Attachment 107224 Details for Bug 5087 – Bug 5087: Add server-side check

[patch] Bug 5087: Add server-side check

Bug-5087-Add-server-side-check.patch (text/plain), 1.87 KB, created by Jonathan Druart on 2020-07-23 09:17:13 UTC

(hide)

Description:

Filename:

MIME Type:

Creator: Jonathan Druart

Created: 2020-07-23 09:17:13 UTC

Size: 1.87 KB

patch

obsolete

>From 97cb389e3a72b1b75fddda7c42f545ffe4356394 Mon Sep 17 00:00:00 2001
>From: Jonathan Druart <jonathan.druart@bugs.koha-community.org>
>Date: Thu, 23 Jul 2020 11:15:24 +0200
>Subject: [PATCH] Bug 5087: Add server-side check
>
>If a user to access a CSV profile that is not available at the OPAC we
>should redirect to 404.
>
>It will also handle undefined csv_profiles
>
>For instance:
>kohadev.mydnsname.org:8080/cgi-bin/koha/opac-downloadshelf.pl?shelfnumber=1&format=3
>kohadev.mydnsname.org:8080/cgi-bin/koha/opac-downloadcart.pl?bib_list=1/2/&format=3
>---
> opac/opac-downloadcart.pl  | 6 ++++++
> opac/opac-downloadshelf.pl | 7 +++++++
> 2 files changed, 13 insertions(+)
>
>diff --git a/opac/opac-downloadcart.pl b/opac/opac-downloadcart.pl
>index 7720cd461e..0fb7a02f3c 100755
>--- a/opac/opac-downloadcart.pl
>+++ b/opac/opac-downloadcart.pl
>@@ -66,6 +66,12 @@ if ($bib_list && $format) {
>     # CSV   
>     if ($format =~ /^\d+$/) {
> 
>+        my $csv_profile = Koha::CsvProfiles->find($format);
>+        if ( not $csv_profile or $csv_profile->staff_only ) {
>+            print $query->redirect('/cgi-bin/koha/errors/404.pl');
>+            exit;
>+        }
>+
>         $output = marc2csv(\@bibs, $format);
> 
>         # Other formats
>diff --git a/opac/opac-downloadshelf.pl b/opac/opac-downloadshelf.pl
>index f317f3ca3d..011fd0c5c5 100755
>--- a/opac/opac-downloadshelf.pl
>+++ b/opac/opac-downloadshelf.pl
>@@ -75,6 +75,13 @@ if ( $shelf and $shelf->can_be_viewed( $borrowernumber ) ) {
> 
>        # CSV
>         if ($format =~ /^\d+$/) {
>+
>+            my $csv_profile = Koha::CsvProfiles->find($format);
>+            if ( not $csv_profile or $csv_profile->staff_only ) {
>+                print $query->redirect('/cgi-bin/koha/errors/404.pl');
>+                exit;
>+            }
>+
>             my @biblios;
>             while ( my $content = $contents->next ) {
>                 push @biblios, $content->biblionumber;
>-- 
>2.20.1

Actions: View | Diff | Splinter Review

Attachments on bug 5087: 2450 | 83438 | 83664 | 98779 | 103437 | 103506 | 103955 | 107111 | 107112 | 107113 | 107114 | 107166 | 107167 | 107168 | 107169 | 107224