Bug 36794 - Illegitimate modification of biblionumber subfield content (999 $c)
Summary: Illegitimate modification of biblionumber subfield content (999 $c)
Status: Pushed to oldstable
Alias: None
Product: Koha
Classification: Unclassified
Component: Cataloging (show other bugs)
Version: unspecified
Hardware: All All
: P5 - low minor (vote)
Assignee: Janusz Kaczmarek
QA Contact: Testopia
URL:
Keywords:
Depends on:
Blocks:
 
Reported: 2024-05-06 12:47 UTC by Janusz Kaczmarek
Modified: 2024-05-30 19:19 UTC (History)
4 users (show)

See Also:
Change sponsored?: Sponsored
Patch complexity: ---
Documentation contact:
Documentation submission:
Text to go in the release notes:
Version(s) released in:
24.05.00,23.11.06,23.05.12


Attachments
Bug 36794: Bug 36794 - Illegitimate modification of biblionumber subfield content (999 $c) (3.12 KB, patch)
2024-05-06 13:43 UTC, Janusz Kaczmarek
Details | Diff | Splinter Review
Bug 36794: Bug 36794 - Illegitimate modification of biblionumber subfield content (999 $c) (3.17 KB, patch)
2024-05-06 16:04 UTC, Roman Dolny
Details | Diff | Splinter Review
Bug 36794: Illegitimate modification of biblionumber subfield content (999 $c) (3.16 KB, patch)
2024-05-06 17:53 UTC, Janusz Kaczmarek
Details | Diff | Splinter Review
Bug 36794: Illegitimate modification of biblionumber subfield content (999 $c) (3.44 KB, patch)
2024-05-10 16:32 UTC, Nick Clemens (kidclamp)
Details | Diff | Splinter Review
Bug 36794: Illegitimate modification of biblionumber subfield content (999 $c) (3.41 KB, patch)
2024-05-13 07:36 UTC, Janusz Kaczmarek
Details | Diff | Splinter Review

Note You need to log in before you can comment on or make changes to this bug.
Description Janusz Kaczmarek 2024-05-06 12:47:37 UTC
It happens that librarians, by mistake, open a biblio editor putting in the URL, by hand, the biblionumber prefixed with a blank (e.g. .../addbiblio.pl?biblionumber= 123 -- mind the space before 123). In such a case the editor opens with the right biblio record (i.e. 123) but, after saving the record, the content of the biblionumber MARC field (999 $c for a standard MARC 21 installation) results modified and contains additional initial blanks.

Moreover, while using ES and making a search for the record (with title, author etc.) we get two records on the result list (instead of one). 

This is because in the addbiblio.pl script $biblionumber is taken (and continuously used) directly from CGI parameter, without any validation and/or correction.
Comment 1 Janusz Kaczmarek 2024-05-06 13:43:32 UTC
Created attachment 166224 [details] [review]
Bug 36794:  Bug 36794 - Illegitimate modification of biblionumber subfield content (999 $c)

It happens that librarians, by mistake, open a biblio editor putting in the
URL, by hand, the biblionumber prefixed with a blank (e.g.
.../addbiblio.pl?biblionumber= 123 -- mind the space before 123).
In such a case the editor opens with the right biblio record (i.e. 123)
but, after saving the record, the content of the biblionumber MARC
field (999 $c for a standard MARC 21 installation) results modified and
contains additional initial blanks.

Moreover, while using ES and making a search for the record (with title,
author etc.) we get two records on the result list (instead of one).

This is because in the addbiblio.pl script $biblionumber is taken (and
continuously used) directly from CGI parameter, without any
validation and/or correction.

Test plan:
==========
0. Have a test installation with ES.
1. Open a biblio record in the editor with an added space before
   biblionumber value, e.g.:
   http://ktd:8081/cgi-bin/koha/cataloguing/addbiblio.pl?biblionumber= 123
   Save the record.
2. From the Normal view choose Save -> MARCXML.  Open the saved file in
   your favourite editor.  You should see, at the end, something like:
   <datafield tag="999" ind1=" " ind2=" ">
     <subfield code="c"> 123</subfield>
   (mind the space before 123).
   This is not right.
3. Make a search with the title or author's name from the record (e.g.
   Henning Mankell for the record 123 from the default ktd data set).
   You should get two records instead of one (while using ES).
4. Apply the patch, restart_all.  Repeat p. 1 and 2 with a different
   biblionumber.  Notice the unchanged (i.e. without spaces) value
   of 999 $c subfield in the exported record and only one record
   as a result of a search.

