]> git.koha-community.org Git - koha.git/commit
Bug 36818: Escape characters in file names uploaded
authorChris Cormack <chris@bigballofwax.co.nz>
Wed, 8 May 2024 22:41:43 +0000 (22:41 +0000)
committerWainui Witika-Park <wainuiwitikapark@catalyst.net.nz>
Fri, 31 May 2024 03:05:08 +0000 (03:05 +0000)
commit8f74140e3f30fba99c6b4397a0a745bd626eb8dc
tree3020fc1bdd6e2be1b7539e6027bb23f779132d3e
parente67a8dcb1999c638b5721df98e2b8ef6c4c1283c
Bug 36818: Escape characters in file names uploaded

To test:
1/ create a file named something like 'execute`curl blog.bigballofwax.co.nz`.zip'
   Where the domain is one you can watch the logs from
2/ Upload this file as a cover image
3/ Check /var/lib/koha/sitename/tmp/koha_sitename/ and see unescaped filenames
4/ Choose process, check the logs of the webserver see the connection has been made
5/ Apply the patch
5/ Repeat 2 & 3 and see the filename is now escaped
6/ Choose process and check no errors but no no remote execution occurs
7/ Test uploading actual zip file and images still works

Signed-off-by: Amit Gupta <amit.gupta@informaticsglobal.com>
Signed-off-by: Martin Renvoize <martin.renvoize@ptfs-europe.com>
Signed-off-by: Wainui Witika-Park <wainuiwitikapark@catalyst.net.nz>
Koha/Uploader.pm