From 709ee75ede5e4264acf46d08d7d31e179db3fa63 Mon Sep 17 00:00:00 2001 From: Aleisha Amohia Date: Tue, 4 May 2021 16:12:35 +1200 Subject: [PATCH] Bug 27961: [20.05.x] Ensure external URLs are filtered TT variables are used to build the link in items.uri . This is a problem particularly when TrackClicks is enabled because the items.uri value doesn't get escaped, resulting in a 404. To test: 1) Enable the TrackClicks system preference (set to Track or Track anonymously) 2) Find a record with an item 3) Edit the item and put an external URL under the Uniform Resource Identifier field 4) Go to that record in the OPAC 5) Click on Link to resource 6) Confirm you are not redirected to the URL and instead see a 404 7) Apply the patch and refresh the page 8) Click on Link to resource 9) Confirm you are redirected as expected 10) Go back to the staff client to edit your item. This time put two URLs in the Uniform Resource Identifier field, separated by ' | '. (Don't forget the spaces around the pipe, and don't forget to add a trailing slash to the URL). 11) Go back to the OPAC and refresh the page. 12) Confirm both URLs redirect as expected. Sponsored-by: Parliamentary Library New Zealand --- .../opac-tmpl/bootstrap/en/modules/opac-detail.tt | 20 ++++++++++++++------ 1 file changed, 14 insertions(+), 6 deletions(-) diff --git a/koha-tmpl/opac-tmpl/bootstrap/en/modules/opac-detail.tt b/koha-tmpl/opac-tmpl/bootstrap/en/modules/opac-detail.tt index 418baf2fc7..4c7a137bea 100644 --- a/koha-tmpl/opac-tmpl/bootstrap/en/modules/opac-detail.tt +++ b/koha-tmpl/opac-tmpl/bootstrap/en/modules/opac-detail.tt @@ -1276,19 +1276,27 @@ [% IF ( itemdata_uri ) %] [% IF ITEM_RESULT.uri %] - [%# Initialize three helper vars %] - [% SET target_attr = ''; SET rel_attr = ''; SET href_attr = '' %] + [%# Initialize two helper vars %] + [% SET target_attr = ''; SET rel_attr = '' %] [% IF Koha.Preference('OPACURLOpenInNewWindow') %][% SET target_attr = '_blank'; SET rel_attr = 'noreferrer' %][% END %] [%# Check if there are multiple URIs; in the single case we only use pref URLLinkText or Link to resource %] [% IF ITEM_RESULT.uri.split(' \| ').size > 1 %] [% FOREACH uri IN ITEM_RESULT.uri.split(' \| ') %] - [% IF trackclicks == 'track' || trackclicks == 'anonymous' %][% SET href_attr = "/cgi-bin/koha/tracklinks.pl?uri=" _ uri _ "&biblionumber=" _ biblio.biblionumber _ "&itemnumber=" _ ITEM_RESULT.itemnumber %] [% ELSE %][% SET href_attr = uri %][% END %] - [% uri | html %]
+ [% IF trackclicks == 'track' || trackclicks == 'anonymous' %] + [% uri | html %] + [% ELSE %] + [% uri | html %] + [% END %] [% END %] [% ELSE %] - [% IF trackclicks == 'track' || trackclicks == 'anonymous' %][% SET href_attr = "/cgi-bin/koha/tracklinks.pl?uri=" _ ITEM_RESULT.uri _ "&biblionumber=" _ biblio.biblionumber _ "&itemnumber=" _ ITEM_RESULT.itemnumber %] [% ELSE %][% SET href_attr = ITEM_RESULT.uri %][% END %] - [% IF Koha.Preference('URLLinkText') %][% Koha.Preference('URLLinkText') | html %][% ELSE %]Link to resource[% END %] + [% IF trackclicks == 'track' || trackclicks == 'anonymous' %] + + [% ELSE %] + + [% END %] + [% IF Koha.Preference('URLLinkText') %][% Koha.Preference('URLLinkText') | html %][% ELSE %]Link to resource[% END %] + [% END %] [% END %] -- 2.11.0