Koha-clms/Koha
Chris Cormack 8f74140e3f Bug 36818: Escape characters in file names uploaded
To test:
1/ create a file named something like 'execute`curl blog.bigballofwax.co.nz`.zip'
   Where the domain is one you can watch the logs from
2/ Upload this file as a cover image
3/ Check /var/lib/koha/sitename/tmp/koha_sitename/ and see unescaped filenames
4/ Choose process, check the logs of the webserver see the connection has been made
5/ Apply the patch
5/ Repeat 2 & 3 and see the filename is now escaped
6/ Choose process and check no errors but no no remote execution occurs
7/ Test uploading actual zip file and images still works

Signed-off-by: Amit Gupta <amit.gupta@informaticsglobal.com>
Signed-off-by: Martin Renvoize <martin.renvoize@ptfs-europe.com>
Signed-off-by: Wainui Witika-Park <wainuiwitikapark@catalyst.net.nz>
2024-05-31 03:05:08 +00:00
..
Account Revert "Bug 29021: RenewAccruingItemWhenPaid renewals are not seen" 2023-02-02 16:54:29 +00:00
Acquisition Bug 33262: Add new field to REST API route for orders 2023-05-15 22:48:10 +00:00
App Bug 29498: Remove usage of deprecated Mojolicious::Routes::Route::detour 2022-01-18 21:15:04 -10:00
ArticleRequest Bug 27944: (follow-up) Move statuses to constants 2021-10-05 10:58:14 +02:00
Auth Bug 32011: 2FA - Prevent qr_code to not be generated 2022-10-31 17:17:23 +00:00
Authority Bug 17600: Standardize our EXPORT_OK 2021-07-16 08:58:47 +02:00
BackgroundJob Bug 32394: [22.05.x] Restore long tasks queue 2023-02-01 18:19:34 +00:00
Biblio Bug 17600: Standardize our EXPORT_OK 2021-07-16 08:58:47 +02:00
BiblioUtils Bug 17600: Standardize our EXPORT_OK 2021-07-16 08:58:47 +02:00
Cache Bug 17600: Standardize our EXPORT_OK 2021-07-16 08:58:47 +02:00
Cash Bug 17600: Standardize our EXPORT_OK 2021-07-16 08:58:47 +02:00
Charges Bug 22435: (follow-up) Update POS for reduced offset types 2021-08-04 14:06:43 +02:00
Checkouts Bug 29495: (follow-up) Use 'item' relationship 2022-01-17 14:55:55 -10:00
Club Bug 29562: Adjust CanItemBeReserved and checkHighHolds to take objects 2022-01-31 21:55:39 -10:00
Config Bug 17600: Standardize our EXPORT_OK 2021-07-16 08:58:47 +02:00
Course Bug 17600: Standardize our EXPORT_OK 2021-07-16 08:58:47 +02:00
Database Bug 31619: add title back to list of OPACSuggestionMandatoryFields options 2022-12-05 18:03:12 +00:00
Edifact Bug 30135: Add EdifactLSQ mapping preference 2022-04-13 15:55:39 +02:00
Exceptions Bug 31086: Throw an exception when a hold is stored with no branchcode 2022-09-02 17:07:18 +00:00
Exporter Bug 17600: Standardize our EXPORT_OK 2021-07-16 08:58:47 +02:00
ExternalContent Bug 32995: Pass user agent string for OverDrive fulfillment 2023-06-15 19:25:57 +00:00
Filter/MARC Bug 15187: Index 880 in Zebra the same as Elasticsearch 2022-09-02 17:56:24 +00:00
Illrequest Bug 22614: Migrate original request 2021-09-21 20:22:57 +02:00
Import Bug 30779: Remove _update_import_record_marc and update tests 2022-10-03 22:48:43 +00:00
Indexer
…
Item Bug 28445: Split and join on ' | ' instead of '|' for repeatable 2021-10-18 11:28:40 +02:00
