[Bug 40719] New: Explicit turn off RELATIVE file paths for plugins for user-entered templates
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=40719 Bug ID: 40719 Summary: Explicit turn off RELATIVE file paths for plugins for user-entered templates Change sponsored?: --- Product: Koha Version: unspecified Hardware: All OS: All Status: NEW Severity: enhancement Priority: P5 - low Component: Notices Assignee: koha-bugs@lists.koha-community.org Reporter: kyle@bywatersolutions.com QA Contact: testopia@bugs.koha-community.org In bug 39184 we set EVAL_PERL and ABSOLUTE to 0, which is the default. RELATIVE also defaults to 0. For security we should probably specify that as well in case the default is changed somehow. -- You are receiving this mail because: You are the assignee for the bug. You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=40719 --- Comment #1 from Kyle M Hall (khall) <kyle@bywatersolutions.com> --- Created attachment 185848 --> https://bugs.koha-community.org/bugzilla3/attachment.cgi?id=185848&action=edit Bug 40719: Explicitly disable off RELATIVE file paths for plugins for user-entered templates In bug 39184 we set EVAL_PERL and ABSOLUTE to 0, which is the default. RELATIVE also defaults to 0. For security we should probably specify that as well in case the default is changed somehow. Test Plan: 1) Apply this patch 2) Generate some notices 3) No change should be noted! -- You are receiving this mail because: You are watching all bug changes. You are the assignee for the bug.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=40719 Kyle M Hall (khall) <kyle@bywatersolutions.com> changed: What |Removed |Added ---------------------------------------------------------------------------- Assignee|koha-bugs@lists.koha-commun |kyle@bywatersolutions.com |ity.org | -- You are receiving this mail because: You are the assignee for the bug. You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=40719 Kyle M Hall (khall) <kyle@bywatersolutions.com> changed: What |Removed |Added ---------------------------------------------------------------------------- Patch complexity|--- |Trivial patch -- You are receiving this mail because: You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=40719 Kyle M Hall (khall) <kyle@bywatersolutions.com> changed: What |Removed |Added ---------------------------------------------------------------------------- Status|NEW |Needs Signoff -- You are receiving this mail because: You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=40719 Noah <noah.tremblay@inlibro.com> changed: What |Removed |Added ---------------------------------------------------------------------------- Attachment #185848|0 |1 is obsolete| | --- Comment #2 from Noah <noah.tremblay@inlibro.com> --- Created attachment 186179 --> https://bugs.koha-community.org/bugzilla3/attachment.cgi?id=186179&action=edit Bug 40719: Explicitly disable off RELATIVE file paths for plugins for user-entered templates In bug 39184 we set EVAL_PERL and ABSOLUTE to 0, which is the default. RELATIVE also defaults to 0. For security we should probably specify that as well in case the default is changed somehow. Test Plan: 1) Apply this patch 2) Generate some notices 3) No change should be noted! Signed-off-by: noah <noah@inlibro.com> -- You are receiving this mail because: You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=40719 Noah <noah.tremblay@inlibro.com> changed: What |Removed |Added ---------------------------------------------------------------------------- Status|Needs Signoff |Signed Off -- You are receiving this mail because: You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=40719 Noah <noah.tremblay@inlibro.com> changed: What |Removed |Added ---------------------------------------------------------------------------- Attachment #186179|0 |1 is obsolete| | --- Comment #3 from Noah <noah.tremblay@inlibro.com> --- Created attachment 186180 --> https://bugs.koha-community.org/bugzilla3/attachment.cgi?id=186180&action=edit Bug 40719: Explicitly disable off RELATIVE file paths for plugins for user-entered templates In bug 39184 we set EVAL_PERL and ABSOLUTE to 0, which is the default. RELATIVE also defaults to 0. For security we should probably specify that as well in case the default is changed somehow. Test Plan: 1) Apply this patch 2) Generate some notices 3) No change should be noted! Signed-off-by: noah <noah@inlibro.com> -- You are receiving this mail because: You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=40719 David Cook <dcook@prosentient.com.au> changed: What |Removed |Added ---------------------------------------------------------------------------- Status|Signed Off |Passed QA -- You are receiving this mail because: