]> git.koha-community.org Git - koha.git/commit
Bug 6628 : Stopping a potential vulnerability
authorChris Cormack <chrisc@catalyst.net.nz>
Fri, 25 Nov 2011 18:39:51 +0000 (07:39 +1300)
committerPaul Poulain <paul.poulain@biblibre.com>
Mon, 28 Nov 2011 09:05:58 +0000 (10:05 +0100)
commit8664d195671c1a65af7b205b14099c1581c0500b
tree21edd4fbd90ed31562dfeb95fe9be07e897df1f8
parent2989e12288b09745863376d10d830af5687e7e5e
Bug 6628 : Stopping a potential vulnerability

Signed-off-by: Frère Sébastien Marie <semarie-koha@latrappe.fr>
Signed-off-by: Katrin Fischer <Katrin.Fischer.83@web.de>
- verified help pages still work
- verified /cgi-bin/koha/help.pl?url=koha/../catalogue/advsearch.pl does not
show the template file (did work on master, not after applying patch)
- verified cgi-bin/koha/help.pl?url=koha/../../../../../../etc/passwd%00.pl does not work (didn't work on master or after applying patch)

Signed-off-by: Paul Poulain <paul.poulain@biblibre.com>
The potential vulnerability would allow anyone to see the content of any .tt file, and .tt only. Was much less critical than the vulnerability for 6629, but it's worth fixing !
help.pl