Library Bug 29922: Make get_search_groups return results sorted by title 2022-08-23 19:32:30 +00:00
List Bug 16446: Add ability to add patrons to list by borrowernumber 2021-10-21 12:24:04 +02:00
MetadataRecord Bug 17600: Standardize our EXPORT_OK 2021-07-16 08:58:47 +02:00
Middleware Bug 36149: (follow-up) POD and tidy 2024-05-03 14:23:39 +12:00
Misc
…
Notice Bug 17600: Standardize our EXPORT_OK 2021-07-16 08:58:47 +02:00
Number Bug 26239: Do not format large negative numbers 2020-08-19 08:22:02 +02:00
OAI/Server Bug 30143: OAI-PMH: Fix SQL query used to fetch deleted records 2022-05-03 11:19:50 -10:00
Object Bug 17600: Standardize our EXPORT_OK 2021-07-16 08:58:47 +02:00
Objects Bug 29844: Fix ->search occurrences 2022-02-09 15:36:23 -10:00
Old Bug 26648: Prevent explosion in notices on missing item 2022-12-05 18:38:50 +00:00
Patron Bug 31739: Password recovery from staff fails if previous expired reset-entry exists. 2022-12-05 22:38:12 +00:00
Patrons Bug 31595: Don't process extended attributes if none are inlcuded in the file 2022-12-05 20:15:55 +00:00
Plugins Bug 31684: Plugin versions starting with a "v" cause unnecessary warnings 2022-12-05 21:06:13 +00:00
REST Bug 29510: (follow-up) Adapt GET /patrons/:patron_id 2024-02-26 03:57:15 +00:00
RecordProcessor
…
Result Bug 29746: (it-doesn't-hurt follow-up) More tests 2022-01-05 13:33:46 -10:00
SMS Bug 17600: Standardize our EXPORT_OK 2021-07-16 08:58:47 +02:00
SMTP Bug 28416: Delay load of Email::Sender::Transport::SMTP 2022-03-25 11:01:04 -10:00
Schema Bug 33262: DBIC schema 2023-05-15 22:48:11 +00:00
SearchEngine Bug 33206: Bad title__sort made of multifield 245 2023-06-15 16:52:15 +00:00
Serial Bug 17600: Standardize our EXPORT_OK 2021-07-16 08:58:47 +02:00
Sitemapper Bug 17600: Standardize our EXPORT_OK 2021-07-16 08:58:47 +02:00
Subscription Bug 17600: Standardize our EXPORT_OK 2021-07-16 08:58:47 +02:00
SuggestionEngine Bug 31069: Remove ExplodedTerms dependency on templates 2022-08-23 17:15:18 +00:00
Tags Bug 17600: Standardize our EXPORT_OK 2021-07-16 08:58:47 +02:00
Template/Plugin Bug 30524: (QA follow-up) Only generate CSRF token if it will be used 2024-02-28 21:18:02 +00:00
UI Bug 31154: Avoid unecessary loop 2022-10-31 21:39:56 +00:00
Util Bug 11175: (QA follow-up) Move get_component_part_query 2021-10-26 16:46:02 +02:00
XSLT Bug 17600: Standardize our EXPORT_OK 2021-07-16 08:58:47 +02:00
Z3950Responder Bug 17600: Standardize our EXPORT_OK 2021-07-16 08:58:47 +02:00
pdfformat Bug 18984: Remove NORMARC support 2021-10-07 15:36:40 +02:00
Account.pm Bug 34316: Add_credit should rethrow an exception correctly 2023-09-13 21:01:29 +00:00
ActionLog.pm
…
ActionLogs.pm
…
AdditionalContent.pm Bug 24387: Rename "News" with "Additional contents" 2021-08-16 11:55:55 +02:00
AdditionalContents.pm Bug 29332: Set default library limits in search_for_display 2021-10-28 12:16:37 +02:00
AdditionalField.pm
…
AdditionalFieldValue.pm
…
AdditionalFieldValues.pm
…
AdditionalFields.pm
…
AdvancedEditorMacro.pm Bug 17600: Standardize our EXPORT_OK 2021-07-16 08:58:47 +02:00
AdvancedEditorMacros.pm Bug 17600: Standardize our EXPORT_OK 2021-07-16 08:58:47 +02:00
