From 39b84b07c36c51da9af72c23844b4a1d20e52331 Mon Sep 17 00:00:00 2001
From: Marcel de Rooy <m.de.rooy@rijksmuseum.nl>
Date: Thu, 27 Feb 2020 08:02:03 +0000
Subject: [PATCH] Bug 24052: Add koha_xslt_security to koha-conf.xml

The line for enabling the unsafe expand_entities option is commented
and includes a warning to keep it like that ;)

Signed-off-by: Marcel de Rooy <m.de.rooy@rijksmuseum.nl>
Signed-off-by: Owen Leonard <oleonard@myacpl.org>
Signed-off-by: Kyle M Hall <kyle@bywatersolutions.com>
Signed-off-by: Martin Renvoize <martin.renvoize@ptfs-europe.com>
---
 debian/templates/koha-conf-site.xml.in | 8 ++++++++
 etc/koha-conf.xml                      | 8 ++++++++
 2 files changed, 16 insertions(+)

diff --git a/debian/templates/koha-conf-site.xml.in b/debian/templates/koha-conf-site.xml.in
index ded7acea7c..319f492c23 100644
--- a/debian/templates/koha-conf-site.xml.in
+++ b/debian/templates/koha-conf-site.xml.in
@@ -426,5 +426,13 @@ __END_SRU_PUBLICSERVER__
     </repo>
  </plugin_repos>
 
+ <koha_xslt_security>
+ <!-- Uncomment the following entry ONLY when you explicitly want the XSLT
+      parser to expand entities like <!ENTITY secret SYSTEM "/etc/secrets">.
+      This is unsafe and therefore NOT recommended!
+     <expand_entities_unsafe>1</expand_entities_unsafe>
+ -->
+ </koha_xslt_security>
+
 </config>
 </yazgfs>
diff --git a/etc/koha-conf.xml b/etc/koha-conf.xml
index 519a9ccd54..5be267d656 100644
--- a/etc/koha-conf.xml
+++ b/etc/koha-conf.xml
@@ -250,5 +250,13 @@ __PAZPAR2_TOGGLE_XML_POST__
     </repo>
  </plugin_repos>
 
+ <koha_xslt_security>
+ <!-- Uncomment the following entry ONLY when you explicitly want the XSLT
+      parser to expand entities like <!ENTITY secret SYSTEM "/etc/secrets">.
+      This is unsafe and therefore NOT recommended!
+     <expand_entities_unsafe>1</expand_entities_unsafe>
+ -->
+ </koha_xslt_security>
+
 </config>
 </yazgfs>
-- 
2.39.5