gitea
/
Koha-clms
1
0
Fork 0
Code Issues Pull Requests Packages Projects Releases Wiki Activity

Bug 39184: Turn off ABSOLUTE and EVAL_PERL for user-entered templates 

This change turns off ABSOLUTE and EVAL_PERL for user-entered templates,
as these options can allow for arbitrary code execution and information
disclosure.

Test plan:
0. Apply the patch
1. koha-plack --restart kohadev
2. Create a Notice for Reports with a report like:
[% IF ( x == 1 ) %]
One
[% ELSE %]
Two
[% END %]
3. Run a report using this template
4. The report should show "Two"
5. Turn on CHECKOUT emails for a test patron
6. Perform a checkout
7. Look at the CHECKOUT email and note that the email body
is correctly generated

Signed-off-by: Magnus Enger <magnus@libriotech.no>
Would be good to have this fixed as the default.

Signed-off-by: Marcel de Rooy <m.de.rooy@rijksmuseum.nl>
The test plan should include PERL blocks or absolute paths! Tested those
instead. Testing x==1 seems irrelevant.
I tried:[% PERL %]print 1;[% END %] and [% INCLUDE /app/Dockerfile_1 %]
Signed-off-by: Katrin Fischer <katrin.fischer@bsz-bw.de>
This commit is contained in:
David Cook 2025-03-03 05:44:59 +00:00 committed by Katrin Fischer
parent 86f61b4f07
commit ec01689dc0
No known key found for this signature in database
GPG Key ID: 0EF6E2C03357A834
2 changed files with 4 additions and 4 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

4
C4/Letters.pm
View File

@ -1810,8 +1810,8 @@ sub _process_tt {
my $use_template_cache = C4::Context->config('template_cache_dir') && defined $ENV{GATEWAY_INTERFACE};
my $template = Template->new(
{
EVAL_PERL => 1,
ABSOLUTE => 1,
EVAL_PERL => 0,
ABSOLUTE => 0,
PLUGIN_BASE => 'Koha::Template::Plugin',
COMPILE_EXT => $use_template_cache ? '.ttc' : '',
COMPILE_DIR => $use_template_cache ? C4::Context->config('template_cache_dir') : '',

4
Koha/TemplateUtils.pm
View File

@ -61,8 +61,8 @@ sub process_tt {
my $tt = Template->new(
{
EVAL_PERL => 1,
ABSOLUTE => 1,
EVAL_PERL => 0,
ABSOLUTE => 0,
PLUGIN_BASE => 'Koha::Template::Plugin',
COMPILE_EXT => $use_template_cache ? '.ttc' : '',
COMPILE_DIR => $use_template_cache ? C4::Context->config('template_cache_dir') : '',