Bugzilla – Attachment 92223 Details for
Bug 23329
tracklinks.pl accepts any url from a parameter for proxying if not tracking
Home
|
New
|
Browse
|
Search
|
[?]
|
Reports
|
Help
|
New Account
|
Log In
[x]
|
Forgot Password
Login:
[x]
[patch]
Bug 23329: Only redirect tracklinks.pl to urls contained in records
Bug-23329-Only-redirect-tracklinkspl-to-urls-conta.patch (text/plain), 4.86 KB, created by
Kyle M Hall (khall)
on 2019-08-15 13:25:42 UTC
(
hide
)
Description:
Bug 23329: Only redirect tracklinks.pl to urls contained in records
Filename:
MIME Type:
Creator:
Kyle M Hall (khall)
Created:
2019-08-15 13:25:42 UTC
Size:
4.86 KB
patch
obsolete
>From ee7b72f402e1d83d361ba6fb4cfcc5d2a582945c Mon Sep 17 00:00:00 2001 >From: Nick Clemens <nick@bywatersolutions.com> >Date: Wed, 17 Jul 2019 11:01:01 +0000 >Subject: [PATCH] Bug 23329: Only redirect tracklinks.pl to urls contained in > records > >Bug 19487 limited redirection to urls contained in a record/item if we were tracking. >We should probably limit forwarding if not tracking as well. >Additionally, if we don't have a soucre, let's not forward > >To test: > 0 - Set TrackClicks syspref to 'Don't track' > 1 - Hit localhost:8080/cgi-bin/koha/tracklinks.pl?uri=http://www.google.com > 2 - You get forwarded to google > 3 - Set TrackClicks to 'Track anonymously' > 4 - You get a 404 > 5 - Apply patch > 6 - Hit localhost:8080/cgi-bin/koha/tracklinks.pl?uri=http://www.google.com > 7 - You get a 404 > 8 - Set TrackClicks syspref to 'Don't track' > 9 - Hit localhost:8080/cgi-bin/koha/tracklinks.pl?uri=http://www.google.com&biblionumber=1 > Choose a biblionumber that exists >10 - You get a 404 >11 - Add http://www.google.com to the 856$u of the record used above >12 - Hit localhost:8080/cgi-bin/koha/tracklinks.pl?uri=http://www.google.com&biblionumber=1 >13 - You are redirected >14 - Confirm redirection and 404 as expected with other settings of TrackClicks > >Signed-off-by: Tomas Cohen Arazi <tomascohen@theke.io> >Signed-off-by: Marcel de Rooy <m.de.rooy@rijksmuseum.nl> >Signed-off-by: Martin Renvoize <martin.renvoize@ptfs-europe.com> > >Signed-off-by: Kyle M Hall <kyle@bywatersolutions.com> >--- > opac/tracklinks.pl | 66 ++++++++++++++++++++-------------------------- > 1 file changed, 28 insertions(+), 38 deletions(-) > >diff --git a/opac/tracklinks.pl b/opac/tracklinks.pl >index 7bdb93935c..329addf0b5 100755 >--- a/opac/tracklinks.pl >+++ b/opac/tracklinks.pl >@@ -28,54 +28,44 @@ use CGI qw ( -utf8 ); > > my $cgi = new CGI; > my $uri = $cgi->param('uri') || ''; >+my $biblionumber = $cgi->param('biblionumber') || 0; >+my $itemnumber = $cgi->param('itemnumber') || 0; > > my $tracker = Koha::Linktracker->new( > { trackingmethod => C4::Context->preference('TrackClicks') } ); > >-if ($uri) { >- if ( $tracker->trackingmethod() eq 'track' >- || $tracker->trackingmethod() eq 'anonymous' ) >- { >- my $borrowernumber = 0; >- >- # we have a uri and we want to track >- if ( $tracker->trackingmethod() eq 'track' ) { >- my ( $user, $cookie, $sessionID, $flags ) = >- checkauth( $cgi, 1, {}, 'opac' ); >- my $userenv = C4::Context->userenv; >- >- if ( defined($userenv) >- && ref($userenv) eq 'HASH' >- && $userenv->{number} ) >- { >- $borrowernumber = $userenv->{number}; >- } >+if ($uri && ($biblionumber || $itemnumber) ) { >+ my $borrowernumber = 0; > >- # get borrower info >- } >- my $biblionumber = $cgi->param('biblionumber') || 0; >- my $itemnumber = $cgi->param('itemnumber') || 0; >+ # we have a uri and we want to track >+ if ( $tracker->trackingmethod() eq 'track' ) { >+ my ( $user, $cookie, $sessionID, $flags ) = >+ checkauth( $cgi, 1, {}, 'opac' ); >+ my $userenv = C4::Context->userenv; > >- my $record = C4::Biblio::GetMarcBiblio({ biblionumber => $biblionumber }); >- my $marc_urls = C4::Biblio::GetMarcUrls($record, C4::Context->preference('marcflavour')); >- if ( ( grep { $_ eq $uri } map { $_->{MARCURL} } @$marc_urls ) >- || Koha::Items->search( { itemnumber => $itemnumber, uri => $uri } )->count ) >+ if ( defined($userenv) >+ && ref($userenv) eq 'HASH' >+ && $userenv->{number} ) > { >- $tracker->trackclick( >- { >- uri => $uri, >- biblionumber => $biblionumber, >- borrowernumber => $borrowernumber, >- itemnumber => $itemnumber >- } >- ); >- print $cgi->redirect($uri); >- exit; >+ $borrowernumber = $userenv->{number}; > } >+ >+ # get borrower info > } >- else { > >- # We have a valid url, but we shouldn't track it, just redirect >+ my $record = C4::Biblio::GetMarcBiblio({ biblionumber => $biblionumber }); >+ my $marc_urls = C4::Biblio::GetMarcUrls($record, C4::Context->preference('marcflavour')); >+ if ( ( grep { $_ eq $uri } map { $_->{MARCURL} } @$marc_urls ) >+ || Koha::Items->search( { itemnumber => $itemnumber, uri => $uri } )->count ) >+ { >+ $tracker->trackclick( >+ { >+ uri => $uri, >+ biblionumber => $biblionumber, >+ borrowernumber => $borrowernumber, >+ itemnumber => $itemnumber >+ } >+ ) if ( $tracker->trackingmethod() eq 'track' || $tracker->trackingmethod() eq 'anonymous' ); > print $cgi->redirect($uri); > exit; > } >-- >2.20.1 (Apple Git-117)
You cannot view the attachment while viewing its details because your browser does not support IFRAMEs.
View the attachment on a separate page
.
View Attachment As Diff
View Attachment As Raw
Actions:
View
|
Diff
|
Splinter Review
Attachments on
bug 23329
:
91566
|
91572
|
91573
|
91759
|
91760
|
92109
|
92110
|
92111
|
92112
|
92187
|
92188
|
92198
|
92199
|
92200
|
92212
|
92213
|
92214
|
92215
|
92216
|
92217
|
92218
|
92219
|
92220
|
92223
|
92224
|
92225
|
92226
|
92227
|
92228
|
92229
|
92230
|
92231
|
92262
|
92263
|
92264
|
92265
|
92266
|
92267
|
92268
|
92269