Attachment 10027 Details for Bug 3280 – Bug 3280 Restrict Send basket feature

[patch] Bug 3280 Restrict Send basket feature

Bug-3280-Restrict-Send-basket-feature.patch (text/plain), 2.89 KB, created by Kyle M Hall on 2012-06-09 13:36:25 UTC

(hide)

Description:

Filename:

MIME Type:

Creator: Kyle M Hall

Created: 2012-06-09 13:36:25 UTC

Size: 2.89 KB

patch

obsolete

>From 53712e42670bc4f94130597b27ae56a6d966f21e Mon Sep 17 00:00:00 2001
>From: =?UTF-8?q?Fr=C3=A8re=20S=C3=A9bastien=20Marie?= <semarie-koha@latrappe.fr>
>Date: Mon, 5 Dec 2011 10:11:46 +0100
>Subject: [PATCH] Bug 3280 Restrict Send basket feature
>
>In order to prevent spamming using sendbasket.pl, some counter-measure are done:
> - permit send basket only for authenticated user
> - permit send basket only if basket contains items
> - use username & email for 'To' field (with fallback to KohaAdminEmailAddress)
> - add field X-Orig-IP with IP of sender
> - add field X-Abuse-Report with KohaAdminEmailAddress
>---
> opac/opac-sendbasket.pl |   23 ++++++++++++++---------
> 1 files changed, 14 insertions(+), 9 deletions(-)
>
>diff --git a/opac/opac-sendbasket.pl b/opac/opac-sendbasket.pl
>index 57d2c79..b010245 100755
>--- a/opac/opac-sendbasket.pl
>+++ b/opac/opac-sendbasket.pl
>@@ -53,11 +53,17 @@ my $email_sender = $query->param('email_sender');
> my $dbh          = C4::Context->dbh;
> 
> if ( $email_add ) {
>-    my $email_from = C4::Context->preference('KohaAdminEmailAddress');
>+    my $user = GetMember(borrowernumber => $borrowernumber);
>+    my $user_email = GetFirstValidEmailAddress($borrowernumber)
>+	|| C4::Context->preference('KohaAdminEmailAddress');
>+    
>+    my $email_from = "$user->{firstname} $user->{surname} <$user_email>";
>     my $comment    = $query->param('comment');
>     my %mail = (
>         To   => $email_add,
>-        From => $email_from
>+        From => $email_from,
>+	'X-Orig-IP' => $ENV{'REMOTE_ADDR'},
>+	'X-Abuse-Report' => C4::Context->preference('KohaAdminEmailAddress'),
>     );
> 
>     my ( $template2, $borrowernumber, $cookie ) = get_template_and_user(
>@@ -65,7 +71,7 @@ if ( $email_add ) {
>             template_name   => "opac-sendbasket.tmpl",
>             query           => $query,
>             type            => "opac",
>-            authnotrequired => 1,
>+            authnotrequired => 0,
>             flagsrequired   => { borrow => 1 },
>         }
>     );
>@@ -105,8 +111,6 @@ if ( $email_add ) {
> 
>     my $resultsarray = \@results;
>     
>-    my $user = GetMember(borrowernumber => $borrowernumber); 
>-    
>     $template2->param(
>         BIBLIO_RESULTS => $resultsarray,
>         email_sender   => $email_sender,
>@@ -166,14 +170,15 @@ $isofile
> $boundary--
> END_OF_BODY
> 
>-    # Sending mail
>-    if ( sendmail %mail ) {
>-        # do something if it works....
>+    # Sending mail (if not empty basket)
>+    if ( defined($iso2709) && sendmail %mail ) {
>+	# do something if it works....
>         $template->param( SENT      => "1" );
>     }
>     else {
>         # do something if it doesnt work....
>-        carp "Error sending mail: $Mail::Sendmail::error \n";
>+	carp "Error sending mail: empty basket" if !defined($iso2709);
>+        carp "Error sending mail: $Mail::Sendmail::error" if $Mail::Sendmail::error;
>         $template->param( error => 1 );
>     }
>     $template->param( email_add => $email_add );
>-- 
>1.7.2.5

Actions: View | Diff | Splinter Review

Attachments on bug 3280: 6576 | 10027 | 10547 | 10548 | 10595