ApiKey.pm Bug 28772: Make validate_secret return 1|0 2021-09-30 09:48:41 +02:00
ApiKeys.pm Bug 17600: Standardize our EXPORT_OK 2021-07-16 08:58:47 +02:00
ArticleRequest.pm Bug 29759: Make cancelling an AR refund 2022-01-31 21:55:39 -10:00
ArticleRequests.pm Bug 29082: Add filtering methods to Koha::ArticleRequests 2021-10-07 10:54:59 +02:00
AudioAlert.pm Bug 17600: Standardize our EXPORT_OK 2021-07-16 08:58:47 +02:00
AudioAlerts.pm Bug 29859: Use iterator instead of as_list 2022-02-09 15:36:23 -10:00
AuthUtils.pm Bug 33341: Address some perlcritic errors in 5.36 2023-04-24 17:16:12 +00:00
AuthorisedValue.pm Bug 17600: Standardize our EXPORT_OK 2021-07-16 08:58:47 +02:00
AuthorisedValueCategories.pm Bug 17600: Standardize our EXPORT_OK 2021-07-16 08:58:47 +02:00
AuthorisedValueCategory.pm Bug 17600: Standardize our EXPORT_OK 2021-07-16 08:58:47 +02:00
AuthorisedValues.pm Bug 29844: Fix ->search occurrences 2022-02-09 15:36:23 -10:00
Authorities.pm Bug 17600: Standardize our EXPORT_OK 2021-07-16 08:58:47 +02:00
Authority.pm Bug 35343: Add record accessor method to Koha::Authority 2024-01-24 07:00:43 +00:00
BackgroundJob.pm Bug 33044: Return job id if there is no connection to rabbit 2023-03-10 16:31:04 +00:00
BackgroundJobs.pm Bug 30982: [22.05.x] Use the REST API for background job list view 2022-11-01 21:40:18 +00:00
Biblio.pm Bug 30865: Double-quote Host-item in Koha::Biblio->get_components_query 2022-07-29 17:23:01 +00:00
BiblioFramework.pm Bug 17600: Standardize our EXPORT_OK 2021-07-16 08:58:47 +02:00
BiblioFrameworks.pm Bug 17600: Standardize our EXPORT_OK 2021-07-16 08:58:47 +02:00
BiblioUtils.pm Bug 29625: Fix var name in Koha::BiblioUtils get_all_biblios_iterator 2022-02-21 15:15:47 -10:00
Biblioitem.pm Bug 17600: Standardize our EXPORT_OK 2021-07-16 08:58:47 +02:00
Biblioitems.pm Bug 17600: Standardize our EXPORT_OK 2021-07-16 08:58:47 +02:00
Biblios.pm Bug 17600: Standardize our EXPORT_OK 2021-07-16 08:58:47 +02:00
Cache.pm Bug 17600: Standardize our EXPORT_OK 2021-07-16 08:58:47 +02:00
Caches.pm
…
Calendar.pm Bug 17600: Standardize our EXPORT_OK 2021-07-16 08:58:47 +02:00
Checkout.pm Bug 29857: Rename base class as Koha::Exception 2022-03-01 22:47:47 -10:00
Checkouts.pm Bug 17600: Standardize our EXPORT_OK 2021-07-16 08:58:47 +02:00
CirculationRule.pm
…
CirculationRules.pm Bug 29705: In test suite merge IssuingRules with CirculationRules 2022-05-06 10:33:10 -10:00
Cities.pm Bug 17600: Standardize our EXPORT_OK 2021-07-16 08:58:47 +02:00
City.pm Bug 17600: Standardize our EXPORT_OK 2021-07-16 08:58:47 +02:00
ClassSortRule.pm Bug 17600: Standardize our EXPORT_OK 2021-07-16 08:58:47 +02:00
ClassSortRules.pm Bug 17600: Standardize our EXPORT_OK 2021-07-16 08:58:47 +02:00
ClassSource.pm Bug 17600: Standardize our EXPORT_OK 2021-07-16 08:58:47 +02:00
ClassSources.pm Bug 17600: Standardize our EXPORT_OK 2021-07-16 08:58:47 +02:00
ClassSplitRule.pm Bug 17600: Standardize our EXPORT_OK 2021-07-16 08:58:47 +02:00
ClassSplitRules.pm
…
Club.pm Bug 29844: Fix ->search occurrences 2022-02-09 15:36:23 -10:00