Sponsored-by: Ignatianum University in Cracow
Comment 2 Roman Dolny 2024-05-06 16:04:36 UTC
Created attachment 166235 [details] [review]
Bug 36794: Bug 36794 - Illegitimate modification of biblionumber subfield content (999 $c)

It happens that librarians, by mistake, open a biblio editor putting in the
URL, by hand, the biblionumber prefixed with a blank (e.g.
.../addbiblio.pl?biblionumber= 123 -- mind the space before 123).
In such a case the editor opens with the right biblio record (i.e. 123)
but, after saving the record, the content of the biblionumber MARC
field (999 $c for a standard MARC 21 installation) results modified and
contains additional initial blanks.

Moreover, while using ES and making a search for the record (with title,
author etc.) we get two records on the result list (instead of one).

This is because in the addbiblio.pl script $biblionumber is taken (and
continuously used) directly from CGI parameter, without any
validation and/or correction.

Test plan:
==========
0. Have a test installation with ES.
1. Open a biblio record in the editor with an added space before
   biblionumber value, e.g.:
   http://ktd:8081/cgi-bin/koha/cataloguing/addbiblio.pl?biblionumber= 123
   Save the record.
2. From the Normal view choose Save -> MARCXML.  Open the saved file in
   your favourite editor.  You should see, at the end, something like:
   <datafield tag="999" ind1=" " ind2=" ">
     <subfield code="c"> 123</subfield>
   (mind the space before 123).
   This is not right.
3. Make a search with the title or author's name from the record (e.g.
   Henning Mankell for the record 123 from the default ktd data set).
   You should get two records instead of one (while using ES).
4. Apply the patch, restart_all.  Repeat p. 1 and 2 with a different
   biblionumber.  Notice the unchanged (i.e. without spaces) value
   of 999 $c subfield in the exported record and only one record
   as a result of a search.

Sponsored-by: Ignatianum University in Cracow
Signed-off-by: Roman Dolny <roman.dolny@jezuici.pl>
Comment 3 Janusz Kaczmarek 2024-05-06 17:53:51 UTC
Created attachment 166236 [details] [review]
Bug 36794: Illegitimate modification of biblionumber subfield content (999 $c)

It happens that librarians, by mistake, open a biblio editor putting in the
URL, by hand, the biblionumber prefixed with a blank (e.g.
.../addbiblio.pl?biblionumber= 123 -- mind the space before 123).
In such a case the editor opens with the right biblio record (i.e. 123)
but, after saving the record, the content of the biblionumber MARC
field (999 $c for a standard MARC 21 installation) results modified and
contains additional initial blanks.

Moreover, while using ES and making a search for the record (with title,
author etc.) we get two records on the result list (instead of one).

This is because in the addbiblio.pl script $biblionumber is taken (and
continuously used) directly from CGI parameter, without any
validation and/or correction.

Test plan:
==========
0. Have a test installation with ES.
1. Open a biblio record in the editor with an added space before
   biblionumber value, e.g.:
   http://ktd:8081/cgi-bin/koha/cataloguing/addbiblio.pl?biblionumber= 123
   Save the record.
2. From the Normal view choose Save -> MARCXML.  Open the saved file in
   your favourite editor.  You should see, at the end, something like:
   <datafield tag="999" ind1=" " ind2=" ">
     <subfield code="c"> 123</subfield>
   (mind the space before 123).
   This is not right.
3. Make a search with the title or author's name from the record (e.g.
   Henning Mankell for the record 123 from the default ktd data set).
   You should get two records instead of one (while using ES).
4. Apply the patch, restart_all.  Repeat p. 1 and 2 with a different
   biblionumber.  Notice the unchanged (i.e. without spaces) value
   of 999 $c subfield in the exported record and only one record
   as a result of a search.

Sponsored-by: Ignatianum University in Cracow
Signed-off-by: Roman Dolny <roman.dolny@jezuici.pl>
Comment 4 Nick Clemens (kidclamp) 2024-05-10 16:32:48 UTC
Created attachment 166587 [details] [review]
Bug 36794: Illegitimate modification of biblionumber subfield content (999 $c)

It happens that librarians, by mistake, open a biblio editor putting in the
URL, by hand, the biblionumber prefixed with a blank (e.g.
.../addbiblio.pl?biblionumber= 123 -- mind the space before 123).
In such a case the editor opens with the right biblio record (i.e. 123)
but, after saving the record, the content of the biblionumber MARC
field (999 $c for a standard MARC 21 installation) results modified and
contains additional initial blanks.

