gitea
/
Koha-clms
1
0
Fork 0
Code Issues Pull Requests Packages Projects Releases Wiki Activity
Koha-clms/misc/cronjobs
History
David Cook f199a09668
Bug 40748: Check for HTTP URLs and skip shell when using system() 
This change checks for HTTP(S) URLs and skips the shell when using
system() so that shell metacharacters aren't interpreted.

Test plan:
0. Apply the patch
1. Insert the following into the Babeltheque_url_update system preference:
$(whoami > /tmp/rce.log)
2. koha-shell kohadev
3. perl misc/cronjobs/social_data/update_social_data.pl
4. Note the script says the following:
$(whoami > /tmp/rce.log) is not a HTTP URL. Aborting.
5. Note also that /tmp/rce.log is not created
6. Change Babeltheque_url_update syspref to something like the following:
http://localhost:8080
7. perl misc/cronjobs/social_data/update_social_data.pl
8. Note that the wget succeeds but the bunzip2 fails (as expected) since
we haven't fetched a bzipped file
9. Try to create a payload that passes the HTTP URL test with shell
metacharacters and note that they're not interpetted and instead
just used as part of a URL string.

Signed-off-by: Jake Deery <jake.deery@openfifth.co.uk>

Signed-off-by: Jonathan Druart <jonathan.druart@bugs.koha-community.org>
Signed-off-by: Lucas Gass <lucas@bywatersolutions.com>
 		2025-09-26 09:10:20 -06:00
..
holds Bug 40163: Fix several http addresses in the code docs 2025-09-23 16:21:29 -06:00
recalls Bug 40163: Fix several http addresses in the code docs 2025-09-23 16:21:29 -06:00
rss Bug 40163: Fix several http addresses in the code docs 2025-09-23 16:21:29 -06:00
social_data Bug 40748: Check for HTTP URLs and skip shell when using system() 2025-09-26 09:10:20 -06:00
thirdparty Bug 40163: Fix several http addresses in the code docs 2025-09-23 16:21:29 -06:00
CONFIGURE.gmail Bug 40163: (follow-up) Fix wrong GNU links and update test 2025-09-24 09:25:04 -06:00
advance_notices.pl Bug 40163: Fix several http addresses in the code docs 2025-09-23 16:21:29 -06:00
archive_purchase_suggestions.pl Bug 40163: Fix several http addresses in the code docs 2025-09-23 16:21:29 -06:00
automatic_checkin.pl Bug 40163: Fix several http addresses in the code docs 2025-09-23 16:21:29 -06:00
automatic_item_modification_by_age.pl Bug 40163: Fix several http addresses in the code docs 2025-09-23 16:21:29 -06:00
automatic_renewals.pl Bug 40163: Fix several http addresses in the code docs 2025-09-23 16:21:29 -06:00
backup.sh
…
batch_anonymise.pl Bug 40163: Fix several http addresses in the code docs 2025-09-23 16:21:29 -06:00
build_browser_and_cloud.pl Bug 38664: Tidy the whole codebase 2025-02-11 14:58:24 +01:00
cart_to_shelf.pl Bug 40163: Fix several http addresses in the code docs 2025-09-23 16:21:29 -06:00
check-url-quick.pl Bug 40163: Fix several http addresses in the code docs 2025-09-23 16:21:29 -06:00
cleanup_database.pl Bug 40163: Fix several http addresses in the code docs 2025-09-23 16:21:29 -06:00
cloud-kw.pl Bug 40163: Fix several http addresses in the code docs 2025-09-23 16:21:29 -06:00
cloud-sample.conf
…
create_koc_db.pl Bug 40163: Fix several http addresses in the code docs 2025-09-23 16:21:29 -06:00
crontab.example Bug 39250: Add archive_purchase_suggestions.pl to cron.daily commented 2025-03-07 15:41:17 +01:00