Clubs.pm Bug 29844: Simplify Koha::Clubs->get_enrollable 2022-02-09 15:36:23 -10:00
Config.pm Bug 28306: Allow to query database with minimal memory footprint 2021-08-31 10:27:52 +02:00
CookieManager.pm Bug 31250: (QA follow-up) The future will be easier 2022-10-31 20:45:24 +00:00
Course.pm Bug 17600: Standardize our EXPORT_OK 2021-07-16 08:58:47 +02:00
Courses.pm Bug 17600: Standardize our EXPORT_OK 2021-07-16 08:58:47 +02:00
CoverImage.pm Bug 17600: Standardize our EXPORT_OK 2021-07-16 08:58:47 +02:00
CoverImages.pm Bug 17600: Standardize our EXPORT_OK 2021-07-16 08:58:47 +02:00
CsvProfile.pm Bug 17600: Standardize our EXPORT_OK 2021-07-16 08:58:47 +02:00
CsvProfiles.pm Bug 17600: Standardize our EXPORT_OK 2021-07-16 08:58:47 +02:00
Database.pm Bug 19821: Use database_test entry if exists 2021-10-25 11:27:40 +02:00
DateUtils.pm Bug 30717: (QA follow-up) Move to module 2022-05-13 15:41:55 -10:00
Desk.pm Bug 17600: Standardize our EXPORT_OK 2021-07-16 08:58:47 +02:00
Desks.pm Bug 17600: Standardize our EXPORT_OK 2021-07-16 08:58:47 +02:00
EDI.pm Bug 28672: (QA follow-up) Method calls cannot be interpolated directly 2023-02-15 21:43:51 +00:00
Edifact.pm Bug 17600: Standardize our EXPORT_OK 2021-07-16 08:58:47 +02:00
Email.pm Bug 29330: Add Koha::Email->new_from_string 2021-11-15 12:38:39 +01:00
Encryption.pm Bug 31053: Add Context module to Koha::Encryption 2022-07-29 16:42:41 +00:00
Exception.pm Bug 29857: (QA follow-up) Add license 2022-03-01 22:47:47 -10:00
Exceptions.pm Bug 30057: Move virtualshelf-related exceptions to a separate library 2022-07-12 16:15:12 +00:00
ExternalContent.pm Bug 17600: Standardize our EXPORT_OK 2021-07-16 08:58:47 +02:00
FrameworkPlugin.pm Bug 28769: Remove tabloop from cataloguing plugins 2021-10-18 11:28:40 +02:00
Hold.pm Bug 32627: Calculate expirationdate relative to waitingdate 2023-06-15 19:08:38 +00:00
Holds.pm Bug 30447: Check if transfers arrived or cancelled 2022-08-23 19:34:49 +00:00
I18N.pm Bug 35174: Do not explode if po dir does not exist 2023-11-22 09:39:12 +01:00
Illcomment.pm
…
Illcomments.pm
…
Illrequest.pm Bug 28932: Fix duplicate next_action & prev_action 2022-01-17 14:55:56 -10:00
Illrequestattribute.pm
…
Illrequestattributes.pm
…
Illrequests.pm
…
ImportBatch.pm Bug 23019: Add profiles to stage-import-batch and magnage-import-batch pages 2020-11-11 15:55:49 +01:00
ImportBatchProfile.pm Bug 23019: (follow-up) Fix other things 2020-11-11 15:55:49 +01:00
ImportBatchProfiles.pm Bug 23019: (follow-up) Fix other things 2020-11-11 15:55:49 +01:00
ImportBatches.pm Bug 23019: Add profiles to stage-import-batch and magnage-import-batch pages 2020-11-11 15:55:49 +01:00
Item.pm Bug 32129: Use patron category when checking if item can fill recall 2023-06-15 19:35:49 +00:00
ItemType.pm Bug 29844: Some more uncaught cases 2022-02-09 15:36:23 -10:00
ItemTypes.pm Bug 17600: Standardize our EXPORT_OK 2021-07-16 08:58:47 +02:00
Items.pm Bug 30465: Fix Koha/Items/BatchUpdate.t 2022-05-06 10:41:55 +01:00
KeyboardShortcut.pm Bug 17600: Standardize our EXPORT_OK 2021-07-16 08:58:47 +02:00
