gitea
/
Koha-clms
1
0
Fork 0
Code Issues Pull Requests Packages Projects Releases Wiki Activity

Bug 36244: Do template toolkit processing first 

To avoid injection of template toolkit code
from database fields that are controlled by
untrusted sources.

Test plan:

* review subtest 'Template toolkit syntax in
  parameters' in t/db_dependent/Letters.t
* Run the unit test:
  prove t/db_dependent/Letters.t

Signed-off-by: Jonathan Druart <jonathan.druart@bugs.koha-community.org>

Signed-off-by: Marcel de Rooy <m.de.rooy@rijksmuseum.nl>

Signed-off-by: Kyle M Hall <kyle@bywatersolutions.com>
Signed-off-by: Katrin Fischer <katrin.fischer@bsz-bw.de>
(cherry picked from commit 07ac3b0b9450f812bb48cfecf7bf3f47f63279b5)
Signed-off-by: Fridolin Somers <fridolin.somers@biblibre.com>
(cherry picked from commit 20353e094a952f506b9be7f21740e1001fbdeb69)
Signed-off-by: Frédéric Demians <f.demians@tamil.fr>
This commit is contained in:
Andreas Jonsson 2024-03-07 09:12:25 +00:00 committed by Frédéric Demians
parent ae48106422
commit dfcdc322e9
1 changed files with 22 additions and 22 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

44
C4/Letters.pm
View File

@ -602,6 +602,28 @@ sub GetPreparedLetter {
return;
my $want_librarian = $params{want_librarian};
$letter->{content} = _process_tt(
{
content => $letter->{content},
lang => $lang,
loops => $loops,
objects => $objects,
substitute => $substitute,
tables => $tables,
}
);
$letter->{title} = _process_tt(
{
content => $letter->{title},
lang => $lang,
loops => $loops,
objects => $objects,
substitute => $substitute,
tables => $tables,
}
);
if (%$substitute) {
while ( my ($token, $val) = each %$substitute ) {
$val //= q{};
@ -672,28 +694,6 @@ sub GetPreparedLetter {
}
}
$letter->{content} = _process_tt(
{
content => $letter->{content},
lang => $lang,
loops => $loops,
objects => $objects,
substitute => $substitute,
tables => $tables,
}
);
$letter->{title} = _process_tt(
{
content => $letter->{title},
lang => $lang,
loops => $loops,
objects => $objects,
substitute => $substitute,
tables => $tables,
}
);
$letter->{content} =~ s/<<\S*>>//go; #remove any stragglers
return $letter;