You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=40719 David Cook <dcook@prosentient.com.au> changed: What |Removed |Added ---------------------------------------------------------------------------- Attachment #186180|0 |1 is obsolete| | --- Comment #4 from David Cook <dcook@prosentient.com.au> --- Created attachment 191538 --> https://bugs.koha-community.org/bugzilla3/attachment.cgi?id=191538&action=edit Bug 40719: Explicitly disable off RELATIVE file paths for plugins for user-entered templates In bug 39184 we set EVAL_PERL and ABSOLUTE to 0, which is the default. RELATIVE also defaults to 0. For security we should probably specify that as well in case the default is changed somehow. Test Plan: 1) Apply this patch 2) Generate some notices 3) No change should be noted! Signed-off-by: noah <noah@inlibro.com> Signed-off-by: David Cook <dcook@prosentient.com.au> -- You are receiving this mail because: You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=40719 --- Comment #5 from David Cook <dcook@prosentient.com.au> --- Created attachment 191539 --> https://bugs.koha-community.org/bugzilla3/attachment.cgi?id=191539&action=edit Bug 40719: Explicitly turn off RELATIVE for TemplateUtils This change explicitly turns off RELATIVE in Koha/TemplateUtils.pm Test plan (Koha/TemplateUtils.pm): 0. Apply the patch and koha-plack --restart kohadev 1. Go to http://localhost:8081/cgi-bin/koha/tools/letter.pl 2. Click "New notice" and choose "reports" 3. Add the following to the report: [% IF ( x == 1 ) %] One [% ELSE %] Two [% END %] 4. Go to http://localhost:8081/cgi-bin/koha/reports/guided_reports.pl?phase=Use%20sav... 5. Create a report like the following: SELECT biblionumber FROM biblio; 6. Click "Run with template" and choose the Reports template you made 7. Note that the output shows "Two" 8. Edit your Reports notice and include the following: [% INSERT ../etc/passwd %] 9. Re-run the report using "Run with template" 10. Note that the output shows the regular SQL results (ie template transform not successful) Signed-off-by: David Cook <dcook@prosentient.com.au> -- You are receiving this mail because: You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=40719 David Cook <dcook@prosentient.com.au> changed: What |Removed |Added ---------------------------------------------------------------------------- CC| |dcook@prosentient.com.au QA Contact|testopia@bugs.koha-communit |dcook@prosentient.com.au |y.org | -- You are receiving this mail because: You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=40719 Lucas Gass (lukeg) <lucas@bywatersolutions.com> changed: What |Removed |Added ---------------------------------------------------------------------------- CC| |lucas@bywatersolutions.com Keywords| |release-notes-needed -- You are receiving this mail because: You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=40719 Lucas Gass (lukeg) <lucas@bywatersolutions.com> changed: What |Removed |Added ---------------------------------------------------------------------------- Version(s)| |26.05.00 released in| | Status|Passed QA |Pushed to main -- You are receiving this mail because: You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=40719 --- Comment #6 from Lucas Gass (lukeg) <lucas@bywatersolutions.com> --- Nice work everyone! Pushed to main for 26.05 -- You are receiving this mail because: You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=40719 Jacob O'Mara <jacob.omara@openfifth.co.uk> changed: What |Removed |Added ---------------------------------------------------------------------------- Status|Pushed to main |Pushed to stable Version(s)|26.05.00 |26.05.00,25.11.02 released in| | -- You are receiving this mail because: You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=40719 --- Comment #7 from Jacob O'Mara <jacob.omara@openfifth.co.uk> --- Thanks all, pushed to 25.11.x -- You are receiving this mail because: You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=40719 Owen Leonard <oleonard@myacpl.org> changed: What |Removed |Added ---------------------------------------------------------------------------- Keywords|release-notes-needed | -- You are receiving this mail because: You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=40719 Laura Escamilla <Laura.escamilla@bywatersolutions.com> changed: What |Removed |Added ---------------------------------------------------------------------------- Status|Pushed to stable |Needs documenting CC| |Laura.escamilla@bywatersolu | |tions.com --- Comment #8 from Laura Escamilla <Laura.escamilla@bywatersolutions.com> --- Not backporting to 25.05 as this is an enhancement. Happy to revisit if needed. -- You are receiving this mail because: You are watching all bug changes.
participants (1)
-
bugzilla-daemon＠bugs.koha-community.org