tracklinks.pl will accept any url from a parameter, even ones not in Koha. In the wild I have spotted bots doing nasty things with this, such as proxying porn links through a Koha server, I suppose for generating fake hits to game ad services. We should only track links that come from within Koha records, and 404 anything else, unless someone has a use case for allowing other links (such as those from the home page/nav blocks maybe?) from Koha to do this. I could see people trying it, but I highly doubt anybody actually would because they've got google etc. analytics for that kind of thing.
I think limiting to the links within records makes sense. How would you check that?
Created attachment 69949 [details] [review] Bug 19847: Track links within the records and 404 for others Test plan: Behave like a robot, you will get 404 Be a human, you will be tracked
Something like that?
Created attachment 69975 [details] [review] Bug 19847 - tracklinks.pl accepts any url from a CGI parameter for proxying To replicate: Disable tracklinks in your system preferences go to, for example: http://<your name here>/cgi-bin/koha/tracklinks.pl?uri=http://google.com This will be passed through. This is the case we want to avoid. So will this: http://<your name here>/cgi-bin/koha/tracklinks.pl?uri=http://www.google.com&biblionumber=24 assuming you've got a biblionumber 24. This case is OK. Test with tracklinks set to track, and anonymous. Click both again. Both should still work. Apply this patch, and test: http://<your name here>/cgi-bin/koha/tracklinks.pl?uri=http://google.com This should not work with tracklinks on any setting - should 404. http://<your name here>/cgi-bin/koha/tracklinks.pl?uri=http://www.google.com&biblionumber=24 This should still work with tracklinks set to track or anonymous. Test also that from the OPAC detail and results pages that the links from those pages still work in all settings of tracklinks.
oh drat you just beat me, took a little different approach, I only check we have a record and a biblionumber and don't bother with checking the urls come from the record. Your way is probably better.
Created attachment 70167 [details] [review] Bug 19847: Track links within the records and 404 for others Test plan: Behave like a robot, you will get 404 Be a human, you will be tracked Signed-off-by: Katrin Fischer <katrin.fischer.83@web.de>
Created attachment 70283 [details] [review] Bug 19847: Track links within the records and 404 for others Test plan: Behave like a robot, you will get 404 Be a human, you will be tracked Signed-off-by: Katrin Fischer <katrin.fischer.83@web.de> Signed-off-by: Nick Clemens <nick@bywatersolutions.com>
Patch pushed to * master for 18.05 * 17.11.x for v17.11.02 * 17.05.x for v17.05.08
*** Bug 22703 has been marked as a duplicate of this bug. ***