Bug 35291: Don't allow symlinks for link files in cover image ZIP
authorDavid Cook <dcook@prosentient.com.au>
Thu, 9 Nov 2023 00:23:45 +0000 (00:23 +0000)
committerPedro Amorim <pedro.amorim@ptfs-europe.com>
Tue, 28 Nov 2023 14:14:18 +0000 (14:14 +0000)
commit9982fdf0d680e4433a0d1a1ae593af88018c73ad
tree9ed7fd09f1bb8892c383d97c2f0cd375dc7ef570
parentbcfa13c93dbe559a0ec7227847e4178a50b5c7f6
Bug 35291: Don't allow symlinks for link files in cover image ZIP

There's no reason to allow symlinks for link files in cover image
ZIP files. Preventing their use prevents someone from uploading
a symlink pointing to an existing file on the Koha server.

Test plan:
0. Apply patch and restart/reload Koha
1. Create a PNG cover image
2. Create a datalink.txt file that contains something like the
following:
29,Untitled.PNG
3. Turn on "LocalCoverImages" system preference
4. Upload via http://localhost:8081/cgi-bin/koha/tools/upload-cover-image.pl
5. Go to http://localhost:8081/cgi-bin/koha/catalogue/detail.pl?biblionumber=29
6. Note the cover image has been uploaded

Signed-off-by: Nick Clemens <nick@bywatersolutions.com>
Signed-off-by: Aleisha Amohia <aleishaamohia@hotmail.com>
Signed-off-by: Tomas Cohen Arazi <tomascohen@theke.io>
Signed-off-by: Pedro Amorim <pedro.amorim@ptfs-europe.com>
tools/upload-cover-image.pl