Bug 35291: Don't allow symlinks for link files in cover image ZIP
authorDavid Cook <dcook@prosentient.com.au>
Thu, 9 Nov 2023 00:23:45 +0000 (00:23 +0000)
committerLucas Gass <lucas@bywatersolutions.com>
Tue, 28 Nov 2023 15:25:15 +0000 (15:25 +0000)
commit115296a42416832895e41e08bc9c0bd4f6752786
tree9913f9f3d0b35fc59e26f588c27478211dfad478
parentc7e6ba43d06b953c51deaaf96c95ec110ff84246
Bug 35291: Don't allow symlinks for link files in cover image ZIP

There's no reason to allow symlinks for link files in cover image
ZIP files. Preventing their use prevents someone from uploading
a symlink pointing to an existing file on the Koha server.

Test plan:
0. Apply patch and restart/reload Koha
1. Create a PNG cover image
2. Create a datalink.txt file that contains something like the
following:
29,Untitled.PNG
3. Turn on "LocalCoverImages" system preference
4. Upload via http://localhost:8081/cgi-bin/koha/tools/upload-cover-image.pl
5. Go to http://localhost:8081/cgi-bin/koha/catalogue/detail.pl?biblionumber=29
6. Note the cover image has been uploaded

Signed-off-by: Nick Clemens <nick@bywatersolutions.com>
Signed-off-by: Aleisha Amohia <aleishaamohia@hotmail.com>
Signed-off-by: Tomas Cohen Arazi <tomascohen@theke.io>
Signed-off-by: Lucas Gass <lucas@bywatersolutions.com>
tools/upload-cover-image.pl