KeyboardShortcuts.pm Bug 17600: Standardize our EXPORT_OK 2021-07-16 08:58:47 +02:00
Libraries.pm Bug 17600: Standardize our EXPORT_OK 2021-07-16 08:58:47 +02:00
Library.pm Bug 28948: (QA follow-up) Convert to allow-list 2021-10-28 17:32:34 +02:00
Linktracker.pm Bug 17600: Standardize our EXPORT_OK 2021-07-16 08:58:47 +02:00
Localization.pm
…
Localizations.pm
…
Logger.pm Bug 25464: Add ability to specify client IP and SIP account used in SIP2 logging 2021-07-26 12:46:32 +02:00
Manual.pm Bug 31465: (follow-up) Link to preference tabs directly 2022-11-10 23:25:07 +00:00
MarcOverlayRule.pm Bug 14957: (QA follow-up) Rename 'merge' => 'overlay' 2021-10-26 16:46:02 +02:00
MarcOverlayRules.pm Bug 14957: Fix field order issue 2021-10-26 16:46:03 +02:00
MarcSubfieldStructure.pm Bug 17600: Standardize our EXPORT_OK 2021-07-16 08:58:47 +02:00
MarcSubfieldStructures.pm Bug 17600: Standardize our EXPORT_OK 2021-07-16 08:58:47 +02:00
MessageAttribute.pm Bug 17600: Standardize our EXPORT_OK 2021-07-16 08:58:47 +02:00
MessageAttributes.pm Bug 17600: Standardize our EXPORT_OK 2021-07-16 08:58:47 +02:00
MetaSearcher.pm Bug 17600: Standardize our EXPORT_OK 2021-07-16 08:58:47 +02:00
MetadataIterator.pm
…
MetadataRecord.pm Bug 17600: Standardize our EXPORT_OK 2021-07-16 08:58:47 +02:00
MoreUtils.pm
…
OAuth.pm Bug 28772: Make secret validation use the new method 2021-09-30 09:19:05 +02:00
OAuthAccessToken.pm
…
OAuthAccessTokens.pm
…
Object.pm Bug 29857: Rename base class as Koha::Exception 2022-03-01 22:47:47 -10:00
Objects.pm Bug 29844: Remove use of wantarray from Koha::Objects 2022-02-09 15:36:23 -10:00
Patron.pm Bug 19613: Use the 'note' profile 2024-05-03 14:23:39 +12:00
Patrons.pm Bug 30058: Add Koha::Patrons->filter_by_have_subpermission 2022-03-17 11:22:56 -10:00
Plugins.pm Bug 30180: (follow-up) Add temporary deprecation warning 2022-05-04 14:29:24 -10:00
ProblemReport.pm
…
ProblemReports.pm
…
PseudonymizedTransaction.pm Bug 17600: Standardize our EXPORT_OK 2021-07-16 08:58:47 +02:00
PseudonymizedTransactions.pm Bug 17600: Standardize our EXPORT_OK 2021-07-16 08:58:47 +02:00
Quote.pm Bug 17600: Standardize our EXPORT_OK 2021-07-16 08:58:47 +02:00
Quotes.pm Bug 17600: Standardize our EXPORT_OK 2021-07-16 08:58:47 +02:00
RDF.pm
…
Rating.pm Bug 17600: Standardize our EXPORT_OK 2021-07-16 08:58:47 +02:00
Ratings.pm Bug 17600: Standardize our EXPORT_OK 2021-07-16 08:58:47 +02:00
Recall.pm Bug 18398: Update C4::Message enqueue to use $patron->notice_email_address 2023-05-15 14:33:33 +00:00
Recalls.pm Bug 18398: Update C4::Message enqueue to use $patron->notice_email_address 2023-05-15 14:33:33 +00:00
RecordProcessor.pm Bug 17600: Standardize our EXPORT_OK 2021-07-16 08:58:47 +02:00
Report.pm Bug 17600: Standardize our EXPORT_OK 2021-07-16 08:58:47 +02:00
Reports.pm Bug 17600: Standardize our EXPORT_OK 2021-07-16 08:58:47 +02:00
Review.pm Bug 17600: Standardize our EXPORT_OK 2021-07-16 08:58:47 +02:00
Reviews.pm Bug 17600: Standardize our EXPORT_OK 2021-07-16 08:58:47 +02:00
Schema.pm
…
Script.pm Bug 29857: Rename base class as Koha::Exception 2022-03-01 22:47:47 -10:00
