gitea
/
Koha-clms
1
0
Fork 0
Code Issues Pull Requests Packages Projects Releases Wiki Activity

Bug 42136: prevent cgi, directory, and file plugins from use in user-entered templates 

Signed-off-by: Brendan Lawlor <blawlor@clamsnet.org>

Signed-off-by: Jonathan Druart <jonathan.druart@bugs.koha-community.org>
Signed-off-by: Lucas Gass <lucas@bywatersolutions.com>
This commit is contained in:
David Cook 2026-03-20 06:10:22 +00:00 committed by Lucas Gass
parent a2a92356b8
commit 268863392e
No known key found for this signature in database
GPG Key ID: 60B447398B0D36CA
3 changed files with 23 additions and 6 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

11
C4/Letters.pm
View File

@ -1913,9 +1913,14 @@ sub _process_tt {
my $use_template_cache = C4::Context->config('template_cache_dir') && defined $ENV{GATEWAY_INTERFACE}; my $use_template_cache = C4::Context->config('template_cache_dir') && defined $ENV{GATEWAY_INTERFACE};
my $template = Template->new( my $template = Template->new(
{ {
EVAL_PERL => 0, EVAL_PERL => 0,
ABSOLUTE => 0, ABSOLUTE => 0,
RELATIVE => 0, RELATIVE => 0,
PLUGINS => {
cgi => 'Koha::Template::Plugin::noop',
directory => 'Koha::Template::Plugin::noop',
file => 'Koha::Template::Plugin::noop',
},
PLUGIN_BASE => 'Koha::Template::Plugin', PLUGIN_BASE => 'Koha::Template::Plugin',
COMPILE_EXT => $use_template_cache ? '.ttc' : '', COMPILE_EXT => $use_template_cache ? '.ttc' : '',
COMPILE_DIR => $use_template_cache ? C4::Context->config('template_cache_dir') : '', COMPILE_DIR => $use_template_cache ? C4::Context->config('template_cache_dir') : '',

7
Koha/Template/Plugin/noop.pm Normal file
View File

@ -0,0 +1,7 @@
package Koha::Template::Plugin::noop;
use Modern::Perl;
use base qw( Template::Plugin );
1;

11
Koha/TemplateUtils.pm
View File

@ -58,9 +58,14 @@ sub process_tt {
my $tt = Template->new( my $tt = Template->new(
{ {
EVAL_PERL => 0, EVAL_PERL => 0,
ABSOLUTE => 0, ABSOLUTE => 0,
RELATIVE => 0, RELATIVE => 0,
PLUGINS => {
cgi => 'Koha::Template::Plugin::noop',
directory => 'Koha::Template::Plugin::noop',
file => 'Koha::Template::Plugin::noop',
},
PLUGIN_BASE => 'Koha::Template::Plugin', PLUGIN_BASE => 'Koha::Template::Plugin',
COMPILE_EXT => $use_template_cache ? '.ttc' : '', COMPILE_EXT => $use_template_cache ? '.ttc' : '',
COMPILE_DIR => $use_template_cache ? C4::Context->config('template_cache_dir') : '', COMPILE_DIR => $use_template_cache ? C4::Context->config('template_cache_dir') : '',