Attachment 69975 Details for Bug 19847 – Bug 19847 - tracklinks.pl accepts any url from a CGI parameter for proxying

[patch] Bug 19847 - tracklinks.pl accepts any url from a CGI parameter for proxying

Bug-19847---tracklinkspl-accepts-any-url-from-a-CG.patch (text/plain), 2.78 KB, created by Liz Rea on 2017-12-20 21:05:56 UTC

(hide)

Description:

Filename:

MIME Type:

Creator: Liz Rea

Created: 2017-12-20 21:05:56 UTC

Size: 2.78 KB

patch

obsolete

>From 1d58b87d748b30741367bac7a40bc3d731c9ff43 Mon Sep 17 00:00:00 2001
>From: Chris Cormack <chrisc@catalyst.net.nz>
>Date: Tue, 24 Jan 2017 14:42:10 +1300
>Subject: [PATCH] Bug 19847 - tracklinks.pl accepts any url from a CGI
> parameter for proxying
>
>To replicate:
>
>Disable tracklinks in your system preferences
>go to, for example:
>http://<your name here>/cgi-bin/koha/tracklinks.pl?uri=http://google.com
>
>This will be passed through. This is the case we want to avoid.
>
>So will this:
>http://<your name here>/cgi-bin/koha/tracklinks.pl?uri=http://www.google.com&biblionumber=24
>assuming you've got a biblionumber 24. This case is OK.
>
>Test with tracklinks set to track, and anonymous. Click both again. Both should still work.
>
>Apply this patch, and test:
>
>http://<your name here>/cgi-bin/koha/tracklinks.pl?uri=http://google.com
>This should not work with tracklinks on any setting - should 404.
>
>http://<your name here>/cgi-bin/koha/tracklinks.pl?uri=http://www.google.com&biblionumber=24
>This should still work with tracklinks set to track or anonymous.
>
>Test also that from the OPAC detail and results pages that the links from those pages still work in all settings of tracklinks.
>---
> opac/tracklinks.pl | 26 +++++++++++++-------------
> 1 file changed, 13 insertions(+), 13 deletions(-)
>
>diff --git a/opac/tracklinks.pl b/opac/tracklinks.pl
>index 02b402d..0d0534c 100755
>--- a/opac/tracklinks.pl
>+++ b/opac/tracklinks.pl
>@@ -23,20 +23,27 @@ use C4::Context;
> use C4::Auth qw(checkauth);
> use Koha::Linktracker;
> use CGI qw ( -utf8 );
>+use C4::Biblio;
> 
> my $cgi = new CGI;
> my $uri = $cgi->param('uri') || '';
> 
>+my $biblionumber = $cgi->param('biblionumber') || undef ;
>+my $record       = GetMarcBiblio({
>+      biblionumber => $biblionumber,
>+}) || undef ;
>+
>+
> my $tracker = Koha::Linktracker->new(
>     { trackingmethod => C4::Context->preference('TrackClicks') } );
> 
>-if ($uri) {
>-    if (   $tracker->trackingmethod() eq 'track'
>-        || $tracker->trackingmethod() eq 'anonymous' )
>-    {
>+# we want to make sure we have a url and biblio to go with it
>+if (  ($uri && $record) &&  ( $tracker->trackingmethod() eq 'track'
>+    || $tracker->trackingmethod() eq 'anonymous' ) )
>+{
>         my $borrowernumber = 0;
> 
>-        # we have a uri and we want to track
>+        # we want to track
>         if ( $tracker->trackingmethod() eq 'track' ) {
>             my ( $user, $cookie, $sessionID, $flags ) =
>               checkauth( $cgi, 1, {}, 'opac' );
>@@ -63,14 +70,7 @@ if ($uri) {
>             }
>         );
>         print $cgi->redirect($uri);
>-    }
>-    else {
>-
>-        # We have a valid url, but we shouldn't track it, just redirect
>-        print $cgi->redirect($uri);
>-    }
>-}
>-else {
>+} else {
> 
>     # we shouldn't be here, bail out
>     print $cgi->redirect("/cgi-bin/koha/errors/404.pl");    # escape early
>-- 
>2.7.4

Actions: View | Diff | Splinter Review

Attachments on bug 19847: 69949 | 69975 | 70167 | 70283