f199a09668
This change checks for HTTP(S) URLs and skips the shell when using system() so that shell metacharacters aren't interpreted. Test plan: 0. Apply the patch 1. Insert the following into the Babeltheque_url_update system preference: $(whoami > /tmp/rce.log) 2. koha-shell kohadev 3. perl misc/cronjobs/social_data/update_social_data.pl 4. Note the script says the following: $(whoami > /tmp/rce.log) is not a HTTP URL. Aborting. 5. Note also that /tmp/rce.log is not created 6. Change Babeltheque_url_update syspref to something like the following: http://localhost:8080 7. perl misc/cronjobs/social_data/update_social_data.pl 8. Note that the wget succeeds but the bunzip2 fails (as expected) since we haven't fetched a bzipped file 9. Try to create a payload that passes the HTTP URL test with shell metacharacters and note that they're not interpetted and instead just used as part of a URL string. Signed-off-by: Jake Deery <jake.deery@openfifth.co.uk> Signed-off-by: Jonathan Druart <jonathan.druart@bugs.koha-community.org> Signed-off-by: Lucas Gass <lucas@bywatersolutions.com> |
||
|---|---|---|
| .. | ||
| get_report_social_data.pl | ||
| update_social_data.pl | ||