debar_patrons_with_fines.pl Bug 40163: Fix several http addresses in the code docs 2025-09-23 16:21:29 -06:00
delete_items.pl Bug 40163: Fix several http addresses in the code docs 2025-09-23 16:21:29 -06:00
delete_patrons.pl Bug 40163: Fix several http addresses in the code docs 2025-09-23 16:21:29 -06:00
delete_records_via_leader.pl Bug 40163: Fix several http addresses in the code docs 2025-09-23 16:21:29 -06:00
edi_cron.pl Bug 40163: Fix several http addresses in the code docs 2025-09-23 16:21:29 -06:00
erm_run_harvester.pl Bug 40163: Fix several http addresses in the code docs 2025-09-23 16:21:29 -06:00
fines.pl Bug 40163: Fix several http addresses in the code docs 2025-09-23 16:21:29 -06:00
gather_print_notices.pl Bug 40163: Fix several http addresses in the code docs 2025-09-23 16:21:29 -06:00
harvest_oai.pl Bug 40163: Fix several http addresses in the code docs 2025-09-23 16:21:29 -06:00
import_webservice_batch.pl Bug 40163: Fix several http addresses in the code docs 2025-09-23 16:21:29 -06:00
longoverdue.pl Bug 40163: Fix several http addresses in the code docs 2025-09-23 16:21:29 -06:00
marc_ordering_process.pl Bug 40163: Fix several http addresses in the code docs 2025-09-23 16:21:29 -06:00
membership_expiry.pl Bug 40163: Fix several http addresses in the code docs 2025-09-23 16:21:29 -06:00
merge_authorities.pl Bug 38664: Tidy the whole codebase 2025-02-11 14:58:24 +01:00
notice_unprocessed_suggestions.pl Bug 40163: Fix several http addresses in the code docs 2025-09-23 16:21:29 -06:00
overdue_notices.pl Bug 40163: Fix several http addresses in the code docs 2025-09-23 16:21:29 -06:00
patron_emailer.pl Bug 40163: Fix several http addresses in the code docs 2025-09-23 16:21:29 -06:00
plugins_nightly.pl Bug 40163: Fix several http addresses in the code docs 2025-09-23 16:21:29 -06:00
printoverdues.sh
…
process_message_queue.pl Bug 40163: Fix several http addresses in the code docs 2025-09-23 16:21:29 -06:00
purge_suggestions.pl Bug 40163: Fix several http addresses in the code docs 2025-09-23 16:21:29 -06:00
reconcile_balances.pl Bug 40163: Fix several http addresses in the code docs 2025-09-23 16:21:29 -06:00
remove_temporary_edifiles.pl Bug 38664: Tidy the whole codebase 2025-02-11 14:58:24 +01:00
restrict_patrons_with_failed_notices.pl Bug 40163: Fix several http addresses in the code docs 2025-09-23 16:21:29 -06:00
runreport.pl Bug 40163: Fix several http addresses in the code docs 2025-09-23 16:21:29 -06:00
serialsUpdate.pl Bug 40163: Fix several http addresses in the code docs 2025-09-23 16:21:29 -06:00
sftp_file.pl Bug 40163: Fix several http addresses in the code docs 2025-09-23 16:21:29 -06:00
share_usage_with_koha_community.pl Bug 40163: Fix several http addresses in the code docs 2025-09-23 16:21:29 -06:00
sitemap.pl Bug 40163: Fix several http addresses in the code docs 2025-09-23 16:21:29 -06:00
staticfines.pl Bug 40163: Fix several http addresses in the code docs 2025-09-23 16:21:29 -06:00
stockrotation.pl Bug 40163: Fix several http addresses in the code docs 2025-09-23 16:21:29 -06:00
update_patrons_category.pl Bug 40163: Fix several http addresses in the code docs 2025-09-23 16:21:29 -06:00
update_totalissues.pl Bug 40163: Fix several http addresses in the code docs 2025-09-23 16:21:29 -06:00
writeoff_debts.pl Bug 40163: Fix several http addresses in the code docs 2025-09-23 16:21:29 -06:00