gitea
/
Koha-clms
1
0
Fork 0
Code Issues Pull Requests Packages Projects Releases Wiki Activity

Bug 37323: Don't allow symlinks in link files in zip and validate filepaths 

Test plan:
0. Apply patch and restart/reload Koha
1. Test that uploading a patron image still works, in single file format and as a zip

Work as suggested

Signed-off-by: Amit Gupta <amit.gupta@informaticsglobal.com>
Signed-off-by: David Cook <dcook@prosentient.com.au>
Signed-off-by: Nick Clemens <nick@bywatersolutions.com>
Signed-off-by: Tomas Cohen Arazi <tomascohen@theke.io>
(cherry picked from commit 9bc0521493fbe2f9fe0dde051d0b2f52c8a14a9a)
Signed-off-by: Tomas Cohen Arazi <tomascohen@theke.io>
This commit is contained in:
Chris Cormack 2024-07-18 23:57:32 +00:00 committed by Tomas Cohen Arazi
parent 7a15b321a3
commit df3ecb46ed
No known key found for this signature in database
GPG Key ID: 0A272EA1B2F3C15F
1 changed files with 8 additions and 4 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

12
tools/picture-upload.pl
View File

@ -25,6 +25,8 @@ use File::Temp;
use CGI qw ( -utf8 );
use GD;
use MIME::Base64;
use Cwd;
use C4::Context;
use C4::Auth qw( get_template_and_user );
use C4::Output qw( output_and_exit output_html_with_http_headers );
@ -213,13 +215,15 @@ sub handle_dir {
my $dir_h;
opendir $dir_h, $dir;
while ( my $filename = readdir $dir_h ) {
$file = "$dir/$filename"
if ( $filename =~ m/datalink\.txt/i
|| $filename =~ m/idlink\.txt/i );
if ( ($filename =~ m/datalink\.txt/i
|| $filename =~ m/idlink\.txt/i ) && ( -e "$dir/$filename" && !-l "$dir/$filename")) {
$file = Cwd::abs_path("$dir/$filename");
}
}
my $fh;
unless ( open( $fh, '<', $file ) ) {
warn "Opening $dir/$file failed!";
warn "Opening $file failed!";
$direrrors{'OPNLINK'} = $file;
# This error is fatal to the import of this directory contents
# so bail and return the error to the caller