Attachment 10547 Details for Bug 3280 – Bug 3280 Restrict Send basket feature

[patch] Bug 3280 Restrict Send basket feature

0001-Bug-3280-Restrict-Send-basket-feature.patch (text/plain), 3.05 KB, created by Sébastien Marie on 2012-06-28 09:29:37 UTC

(hide)

Description:

Filename:

MIME Type:

Creator: Sébastien Marie

Created: 2012-06-28 09:29:37 UTC

Size: 3.05 KB

patch

obsolete

>From 8128a453cbe145225442fad2269b32e8673a69e1 Mon Sep 17 00:00:00 2001
>From: =?UTF-8?q?Fr=C3=A8re=20S=C3=A9bastien=20Marie?=
> <semarie-koha@latrappe.fr>
>Date: Mon, 5 Dec 2011 10:11:46 +0100
>Subject: [PATCH] Bug 3280 Restrict Send basket feature
>
>In order to prevent spamming using sendbasket.pl, some counter-measure are done:
> - permit send basket only for authenticated user
> - permit send basket only if basket contains items
> - use username & email for 'Reply-To' field (with fallback to KohaAdminEmailAddress)
> - add field X-Orig-IP with IP of sender
> - add field X-Abuse-Report with KohaAdminEmailAddress
>
>Note: with don't use forged 'To' address with patron email in order to
>prevent be marked as spam (by SPF for example).
>---
> opac/opac-sendbasket.pl |   23 +++++++++++++++--------
> 1 files changed, 15 insertions(+), 8 deletions(-)
>
>diff --git a/opac/opac-sendbasket.pl b/opac/opac-sendbasket.pl
>index 7787217..f431f4d 100755
>--- a/opac/opac-sendbasket.pl
>+++ b/opac/opac-sendbasket.pl
>@@ -54,11 +54,19 @@ my $email_sender = $query->param('email_sender');
> my $dbh          = C4::Context->dbh;
> 
> if ( $email_add ) {
>+    my $user = GetMember(borrowernumber => $borrowernumber);
>+    my $user_email = GetFirstValidEmailAddress($borrowernumber)
>+	|| C4::Context->preference('KohaAdminEmailAddress');
>+    
>     my $email_from = C4::Context->preference('KohaAdminEmailAddress');
>+    my $email_replyto = "$user->{firstname} $user->{surname} <$user_email>";
>     my $comment    = $query->param('comment');
>     my %mail = (
>         To   => $email_add,
>-        From => $email_from
>+        From => $email_from,
>+	'Reply-To' => $email_replyto,
>+	'X-Orig-IP' => $ENV{'REMOTE_ADDR'},
>+	'X-Abuse-Report' => C4::Context->preference('KohaAdminEmailAddress'),
>     );
> 
>     my ( $template2, $borrowernumber, $cookie ) = get_template_and_user(
>@@ -66,7 +74,7 @@ if ( $email_add ) {
>             template_name   => "opac-sendbasket.tmpl",
>             query           => $query,
>             type            => "opac",
>-            authnotrequired => 1,
>+            authnotrequired => 0,
>             flagsrequired   => { borrow => 1 },
>         }
>     );
>@@ -106,8 +114,6 @@ if ( $email_add ) {
> 
>     my $resultsarray = \@results;
>     
>-    my $user = GetMember(borrowernumber => $borrowernumber); 
>-    
>     $template2->param(
>         BIBLIO_RESULTS => $resultsarray,
>         email_sender   => $email_sender,
>@@ -162,14 +168,15 @@ $isofile
> $boundary--
> END_OF_BODY
> 
>-    # Sending mail
>-    if ( sendmail %mail ) {
>-        # do something if it works....
>+    # Sending mail (if not empty basket)
>+    if ( defined($iso2709) && sendmail %mail ) {
>+	# do something if it works....
>         $template->param( SENT      => "1" );
>     }
>     else {
>         # do something if it doesnt work....
>-        carp "Error sending mail: $Mail::Sendmail::error \n";
>+	carp "Error sending mail: empty basket" if !defined($iso2709);
>+        carp "Error sending mail: $Mail::Sendmail::error" if $Mail::Sendmail::error;
>         $template->param( error => 1 );
>     }
>     $template->param( email_add => $email_add );
>-- 
>1.7.6
>

Actions: View | Diff | Splinter Review

Attachments on bug 3280: 6576 | 10027 | 10547 | 10548 | 10595