtils

This change explicitly turns off RELATIVE in Koha/TemplateUtils.pm

Test plan (Koha/TemplateUtils.pm):
0. Apply the patch and koha-plack --restart kohadev
1. Go to http://localhost:8081/cgi-bin/koha/tools/letter.pl
2. Click "New notice" and choose "reports"
3. Add the following to the report:
[% IF ( x == 1 ) %]
One
[% ELSE %]
Two
[% END %]
4. Go to http://localhost:8081/cgi-bin/koha/reports/guided_reports.pl?phase=Use%20saved
5. Create a report like the following:
SELECT biblionumber FROM biblio;
6. Click "Run with template" and choose the Reports template you made
7. Note that the output shows "Two"
8. Edit your Reports notice and include the following:
[% INSERT ../etc/passwd %]
9. Re-run the report using "Run with template"
10. Note that the output shows the regular SQL results (ie template transform not successful)

Signed-off-by: David Cook <dcook@prosentient.com.au>