Bugzilla – Attachment 62215 Details for
Bug 14994
Add RSS/Atom feed proxy
Home
|
New
|
Browse
|
Search
|
[?]
|
Reports
|
Help
|
New Account
|
Log In
[x]
|
Forgot Password
Login:
[x]
[patch]
[SIGNED-OFF] Bug 14994 - Request proxy (added opac-proxy.pl)
SIGNED-OFF-Bug-14994---Request-proxy-added-opac-pr.patch (text/plain), 3.94 KB, created by
Owen Leonard
on 2017-04-17 13:34:41 UTC
(
hide
)
Description:
[SIGNED-OFF] Bug 14994 - Request proxy (added opac-proxy.pl)
Filename:
MIME Type:
Creator:
Owen Leonard
Created:
2017-04-17 13:34:41 UTC
Size:
3.94 KB
patch
obsolete
>From 3b51a38ee9738e812af2f9ce2d435f9a59044695 Mon Sep 17 00:00:00 2001 >From: Martin Persson <xarragon@gmail.com> >Date: Wed, 21 Oct 2015 14:14:52 +0200 >Subject: [PATCH] [SIGNED-OFF] Bug 14994 - Request proxy (added opac-proxy.pl) > >This patch adds a new opac page that is used as an endpoint >for external web requests such as RSS feeds. This allows user >scripts to pull data via XHR requests from external resources >without violating the 'same-origin' restriction. > >I would appreciate some feedback on security implications of >doing this. Might need to add some DoS protection etc. > >The script takes a single parameter; 'id', the number of the >feed to retrieve. This is an offset into an array of URLs >stored in the system preference named 'RequestProxyURL'. >The offset i based on 1 to make it easier for non-technical >people. The first feed is '1', '0' is invalid. > >Test plan: > >1) Apply the syspref patch first. >2) Apply this patch. >3) Enable the request proxy by going into System Preferences, > Web Services, set RequestProxyEnabled to 'yes' and > enter a test URL such as: > http://hyltebiblioteken.blogspot.se/feeds/posts/default > and: > http://bokbastisarna.blogspot.com/feeds/posts/default > into RequestProxyURL. >4) Save and go to the new url: > http://127.0.1.1/cgi-bin/koha/opac-proxy.pl?id=1 > You should get the content of the first URL with 'id' = 1. > With 'id' = 2 you should get the second URL. > With 'id' = 3 you should get a 503 error. >5) Disable the service again, 'RequestProxyEnabled' = no. >6) Go back to the proxy url, you should now receive a 503 error > even for valid feed id's AND for invalid ones. > >Sponsored-By: Halland County Library > >Signed-off-by: Owen Leonard <oleonard@myacpl.org> >--- > opac/opac-proxy.pl | 70 ++++++++++++++++++++++++++++++++++++++++++++++++++++++ > 1 file changed, 70 insertions(+) > create mode 100755 opac/opac-proxy.pl > >diff --git a/opac/opac-proxy.pl b/opac/opac-proxy.pl >new file mode 100755 >index 0000000..a8502c6 >--- /dev/null >+++ b/opac/opac-proxy.pl >@@ -0,0 +1,70 @@ >+#!/usr/bin/perl >+ >+# Copyright 2015 Halland County Library >+# >+# This file is part of Koha. >+# >+# Koha is free software; you can redistribute it and/or modify it >+# under the terms of the GNU General Public License as published by >+# the Free Software Foundation; either version 3 of the License, or >+# (at your option) any later version. >+# >+# Koha is distributed in the hope that it will be useful, but >+# WITHOUT ANY WARRANTY; without even the implied warranty of >+# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the >+# GNU General Public License for more details. >+# >+# You should have received a copy of the GNU General Public License >+# along with Koha; if not, see <http://www.gnu.org/licenses>. >+ >+use Modern::Perl; >+use Koha; >+use C4::Context; >+use LWP::UserAgent; >+use CGI qw( -utf8 ); >+ >+# Basic DoS protection (see perldoc CGI) >+$CGI::POST_MAX = 1024; >+$CGI::DISABLE_UPLOADS = 1; >+ >+# These should be moved to configuration >+my $status_text = '503 Service Unavailable'; >+my $src_valid = '127.0.0.1'; >+ >+my $cgi = CGI->new; >+my $id = $cgi->param('id') || 0; >+ >+my @urls = split("\n", C4::Context->preference('RequestProxyURL')); >+ >+if ( C4::Context->preference('RequestProxyEnabled') && >+ $cgi->request_method eq 'GET' && >+ ($id > 0 && $id <= scalar @urls)) { >+ >+ my $url = $urls[$id - 1]; >+ >+ my $agent = new LWP::UserAgent; >+ my $req = HTTP::Request->new('GET'); >+ $req->url($url); >+ my $resp = $agent->request($req); >+ >+ my $cgi = CGI->new; >+ >+ my $headers = $resp->headers; >+ >+ my @fields = $headers->header_field_names; >+ my %newheaders; >+ foreach my $field (@fields) { >+ $newheaders{ $field } = $headers->header($field); >+ } >+ >+ print $cgi->header(\%newheaders); >+ print $resp->content; >+ >+} else { >+ print $cgi->header( >+ -type => 'text/html', >+ -status => $status_text), >+ $cgi->start_html, >+ $cgi->h1($status_text), >+ $cgi->end_html; >+} >-- >2.1.4
You cannot view the attachment while viewing its details because your browser does not support IFRAMEs.
View the attachment on a separate page
.
View Attachment As Diff
View Attachment As Raw
Actions:
View
|
Diff
|
Splinter Review
Attachments on
bug 14994
:
43690
|
43691
|
49439
|
62214
| 62215