Koha-community/Koha
13
7
Fork 0
Code Issues Releases Wiki Activity

Bug 35291: Don't allow symlinks for link files in cover image ZIP

Browse source 
There's no reason to allow symlinks for link files in cover image
ZIP files. Preventing their use prevents someone from uploading
a symlink pointing to an existing file on the Koha server.

Test plan:
0. Apply patch and restart/reload Koha
1. Create a PNG cover image
2. Create a datalink.txt file that contains something like the
following:
29,Untitled.PNG
3. Turn on "LocalCoverImages" system preference
4. Upload via http://localhost:8081/cgi-bin/koha/tools/upload-cover-image.pl
5. Go to http://localhost:8081/cgi-bin/koha/catalogue/detail.pl?biblionumber=29
6. Note the cover image has been uploaded

Signed-off-by: Nick Clemens <nick@bywatersolutions.com>
Signed-off-by: Aleisha Amohia <aleishaamohia@hotmail.com>
Signed-off-by: Tomas Cohen Arazi <tomascohen@theke.io>
Signed-off-by: Pedro Amorim <pedro.amorim@ptfs-europe.com>
This commit is contained in:
David Cook 2023-11-09 00:23:45 +00:00 committed by Pedro Amorim
parent bcfa13c93d
commit 9982fdf0d6
1 changed files with 6 additions and 5 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

11
tools/upload-cover-image.pl
View file

@ -158,11 +158,12 @@ if ($fileID) {
}
foreach my $dir (@directories) {
my $file;
if ( -e "$dir/idlink.txt" ) {
$file = "$dir/idlink.txt";
}
elsif ( -e "$dir/datalink.txt" ) {
$file = "$dir/datalink.txt";
my $idlink = "$dir/idlink.txt";
my $datalink = "$dir/datalink.txt";
if ( -e $idlink && !-l $idlink ) {
$file = $idlink;
} elsif ( -e $datalink && !-l $datalink ) {
$file = $datalink;
}
else {
next;