gitea
/
Koha-clms
1
0
Fork 0
Code Issues Pull Requests Packages Projects Releases Wiki Activity

Bug 37488: Validate paths in datalink.txt/idlink.txt files 

This change validates the paths in datalink.txt/idlink.txt,
so that only images in the unpacked archive directory are allowed

Test plan:
0. Apply the patch
1. koha-plack --reload kohadev
2. Create a datalink.txt file with the following:
42,selfie.jpg
3. Create a jpeg at selfie.jpg
4. ZIP the datalink.txt and selfie.jpg files
5. Upload to the "Upload patron images" tool
(after enabling the "patronimages" system preference)
6. Note that the image uploads correctly

Signed-off-by: Nick Clemens <nick@bywatersolutions.com>

Signed-off-by: Marcel de Rooy <m.de.rooy@rijksmuseum.nl>
Signed-off-by: Tomas Cohen Arazi <tomascohen@theke.io>
This commit is contained in:
David Cook 2024-07-26 04:01:43 +00:00 committed by Tomas Cohen Arazi
parent cdd8ff892c
commit 5dc4b625cb
No known key found for this signature in database
GPG Key ID: 0A272EA1B2F3C15F
1 changed files with 6 additions and 1 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

7
tools/picture-upload.pl
View File

@ -266,7 +266,12 @@ sub handle_dir {
$cardnumber =~ s/[\"\r\n]//g; # remove offensive characters
$filename =~ s/[\"\r\n\s]//g;
$logger->debug("Cardnumber: $cardnumber Filename: $filename");
$source = "$dir/$filename";
$source = Cwd::abs_path("$dir/$filename");
if ( $source !~ /^\Q$dir\E/ ) {
#NOTE: Unset $source if it points to a file outside of this unpacked ZIP archive
$source = '';
}
%counts = handle_file( $cardnumber, $source, $template, %counts );
}
closedir $dir_h;