X-Git-Url: http://git.rot13.org/?a=blobdiff_plain;f=C4%2FTemplates.pm;h=343a3741993f51866d564c1b784ce5eb3d3b9ffd;hb=0aeae50229c6a381fe112644b72eefd6848fb655;hp=94c5bafa5eeb528230680ece1b626576820158c0;hpb=411d0cf8ead451099704237549a899bb216aece3;p=koha.git

diff --git a/C4/Templates.pm b/C4/Templates.pm
index 94c5bafa5e..343a374199 100644
--- a/C4/Templates.pm
+++ b/C4/Templates.pm
@@ -25,7 +25,7 @@ use List::MoreUtils qw/ any uniq /;
 
 =head1 NAME 
 
-    Koha::Templates - Object for manipulating templates for use with Koha
+C4::Templates - Object for manipulating templates for use with Koha
 
 =cut
 
@@ -163,9 +163,11 @@ sub _get_template_file {
     my $htdocs = C4::Context->config($is_intranet ? 'intrahtdocs' : 'opachtdocs');
     my ($theme, $lang, $availablethemes) = themelanguage($htdocs, $tmplbase, $interface, $query);
     $lang //= 'en';
-    my $filename = "$htdocs/$theme/$lang/modules/$tmplbase";
+    $theme //= '';
+    $tmplbase = "$htdocs/$theme/$lang/modules/$tmplbase" if $tmplbase !~ /^\//;
+        # do not prefix an absolute path
 
-    return ($htdocs, $theme, $lang, $filename);
+    return ( $htdocs, $theme, $lang, $tmplbase );
 }
 
 =head2 badtemplatecheck
@@ -181,16 +183,29 @@ sub _get_template_file {
 
 sub badtemplatecheck {
     my ( $template ) = @_;
-    Koha::Exceptions::NoPermission->throw( 'bad template path' )
-        unless $template =~ m/^[a-zA-Z0-9_\-\/]+\.(tt|pref)$/;
+    if( !$template || $template !~ m/^[a-zA-Z0-9_\-\/]+\.(tt|pref)$/ ) {
+        # This also includes two dots
+        Koha::Exceptions::NoPermission->throw( 'bad template path' );
+    } else {
+        # Check allowed dirs
+        my $dirs = C4::Context->config("pluginsdir");
+        $dirs = [ $dirs ] if !ref($dirs);
+        unshift @$dirs, C4::Context->config('opachtdocs'), C4::Context->config('intrahtdocs');
+        my $found = 0;
+        foreach my $dir ( @$dirs ) {
+            $dir .= '/' if $dir !~ m/\/$/;
+            $found++ if $template =~ m/^$dir/;
+            last if $found;
+        }
+        Koha::Exceptions::NoPermission->throw( 'bad template path' ) if !$found;
+    }
 }
 
 sub gettemplate {
-    my ( $tmplbase, $interface, $query, $is_plugin ) = @_;
+    my ( $tmplbase, $interface, $query ) = @_;
     ($query) or warn "no query in gettemplate";
     my ($htdocs, $theme, $lang, $filename)
        =  _get_template_file($tmplbase, $interface, $query);
-    $filename = $tmplbase if ( $is_plugin );
     badtemplatecheck( $filename ); # single trip for bad templates
     my $template = C4::Templates->new($interface, $filename, $tmplbase, $query);