SearchEngine.pm Bug 17600: Standardize our EXPORT_OK 2021-07-16 08:58:47 +02:00
SearchField.pm Bug 17600: Standardize our EXPORT_OK 2021-07-16 08:58:47 +02:00
SearchFields.pm Bug 17600: Standardize our EXPORT_OK 2021-07-16 08:58:47 +02:00
SearchMarcMap.pm Bug 17600: Standardize our EXPORT_OK 2021-07-16 08:58:47 +02:00
SearchMarcMaps.pm Bug 17600: Standardize our EXPORT_OK 2021-07-16 08:58:47 +02:00
Serial.pm Bug 17600: Standardize our EXPORT_OK 2021-07-16 08:58:47 +02:00
Serials.pm Bug 17600: Standardize our EXPORT_OK 2021-07-16 08:58:47 +02:00
SharedContent.pm Bug 17600: Standardize our EXPORT_OK 2021-07-16 08:58:47 +02:00
SimpleMARC.pm Bug 31644: Check if subfield defined, not for truth 2022-12-05 21:51:37 +00:00
Sitemapper.pm
…
Statistic.pm Bug 17600: Standardize our EXPORT_OK 2021-07-16 08:58:47 +02:00
Statistics.pm Bug 17600: Standardize our EXPORT_OK 2021-07-16 08:58:47 +02:00
StockRotationItem.pm Bug 30518: Correct DateTime maths for needs_advancing 2022-04-19 21:25:50 -10:00
StockRotationItems.pm
…
StockRotationRota.pm
…
StockRotationRotas.pm
…
StockRotationStage.pm
…
StockRotationStages.pm
…
Subscription.pm Bug 17600: Standardize our EXPORT_OK 2021-07-16 08:58:47 +02:00
Subscriptions.pm Bug 17600: Standardize our EXPORT_OK 2021-07-16 08:58:47 +02:00
Suggestion.pm Bug 17314: Implement /suggestions routes 2021-10-28 17:32:34 +02:00
SuggestionEngine.pm Bug 17600: Standardize our EXPORT_OK 2021-07-16 08:58:47 +02:00
Suggestions.pm Bug 33238: Fix bad suggestions query (Bug 29886 follow-up) 2023-05-05 22:29:15 +00:00
Tag.pm Bug 17600: Standardize our EXPORT_OK 2021-07-16 08:58:47 +02:00
Tags.pm Bug 17600: Standardize our EXPORT_OK 2021-07-16 08:58:47 +02:00
Token.pm Bug 27849: (follow-up) Add test 2022-09-29 15:41:54 +00:00
TrackedLink.pm Bug 22690: (QA follow-up) Add TrackedLink classes and use them 2021-08-27 11:02:41 +02:00
TrackedLinks.pm Bug 22690: (QA follow-up) Add TrackedLink classes and use them 2021-08-27 11:02:41 +02:00
UploadedFile.pm Bug 29156: File missing warning in Koha::UploadedFile for permanent files only 2022-01-21 21:34:51 -10:00
UploadedFiles.pm Bug 17600: Standardize our EXPORT_OK 2021-07-16 08:58:47 +02:00
Uploader.pm Bug 36818: Escape characters in file names uploaded 2024-05-31 03:05:08 +00:00
Virtualshelf.pm Bug 29955: Fix method import issues 2022-11-10 23:49:26 +00:00
Virtualshelfcontent.pm Bug 17600: Standardize our EXPORT_OK 2021-07-16 08:58:47 +02:00
Virtualshelfcontents.pm Bug 17600: Standardize our EXPORT_OK 2021-07-16 08:58:47 +02:00
Virtualshelfshare.pm Bug 30057: Move virtualshelf-related exceptions to a separate library 2022-07-12 16:15:12 +00:00
Virtualshelfshares.pm Bug 17600: Standardize our EXPORT_OK 2021-07-16 08:58:47 +02:00
Virtualshelves.pm Bug 26346: Add option to make public lists editable by all staff 2022-04-12 17:13:02 +02:00
Z3950Responder.pm Bug 25292: Flushing L1 on every Z3950 server search 2021-01-11 10:27:37 +01:00
Z3950Server.pm Bug 17600: Standardize our EXPORT_OK 2021-07-16 08:58:47 +02:00
Z3950Servers.pm Bug 17600: Standardize our EXPORT_OK 2021-07-16 08:58:47 +02:00