From 3b51a38ee9738e812af2f9ce2d435f9a59044695 Mon Sep 17 00:00:00 2001 From: Martin Persson Date: Wed, 21 Oct 2015 14:14:52 +0200 Subject: [PATCH] [SIGNED-OFF] Bug 14994 - Request proxy (added opac-proxy.pl) This patch adds a new opac page that is used as an endpoint for external web requests such as RSS feeds. This allows user scripts to pull data via XHR requests from external resources without violating the 'same-origin' restriction. I would appreciate some feedback on security implications of doing this. Might need to add some DoS protection etc. The script takes a single parameter; 'id', the number of the feed to retrieve. This is an offset into an array of URLs stored in the system preference named 'RequestProxyURL'. The offset i based on 1 to make it easier for non-technical people. The first feed is '1', '0' is invalid. Test plan: 1) Apply the syspref patch first. 2) Apply this patch. 3) Enable the request proxy by going into System Preferences, Web Services, set RequestProxyEnabled to 'yes' and enter a test URL such as: http://hyltebiblioteken.blogspot.se/feeds/posts/default and: http://bokbastisarna.blogspot.com/feeds/posts/default into RequestProxyURL. 4) Save and go to the new url: http://127.0.1.1/cgi-bin/koha/opac-proxy.pl?id=1 You should get the content of the first URL with 'id' = 1. With 'id' = 2 you should get the second URL. With 'id' = 3 you should get a 503 error. 5) Disable the service again, 'RequestProxyEnabled' = no. 6) Go back to the proxy url, you should now receive a 503 error even for valid feed id's AND for invalid ones. Sponsored-By: Halland County Library Signed-off-by: Owen Leonard --- opac/opac-proxy.pl | 70 ++++++++++++++++++++++++++++++++++++++++++++++++++++++ 1 file changed, 70 insertions(+) create mode 100755 opac/opac-proxy.pl diff --git a/opac/opac-proxy.pl b/opac/opac-proxy.pl new file mode 100755 index 0000000..a8502c6 --- /dev/null +++ b/opac/opac-proxy.pl @@ -0,0 +1,70 @@ +#!/usr/bin/perl + +# Copyright 2015 Halland County Library +# +# This file is part of Koha. +# +# Koha is free software; you can redistribute it and/or modify it +# under the terms of the GNU General Public License as published by +# the Free Software Foundation; either version 3 of the License, or +# (at your option) any later version. +# +# Koha is distributed in the hope that it will be useful, but +# WITHOUT ANY WARRANTY; without even the implied warranty of +# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the +# GNU General Public License for more details. +# +# You should have received a copy of the GNU General Public License +# along with Koha; if not, see . + +use Modern::Perl; +use Koha; +use C4::Context; +use LWP::UserAgent; +use CGI qw( -utf8 ); + +# Basic DoS protection (see perldoc CGI) +$CGI::POST_MAX = 1024; +$CGI::DISABLE_UPLOADS = 1; + +# These should be moved to configuration +my $status_text = '503 Service Unavailable'; +my $src_valid = '127.0.0.1'; + +my $cgi = CGI->new; +my $id = $cgi->param('id') || 0; + +my @urls = split("\n", C4::Context->preference('RequestProxyURL')); + +if ( C4::Context->preference('RequestProxyEnabled') && + $cgi->request_method eq 'GET' && + ($id > 0 && $id <= scalar @urls)) { + + my $url = $urls[$id - 1]; + + my $agent = new LWP::UserAgent; + my $req = HTTP::Request->new('GET'); + $req->url($url); + my $resp = $agent->request($req); + + my $cgi = CGI->new; + + my $headers = $resp->headers; + + my @fields = $headers->header_field_names; + my %newheaders; + foreach my $field (@fields) { + $newheaders{ $field } = $headers->header($field); + } + + print $cgi->header(\%newheaders); + print $resp->content; + +} else { + print $cgi->header( + -type => 'text/html', + -status => $status_text), + $cgi->start_html, + $cgi->h1($status_text), + $cgi->end_html; +} -- 2.1.4