gitea
/
Koha-clms
1
0
Fork 0
Code Issues Pull Requests Packages Projects Releases Wiki Activity

Bug 40719: Explicitly disable off RELATIVE file paths for plugins for user-entered templates 

In bug 39184 we set EVAL_PERL and ABSOLUTE to 0, which is the default. RELATIVE also defaults to 0. For security we should probably specify that as well in case the default is changed somehow.

Test Plan:
1) Apply this patch
2) Generate some notices
3) No change should be noted!

Signed-off-by: noah <noah@inlibro.com>
Signed-off-by: David Cook <dcook@prosentient.com.au>
Signed-off-by: Lucas Gass <lucas@bywatersolutions.com>
(cherry picked from commit bd85f990da)
Signed-off-by: Jacob O'Mara <jacob.omara@openfifth.co.uk>
This commit is contained in:
Kyle M Hall 2025-08-28 07:34:39 -04:00 committed by Jacob O'Mara
parent af3c80b9af
commit b36dca90b1
No known key found for this signature in database
1 changed files with 1 additions and 0 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

1
C4/Letters.pm
View File

@ -1804,6 +1804,7 @@ sub _process_tt {
{
EVAL_PERL => 0,
ABSOLUTE => 0,
RELATIVE => 0,
PLUGIN_BASE => 'Koha::Template::Plugin',
COMPILE_EXT => $use_template_cache ? '.ttc' : '',
COMPILE_DIR => $use_template_cache ? C4::Context->config('template_cache_dir') : '',