Lines 35-40
my $input = CGI->new;
Link Here
|
35 |
my $query = $input->param('term'); |
35 |
my $query = $input->param('term'); |
36 |
my $table = $input->param('table'); |
36 |
my $table = $input->param('table'); |
37 |
my $field = $input->param('field'); |
37 |
my $field = $input->param('field'); |
|
|
38 |
my $session_cookie = $input->cookie('CGISESSID'); |
38 |
|
39 |
|
39 |
# Prevent from disclosing data |
40 |
# Prevent from disclosing data |
40 |
die() unless ( $table eq "biblioitems" ); |
41 |
die() unless ( $table eq "biblioitems" ); |
Lines 43-49
die() unless ( $field eq 'publishercode' || $field eq 'collectiontitle' );
Link Here
|
43 |
binmode STDOUT, ":encoding(UTF-8)"; |
44 |
binmode STDOUT, ":encoding(UTF-8)"; |
44 |
print $input->header( -type => 'text/plain', -charset => 'UTF-8' ); |
45 |
print $input->header( -type => 'text/plain', -charset => 'UTF-8' ); |
45 |
|
46 |
|
46 |
my ( $auth_status ) = check_cookie_auth( $input->cookie('CGISESSID'), { editcatalogue => '*' } ); |
47 |
my ( $auth_status ) = check_cookie_auth( $session_cookie, { editcatalogue => '*' } ); |
47 |
if ( $auth_status ne "ok" ) { |
48 |
if ( $auth_status ne "ok" ) { |
48 |
exit 0; |
49 |
exit 0; |
49 |
} |
50 |
} |