From 1a202aa4aa767624fa84df74e916bec7c08b01ab Mon Sep 17 00:00:00 2001
From: David Cook <dcook@prosentient.com.au>
Date: Fri, 20 Mar 2026 06:10:22 +0000
Subject: [PATCH] Bug 42136: prevent cgi, directory, and file plugins from use
 in user-entered templates

Signed-off-by: Brendan Lawlor <blawlor@clamsnet.org>

Signed-off-by: Jonathan Druart <jonathan.druart@bugs.koha-community.org>
Signed-off-by: Lucas Gass <lucas@bywatersolutions.com>
---
 C4/Letters.pm                | 10 ++++++++--
 Koha/Template/Plugin/noop.pm |  7 +++++++
 Koha/TemplateUtils.pm        | 10 ++++++++--
 3 files changed, 23 insertions(+), 4 deletions(-)
 create mode 100644 Koha/Template/Plugin/noop.pm

diff --git a/C4/Letters.pm b/C4/Letters.pm
index b748be2076..9860050f69 100644
--- a/C4/Letters.pm
+++ b/C4/Letters.pm
@@ -1805,8 +1805,14 @@ sub _process_tt {
     my $use_template_cache = C4::Context->config('template_cache_dir') && defined $ENV{GATEWAY_INTERFACE};
     my $template           = Template->new(
         {
-            EVAL_PERL    => 0,
-            ABSOLUTE     => 0,
+            EVAL_PERL => 0,
+            ABSOLUTE  => 0,
+            RELATIVE  => 0,
+            PLUGINS   => {
+                cgi       => 'Koha::Template::Plugin::noop',
+                directory => 'Koha::Template::Plugin::noop',
+                file      => 'Koha::Template::Plugin::noop',
+            },
             PLUGIN_BASE  => 'Koha::Template::Plugin',
             COMPILE_EXT  => $use_template_cache ? '.ttc'                                    : '',
             COMPILE_DIR  => $use_template_cache ? C4::Context->config('template_cache_dir') : '',
diff --git a/Koha/Template/Plugin/noop.pm b/Koha/Template/Plugin/noop.pm
new file mode 100644
index 0000000000..ab9f012bf8
--- /dev/null
+++ b/Koha/Template/Plugin/noop.pm
@@ -0,0 +1,7 @@
+package Koha::Template::Plugin::noop;
+
+use Modern::Perl;
+
+use base qw( Template::Plugin );
+
+1;
diff --git a/Koha/TemplateUtils.pm b/Koha/TemplateUtils.pm
index 81e4bc78b1..60a8f3b2ee 100644
--- a/Koha/TemplateUtils.pm
+++ b/Koha/TemplateUtils.pm
@@ -61,8 +61,14 @@ sub process_tt {
 
         my $tt = Template->new(
             {
-                EVAL_PERL   => 0,
-                ABSOLUTE    => 0,
+                EVAL_PERL => 0,
+                ABSOLUTE  => 0,
+                RELATIVE  => 0,
+                PLUGINS   => {
+                    cgi       => 'Koha::Template::Plugin::noop',
+                    directory => 'Koha::Template::Plugin::noop',
+                    file      => 'Koha::Template::Plugin::noop',
+                },
                 PLUGIN_BASE => 'Koha::Template::Plugin',
                 COMPILE_EXT => $use_template_cache ? '.ttc'                                    : '',
                 COMPILE_DIR => $use_template_cache ? C4::Context->config('template_cache_dir') : '',