From bd85f990dac046edd4d33ed6dbae7b815ec87b3e Mon Sep 17 00:00:00 2001
From: Kyle M Hall <kyle@bywatersolutions.com>
Date: Thu, 28 Aug 2025 07:34:39 -0400
Subject: [PATCH] Bug 40719: Explicitly disable off RELATIVE file paths for
 plugins for user-entered templates

In bug 39184 we set EVAL_PERL and ABSOLUTE to 0, which is the default. RELATIVE also defaults to 0. For security we should probably specify that as well in case the default is changed somehow.

Test Plan:
1) Apply this patch
2) Generate some notices
3) No change should be noted!

Signed-off-by: noah <noah@inlibro.com>
Signed-off-by: David Cook <dcook@prosentient.com.au>
Signed-off-by: Lucas Gass <lucas@bywatersolutions.com>
---
 C4/Letters.pm | 1 +
 1 file changed, 1 insertion(+)

diff --git a/C4/Letters.pm b/C4/Letters.pm
index c2f540c072..26d866d7f0 100644
--- a/C4/Letters.pm
+++ b/C4/Letters.pm
@@ -1804,6 +1804,7 @@ sub _process_tt {
         {
             EVAL_PERL    => 0,
             ABSOLUTE     => 0,
+            RELATIVE     => 0,
             PLUGIN_BASE  => 'Koha::Template::Plugin',
             COMPILE_EXT  => $use_template_cache ? '.ttc'                                    : '',
             COMPILE_DIR  => $use_template_cache ? C4::Context->config('template_cache_dir') : '',