From b36dca90b1ff7f638d19e813bb34d578ca8fd9ce Mon Sep 17 00:00:00 2001
From: Kyle M Hall <kyle@bywatersolutions.com>
Date: Thu, 28 Aug 2025 07:34:39 -0400
Subject: [PATCH] Bug 40719: Explicitly disable off RELATIVE file paths for
 plugins for user-entered templates

In bug 39184 we set EVAL_PERL and ABSOLUTE to 0, which is the default. RELATIVE also defaults to 0. For security we should probably specify that as well in case the default is changed somehow.

Test Plan:
1) Apply this patch
2) Generate some notices
3) No change should be noted!

Signed-off-by: noah <noah@inlibro.com>
Signed-off-by: David Cook <dcook@prosentient.com.au>
Signed-off-by: Lucas Gass <lucas@bywatersolutions.com>
(cherry picked from commit bd85f990dac046edd4d33ed6dbae7b815ec87b3e)
Signed-off-by: Jacob O'Mara <jacob.omara@openfifth.co.uk>
---
 C4/Letters.pm | 1 +
 1 file changed, 1 insertion(+)

diff --git a/C4/Letters.pm b/C4/Letters.pm
index c2f540c072..26d866d7f0 100644
--- a/C4/Letters.pm
+++ b/C4/Letters.pm
@@ -1804,6 +1804,7 @@ sub _process_tt {
         {
             EVAL_PERL    => 0,
             ABSOLUTE     => 0,
+            RELATIVE     => 0,
             PLUGIN_BASE  => 'Koha::Template::Plugin',
             COMPILE_EXT  => $use_template_cache ? '.ttc'                                    : '',
             COMPILE_DIR  => $use_template_cache ? C4::Context->config('template_cache_dir') : '',