From 1d58b87d748b30741367bac7a40bc3d731c9ff43 Mon Sep 17 00:00:00 2001 From: Chris Cormack Date: Tue, 24 Jan 2017 14:42:10 +1300 Subject: [PATCH] Bug 19847 - tracklinks.pl accepts any url from a CGI parameter for proxying To replicate: Disable tracklinks in your system preferences go to, for example: http:///cgi-bin/koha/tracklinks.pl?uri=http://google.com This will be passed through. This is the case we want to avoid. So will this: http:///cgi-bin/koha/tracklinks.pl?uri=http://www.google.com&biblionumber=24 assuming you've got a biblionumber 24. This case is OK. Test with tracklinks set to track, and anonymous. Click both again. Both should still work. Apply this patch, and test: http:///cgi-bin/koha/tracklinks.pl?uri=http://google.com This should not work with tracklinks on any setting - should 404. http:///cgi-bin/koha/tracklinks.pl?uri=http://www.google.com&biblionumber=24 This should still work with tracklinks set to track or anonymous. Test also that from the OPAC detail and results pages that the links from those pages still work in all settings of tracklinks. --- opac/tracklinks.pl | 26 +++++++++++++------------- 1 file changed, 13 insertions(+), 13 deletions(-) diff --git a/opac/tracklinks.pl b/opac/tracklinks.pl index 02b402d..0d0534c 100755 --- a/opac/tracklinks.pl +++ b/opac/tracklinks.pl @@ -23,20 +23,27 @@ use C4::Context; use C4::Auth qw(checkauth); use Koha::Linktracker; use CGI qw ( -utf8 ); +use C4::Biblio; my $cgi = new CGI; my $uri = $cgi->param('uri') || ''; +my $biblionumber = $cgi->param('biblionumber') || undef ; +my $record = GetMarcBiblio({ + biblionumber => $biblionumber, +}) || undef ; + + my $tracker = Koha::Linktracker->new( { trackingmethod => C4::Context->preference('TrackClicks') } ); -if ($uri) { - if ( $tracker->trackingmethod() eq 'track' - || $tracker->trackingmethod() eq 'anonymous' ) - { +# we want to make sure we have a url and biblio to go with it +if ( ($uri && $record) && ( $tracker->trackingmethod() eq 'track' + || $tracker->trackingmethod() eq 'anonymous' ) ) +{ my $borrowernumber = 0; - # we have a uri and we want to track + # we want to track if ( $tracker->trackingmethod() eq 'track' ) { my ( $user, $cookie, $sessionID, $flags ) = checkauth( $cgi, 1, {}, 'opac' ); @@ -63,14 +70,7 @@ if ($uri) { } ); print $cgi->redirect($uri); - } - else { - - # We have a valid url, but we shouldn't track it, just redirect - print $cgi->redirect($uri); - } -} -else { +} else { # we shouldn't be here, bail out print $cgi->redirect("/cgi-bin/koha/errors/404.pl"); # escape early -- 2.7.4