[Bug 42087] New: Add dependency File::LibMagic for validating file using magic numbers
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=42087 Bug ID: 42087 Summary: Add dependency File::LibMagic for validating file using magic numbers Initiative type: --- Sponsorship --- status: Product: Koha Version: Main Hardware: All OS: All Status: NEW Severity: enhancement Priority: P5 - low Component: Packaging Assignee: koha-bugs@lists.koha-community.org Reporter: dcook@prosentient.com.au QA Contact: testopia@bugs.koha-community.org CC: mtj@kohaaloha.com There are many cases in Koha where we're working with files and we want to know what type of file it is, but we can't trust the file extension or the Content-Type that it's uploaded with, because those are user-controlled data. A common method for testing file type is using magic numbers via the libmagic library. In Perl File::LibMagic provides Perl bindings to this C library, which makes it easy to check what kind of file we're working with (to a reasonable degree). libfile-libmagic-perl is available in Debian, so it should be an easy dependency to add. It will help improve our security and even just user experience. -- You are receiving this mail because: You are watching all bug changes. You are the assignee for the bug.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=42087 David Cook <dcook@prosentient.com.au> changed: What |Removed |Added ---------------------------------------------------------------------------- Blocks| |42080 Referenced Bugs: https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=42080 [Bug 42080] Invoice PDFs are forced downloads -- You are receiving this mail because: You are watching all bug changes. You are the assignee for the bug.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=42087 David Cook <dcook@prosentient.com.au> changed: What |Removed |Added ---------------------------------------------------------------------------- Keywords| |dependency Assignee|koha-bugs@lists.koha-commun |dcook@prosentient.com.au |ity.org | -- You are receiving this mail because: You are the assignee for the bug. You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=42087 David Cook <dcook@prosentient.com.au> changed: What |Removed |Added ---------------------------------------------------------------------------- Text to go in the| |This patch adds release notes| |File::LibMagic to Koha's | |dependencies via cpanfile. | |This Perl library allows | |access to the C library | |libmagic which determines | |file type based off of | |"magic numbers" which are | |data in the first line of | |many file types which are | |unique to that filetype. -- You are receiving this mail because: You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=42087 David Cook <dcook@prosentient.com.au> changed: What |Removed |Added ---------------------------------------------------------------------------- Status|NEW |Needs Signoff -- You are receiving this mail because: You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=42087 --- Comment #1 from David Cook <dcook@prosentient.com.au> --- Created attachment 195243 --> https://bugs.koha-community.org/bugzilla3/attachment.cgi?id=195243&action=edit Bug 42087: Add dependency to cpanfile This change adds File::LibMagic to cpanfile -- You are receiving this mail because: You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=42087 --- Comment #2 from David Cook <dcook@prosentient.com.au> --- Created attachment 195244 --> https://bugs.koha-community.org/bugzilla3/attachment.cgi?id=195244&action=edit Bug 42087: Add dependency to debian/control This change adds File::LibMagic (via libfile-libmagic-perl) to debian/control. The debian/control should be automatically re-generated by debian/control.in during the package process, but we want to record the change here anyway. -- You are receiving this mail because: You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=42087 David Cook <dcook@prosentient.com.au> changed: What |Removed |Added ---------------------------------------------------------------------------- Blocks| |30033 -- You are receiving this mail because: You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=42087 David Nind <david@davidnind.com> changed: What |Removed |Added ---------------------------------------------------------------------------- Status|Needs Signoff |Signed Off -- You are receiving this mail because: You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=42087 David Nind <david@davidnind.com> changed: What |Removed |Added ---------------------------------------------------------------------------- Attachment #195243|0 |1 is obsolete| | --- Comment #3 from David Nind <david@davidnind.com> --- Created attachment 195365 --> https://bugs.koha-community.org/bugzilla3/attachment.cgi?id=195365&action=edit Bug 42087: Add dependency to cpanfile This change adds File::LibMagic to cpanfile Signed-off-by: David Nind <david@davidnind.com> -- You are receiving this mail because: You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=42087 David Nind <david@davidnind.com> changed: What |Removed |Added ---------------------------------------------------------------------------- Attachment #195244|0 |1 is obsolete| | --- Comment #4 from David Nind <david@davidnind.com> --- Created attachment 195366 --> https://bugs.koha-community.org/bugzilla3/attachment.cgi?id=195366&action=edit Bug 42087: Add dependency to debian/control This change adds File::LibMagic (via libfile-libmagic-perl) to debian/control. The debian/control should be automatically re-generated by debian/control.in during the package process, but we want to record the change here anyway. Signed-off-by: David Nind <david@davidnind.com> -- You are receiving this mail because: You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=42087 David Nind <david@davidnind.com> changed: What |Removed |Added ---------------------------------------------------------------------------- CC| |david@davidnind.com --- Comment #5 from David Nind <david@davidnind.com> --- I've signed off, so hope I have tested correctly. Testing notes (using KTD): 1. Before the patches, go to More > About Koha > Perl modules. 2. Search for File, note that there is no File::LibMagic module shown. 3. Apply the patch, then shutdown and restart KTD. 4. Repeat step 1, and note that File::LibMagic is now shown: - Module: File::LibMagic - Required: tick - Current version: Not installed - Minimum version required: 1.23 - Status: Required module missing 5. Install the missing perl module: sudo apt install libfile-libmagic-perl 6. Restart everything: restart_all 6. For step 4, note that the module is now installed. I'm assuming once the packaging is updated that this will show as installed by default. -- You are receiving this mail because: You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=42087 --- Comment #6 from David Cook <dcook@prosentient.com.au> --- Thanks David :) -- You are receiving this mail because: You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=42087 David Cook <dcook@prosentient.com.au> changed: What |Removed |Added ---------------------------------------------------------------------------- CC| |jonathan.druart@gmail.com -- You are receiving this mail because: You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=42087 Jonathan Druart <jonathan.druart@gmail.com> changed: What |Removed |Added ---------------------------------------------------------------------------- QA Contact|testopia@bugs.koha-communit |jonathan.druart@gmail.com |y.org | Status|Signed Off |Passed QA -- You are receiving this mail because: You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=42087 Jonathan Druart <jonathan.druart@gmail.com> changed: What |Removed |Added ---------------------------------------------------------------------------- Attachment #195365|0 |1 is obsolete| | -- You are receiving this mail because: You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=42087 Jonathan Druart <jonathan.druart@gmail.com> changed: What |Removed |Added ---------------------------------------------------------------------------- Attachment #195366|0 |1 is obsolete| | -- You are receiving this mail because: You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=42087 --- Comment #7 from Jonathan Druart <jonathan.druart@gmail.com> --- Created attachment 199232 --> https://bugs.koha-community.org/bugzilla3/attachment.cgi?id=199232&action=edit Bug 42087: Add dependency to cpanfile This change adds File::LibMagic to cpanfile Signed-off-by: David Nind <david@davidnind.com> Signed-off-by: Jonathan Druart <jonathan.druart@bugs.koha-community.org> -- You are receiving this mail because: You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=42087 --- Comment #8 from Jonathan Druart <jonathan.druart@gmail.com> --- Created attachment 199233 --> https://bugs.koha-community.org/bugzilla3/attachment.cgi?id=199233&action=edit Bug 42087: Add dependency to debian/control This change adds File::LibMagic (via libfile-libmagic-perl) to debian/control. The debian/control should be automatically re-generated by debian/control.in during the package process, but we want to record the change here anyway. Signed-off-by: David Nind <david@davidnind.com> Signed-off-by: Jonathan Druart <jonathan.druart@bugs.koha-community.org> -- You are receiving this mail because: You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=42087 --- Comment #9 from David Cook <dcook@prosentient.com.au> --- Thanks, Jonathan. Legend! -- You are receiving this mail because: You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=42087 Pedro Amorim (ammopt) <pedro.amorim@openfifth.co.uk> changed: What |Removed |Added ---------------------------------------------------------------------------- Status|Passed QA |Pushed to main Version(s)| |26.11.00 released in| | -- You are receiving this mail because: You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=42087 --- Comment #10 from Pedro Amorim (ammopt) <pedro.amorim@openfifth.co.uk> --- Thanks everyone! Pushed to main for 26.11! -- You are receiving this mail because: You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=42087 --- Comment #11 from David Nind <david@davidnind.com> --- Testing notes (using KTD): 1. Bug 42087 introduced a new dependency which may not yet be in KTD/packages. 2. In the interim: sudo apt install libfile-libmagic-perl -- You are receiving this mail because: You are watching all bug changes.
participants (1)
-
bugzilla-daemon＠bugs.koha-community.org