Moreover, while using ES and making a search for the record (with title,
author etc.) we get two records on the result list (instead of one).

This is because in the addbiblio.pl script $biblionumber is taken (and
continuously used) directly from CGI parameter, without any
validation and/or correction.

Test plan:
==========
0. Have a test installation with ES.
1. Open a biblio record in the editor with an added space before
   biblionumber value, e.g.:
   http://ktd:8081/cgi-bin/koha/cataloguing/addbiblio.pl?biblionumber= 123
   Save the record.
2. From the Normal view choose Save -> MARCXML.  Open the saved file in
   your favourite editor.  You should see, at the end, something like:
   <datafield tag="999" ind1=" " ind2=" ">
     <subfield code="c"> 123</subfield>
   (mind the space before 123).
   This is not right.
3. Make a search with the title or author's name from the record (e.g.
   Henning Mankell for the record 123 from the default ktd data set).
   You should get two records instead of one (while using ES).
4. Apply the patch, restart_all.  Repeat p. 1 and 2 with a different
   biblionumber.  Notice the unchanged (i.e. without spaces) value
   of 999 $c subfield in the exported record and only one record
   as a result of a search.

WNC amended patch - rebased, added conditional in case no bib, moved comments to their own lines

Sponsored-by: Ignatianum University in Cracow
Signed-off-by: Roman Dolny <roman.dolny@jezuici.pl>
Signed-off-by: Nick Clemens <nick@bywatersolutions.com>
Comment 5 Nick Clemens (kidclamp) 2024-05-10 16:34:01 UTC
This a bug 36799 are a little odd, but biblionumber and authid should always be numeric, it fixes issues if a library does a bad copy and paste, passing QA
Comment 6 Katrin Fischer 2024-05-13 07:19:52 UTC
Please rebase - I didn't want to mess it up :)
Comment 7 Janusz Kaczmarek 2024-05-13 07:36:19 UTC
Created attachment 166619 [details] [review]
Bug 36794: Illegitimate modification of biblionumber subfield content (999 $c)

It happens that librarians, by mistake, open a biblio editor putting in the
URL, by hand, the biblionumber prefixed with a blank (e.g.
.../addbiblio.pl?biblionumber= 123 -- mind the space before 123).
In such a case the editor opens with the right biblio record (i.e. 123)
but, after saving the record, the content of the biblionumber MARC
field (999 $c for a standard MARC 21 installation) results modified and
contains additional initial blanks.

Moreover, while using ES and making a search for the record (with title,
author etc.) we get two records on the result list (instead of one).

This is because in the addbiblio.pl script $biblionumber is taken (and
continuously used) directly from CGI parameter, without any
validation and/or correction.

Test plan:
==========
0. Have a test installation with ES.
1. Open a biblio record in the editor with an added space before
   biblionumber value, e.g.:
   http://ktd:8081/cgi-bin/koha/cataloguing/addbiblio.pl?biblionumber= 123
   Save the record.
2. From the Normal view choose Save -> MARCXML.  Open the saved file in
   your favourite editor.  You should see, at the end, something like:
   <datafield tag="999" ind1=" " ind2=" ">
     <subfield code="c"> 123</subfield>
   (mind the space before 123).
   This is not right.
3. Make a search with the title or author's name from the record (e.g.
   Henning Mankell for the record 123 from the default ktd data set).
   You should get two records instead of one (while using ES).
4. Apply the patch, restart_all.  Repeat p. 1 and 2 with a different
   biblionumber.  Notice the unchanged (i.e. without spaces) value
   of 999 $c subfield in the exported record and only one record
   as a result of a search.

WNC amended patch - rebased, added conditional in case no bib, moved comments to their own lines

Sponsored-by: Ignatianum University in Cracow
Signed-off-by: Roman Dolny <roman.dolny@jezuici.pl>
Signed-off-by: Nick Clemens <nick@bywatersolutions.com>
Comment 8 Janusz Kaczmarek 2024-05-13 07:37:37 UTC
(In reply to Katrin Fischer from comment #6)
> Please rebase - I didn't want to mess it up :)

Done--should apply smoothly now.  Thank you!
Comment 9 Katrin Fischer 2024-05-13 08:42:25 UTC
Pushed for 24.05!

Well done everyone, thank you!
Comment 10 Fridolin Somers 2024-05-29 12:09:36 UTC
Pushed to 23.11.x for 23.11.06
Comment 11 Lucas Gass 2024-05-30 19:19:30 UTC
Backported to 23.05.x for upcoming 23.05.12