Bug 35291: Don't allow symlinks for link files in cover image ZIP
authorDavid Cook <dcook@prosentient.com.au>
Thu, 9 Nov 2023 00:23:45 +0000 (00:23 +0000)
committerJonathan Druart <jonathan.druart@bugs.koha-community.org>
Fri, 1 Dec 2023 06:05:08 +0000 (07:05 +0100)
commitd0ca53764aebe6055239cd9a0fca53b71ed6afa7
tree9974e50954bf6a583c0e5a5153aee6345c7be1ae
parent3525f0bf68a6d4d127e78bf7c6f0cb5c21b7b19f
Bug 35291: Don't allow symlinks for link files in cover image ZIP

There's no reason to allow symlinks for link files in cover image
ZIP files. Preventing their use prevents someone from uploading
a symlink pointing to an existing file on the Koha server.

Test plan:
0. Apply patch and restart/reload Koha
1. Create a PNG cover image
2. Create a datalink.txt file that contains something like the
following:
29,Untitled.PNG
3. Turn on "LocalCoverImages" system preference
4. Upload via http://localhost:8081/cgi-bin/koha/tools/upload-cover-image.pl
5. Go to http://localhost:8081/cgi-bin/koha/catalogue/detail.pl?biblionumber=29
6. Note the cover image has been uploaded

Signed-off-by: Nick Clemens <nick@bywatersolutions.com>
Signed-off-by: Aleisha Amohia <aleishaamohia@hotmail.com>
Signed-off-by: Tomas Cohen Arazi <tomascohen@theke.io>
Signed-off-by: Jonathan Druart <jonathan.druart@bugs.koha-community.org>
tools/upload-cover-image.pl