From 7c33726cd3f31dd954a8c529a9d8ac32bd1efbed Mon Sep 17 00:00:00 2001
From: David Cook <dcook@prosentient.com.au>
Date: Fri, 20 Mar 2026 06:10:22 +0000
Subject: [PATCH] Bug 42136: prevent cgi, directory, and file plugins from use
 in user-entered templates

Signed-off-by: Brendan Lawlor <blawlor@clamsnet.org>

Signed-off-by: Jonathan Druart <jonathan.druart@bugs.koha-community.org>
Signed-off-by: Wainui Witika-Park <wainuiwitikapark@catalyst.net.nz>
---
 C4/Letters.pm                | 10 ++++++++--
 Koha/Template/Plugin/noop.pm |  7 +++++++
 2 files changed, 15 insertions(+), 2 deletions(-)
 create mode 100644 Koha/Template/Plugin/noop.pm

diff --git a/C4/Letters.pm b/C4/Letters.pm
index 8c47f3d049..2306d218cb 100644
--- a/C4/Letters.pm
+++ b/C4/Letters.pm
@@ -1608,8 +1608,14 @@ sub _process_tt {
     my $use_template_cache = C4::Context->config('template_cache_dir') && defined $ENV{GATEWAY_INTERFACE};
     my $template           = Template->new(
         {
-            EVAL_PERL    => 0,
-            ABSOLUTE     => 0,
+            EVAL_PERL => 0,
+            ABSOLUTE  => 0,
+            RELATIVE  => 0,
+            PLUGINS   => {
+                cgi       => 'Koha::Template::Plugin::noop',
+                directory => 'Koha::Template::Plugin::noop',
+                file      => 'Koha::Template::Plugin::noop',
+            },
             PLUGIN_BASE  => 'Koha::Template::Plugin',
             COMPILE_EXT  => $use_template_cache ? '.ttc' : '',
             COMPILE_DIR  => $use_template_cache ? C4::Context->config('template_cache_dir') : '',
diff --git a/Koha/Template/Plugin/noop.pm b/Koha/Template/Plugin/noop.pm
new file mode 100644
index 0000000000..ab9f012bf8
--- /dev/null
+++ b/Koha/Template/Plugin/noop.pm
@@ -0,0 +1,7 @@
+package Koha::Template::Plugin::noop;
+
+use Modern::Perl;
+
+use base qw( Template::Plugin );
+
+1;