Bugzilla – Attachment 102020 Details for
Bug 25009
opac-showmarc.pl allows fetching data directly from import batches
Home
|
New
|
Browse
|
Search
|
[?]
|
Reports
|
Help
|
New Account
|
Log In
[x]
|
Forgot Password
Login:
[x]
[patch]
Bug 25009: Avoid leakages in opac-showmarc.pl
Bug-25009-Avoid-leakages-in-opac-showmarcpl.patch (text/plain), 3.29 KB, created by
Tomás Cohen Arazi (tcohen)
on 2020-03-27 21:32:18 UTC
(
hide
)
Description:
Bug 25009: Avoid leakages in opac-showmarc.pl
Filename:
MIME Type:
Creator:
Tomás Cohen Arazi (tcohen)
Created:
2020-03-27 21:32:18 UTC
Size:
3.29 KB
patch
obsolete
>From d62b0684aecc6d0a866caf6db030d6daa2216f3e Mon Sep 17 00:00:00 2001 >From: Tomas Cohen Arazi <tomascohen@theke.io> >Date: Fri, 27 Mar 2020 18:16:58 -0300 >Subject: [PATCH] Bug 25009: Avoid leakages in opac-showmarc.pl > >This patch cleans opac-showmarc.pl so it doesn't allow retrieving >records from import batches without requiring any permissions in the >OPAC. > >it does so by just removing the code portion that does that. > >It also cleans the record fetch operation and how the record processor >is initialized to it actually works :-D > >To test: >1. Perform a successful Z39.50 search in cataloguing (this fetches 20 > records usually) >2. Query your DB for a valid import_record_id: > $ koha-mysql kohadev > > SELECT * FROM import_records LIMIT 1; >3. Notice some of the MARCXML details (title, author, etc), and the > import_record_id >4. Point your browser to the opac-showmarc.pl URL like this: > http://kohadev.mydnsname.org:8080/cgi-bin/koha/opac-showmarc.pl?importid=20 >=> FAIL: You get the record! (Bonus: no field/subfield takes place) >5. Hide some obvious subfield on the framework for a known (to you) > biblionumber >6. Point your browser to: > http://kohadev.mydnsname.org:8080/cgi-bin/koha/opac-showmarc.pl?id=<biblionumber_here> >=> FAIL: No filtering takes place >7. Apply this patch >8. Repeat 4 >=> SUCCESS: You get an error because you did a bad request (no id param) >9. Repeat 6 >=> SUCCESS: Subfield filtering actually works! >10. Sign off :-D > >Signed-off-by: Tomas Cohen Arazi <tomascohen@theke.io> >--- > opac/opac-showmarc.pl | 41 +++++++++++++++++++++++++---------------- > 1 file changed, 25 insertions(+), 16 deletions(-) > >diff --git a/opac/opac-showmarc.pl b/opac/opac-showmarc.pl >index 232eac50a8..a8b5849dd3 100755 >--- a/opac/opac-showmarc.pl >+++ b/opac/opac-showmarc.pl >@@ -41,27 +41,36 @@ my ( $template, $loggedinuser, $cookie ) = get_template_and_user({ > authnotrequired => ( C4::Context->preference("OpacPublic") ? 1 : 0 ), > debug => 1, > }); >-my $biblionumber = $input->param('id'); >-$biblionumber = int($biblionumber); >-my $importid= $input->param('importid'); >-my $view= $input->param('viewas') || 'marc'; > >-my $record_processor = Koha::RecordProcessor->new({ filters => 'ViewPolicy' }); >+my $biblionumber = $input->param('id'); > >-my $record; >-if ($importid) { >- my ($marc) = GetImportRecordMarc($importid); >- $record = MARC::Record->new_from_usmarc($marc); >+unless ( $biblionumber ) { >+ print $input->redirect("/cgi-bin/koha/errors/400.pl"); >+ exit; > } >-else { >- $record = GetMarcBiblio({ biblionumber => $biblionumber }); >- my $framework = GetFrameworkCode($biblionumber); >- $record_processor->options({ >- interface => 'opac', >- frameworkcode => $framework >- }); >+ >+my $biblio; >+$biblio = Koha::Biblios->find( $biblionumber, { prefetch => [ 'metadata' ] } ); >+ >+unless ( $biblio ) { >+ print $input->redirect('/cgi-bin/koha/errors/404.pl'); >+ exit; > } > >+my $view= $input->param('viewas') || 'marc'; >+ >+my $record_processor = Koha::RecordProcessor->new( >+ { >+ filters => 'ViewPolicy', >+ options => { >+ interface => 'opac', >+ frameworkcode => $biblio->frameworkcode >+ } >+ } >+); >+ >+my $record = $biblio->metadata->record; >+ > if(!ref $record) { > print $input->redirect("/cgi-bin/koha/errors/404.pl"); > exit; >-- >2.26.0
You cannot view the attachment while viewing its details because your browser does not support IFRAMEs.
View the attachment on a separate page
.
View Attachment As Diff
View Attachment As Raw
Actions:
View
|
Diff
|
Splinter Review
Attachments on
bug 25009
:
102020
|
102076
|
102832
|
103474