[open-ils-commits] r14032 - trunk/Open-ILS/src/perlmods/OpenILS/Application/Trigger (miker)
svn at svn.open-ils.org
svn at svn.open-ils.org
Wed Sep 16 21:54:23 EDT 2009
Author: miker
Date: 2009-09-16 21:54:21 -0400 (Wed, 16 Sep 2009)
New Revision: 14032
Modified:
trunk/Open-ILS/src/perlmods/OpenILS/Application/Trigger/Event.pm
Log:
use Safe to protect against EVIL evals coming in from the outside world -- we share the environment into the Safe compartment using the name $current_environment
Modified: trunk/Open-ILS/src/perlmods/OpenILS/Application/Trigger/Event.pm
===================================================================
--- trunk/Open-ILS/src/perlmods/OpenILS/Application/Trigger/Event.pm 2009-09-16 03:38:25 UTC (rev 14031)
+++ trunk/Open-ILS/src/perlmods/OpenILS/Application/Trigger/Event.pm 2009-09-17 01:54:21 UTC (rev 14032)
@@ -8,6 +8,8 @@
use OpenILS::Utils::CStoreEditor q/:funcs/;
use OpenILS::Application::Trigger::ModRunner;
+use Safe;
+
my $log = 'OpenSRF::Utils::Logger';
sub new {
@@ -348,6 +350,8 @@
return $ok || undef;
}
+my $current_environment;
+
sub build_environment {
my $self = shift;
return $self if ($self->environment->{complete});
@@ -356,12 +360,18 @@
try {
+ my $compartment = new Safe;
+ $compartment->permit(':default',':load');
+ $compartment->share('$current_environment');
+
$self->environment->{EventProcessor} = $self;
$self->environment->{target} = $self->target;
$self->environment->{event} = $self->event;
$self->environment->{template} = $self->event->event_def->template;
- $self->environment->{params}{ $_->param } = eval $_->value for ( @{$self->event->event_def->params} );
+ $current_environment = $self->environment;
+
+ $self->environment->{params}{ $_->param } = $compartment->reval($_->value) for ( @{$self->event->event_def->params} );
for my $e ( @{$self->event->event_def->env} ) {
my (@label, @path);
More information about the open-ils-commits
mailing list