View | Details | Raw Unified | Return to bug 23329
Collapse All | Expand All

(-)a/opac/tracklinks.pl (-2 / +4 lines)
Lines 22-27 use Modern::Perl; Link Here
22
use C4::Context;
22
use C4::Context;
23
use C4::Auth qw(checkauth);
23
use C4::Auth qw(checkauth);
24
use C4::Biblio;
24
use C4::Biblio;
25
use C4::Output;
25
use Koha::Items;
26
use Koha::Items;
26
use Koha::Linktracker;
27
use Koha::Linktracker;
27
use CGI qw ( -utf8 );
28
use CGI qw ( -utf8 );
Lines 56-63 if ($uri && ($biblionumber || $itemnumber) ) { Link Here
56
57
57
    my $record = C4::Biblio::GetMarcBiblio({ biblionumber => $biblionumber });
58
    my $record = C4::Biblio::GetMarcBiblio({ biblionumber => $biblionumber });
58
    my $marc_urls = $record ? C4::Biblio::GetMarcUrls($record, C4::Context->preference('marcflavour')) : [];
59
    my $marc_urls = $record ? C4::Biblio::GetMarcUrls($record, C4::Context->preference('marcflavour')) : [];
60
59
    if ( ( any { $_ eq $uri } map { $_->{MARCURL} } @$marc_urls )
61
    if ( ( any { $_ eq $uri } map { $_->{MARCURL} } @$marc_urls )
60
        || Koha::Items->search( { itemnumber => $itemnumber, uri => $uri } )->count )
62
        || ( $itemnumber && Koha::Items->search( { itemnumber => $itemnumber, uri => $uri } )->count ) )
61
    {
63
    {
62
        $tracker->trackclick(
64
        $tracker->trackclick(
63
            {
65
            {
Lines 72-76 if ($uri && ($biblionumber || $itemnumber) ) { Link Here
72
    }
74
    }
73
}
75
}
74
76
75
print $cgi->redirect("/cgi-bin/koha/errors/404.pl");    # escape early
77
output_error( $cgi, '404' );
76
exit;
78
exit;
(-)a/t/db_dependent/www/regressions.t (-8 / +3 lines)
Lines 38-46 my $schema = Koha::Database->new->schema; Link Here
38
my $builder = t::lib::TestBuilder->new;
38
my $builder = t::lib::TestBuilder->new;
39
39
40
subtest 'open redirection vulnerabilities in tracklinks' => sub {
40
subtest 'open redirection vulnerabilities in tracklinks' => sub {
41
    plan tests => 30;
41
    plan tests => 36;
42
43
    $schema->storage->txn_begin;
44
42
45
    # No URI's
43
    # No URI's
46
    my $biblio        = $builder->build_sample_biblio();
44
    my $biblio        = $builder->build_sample_biblio();
Lines 58-69 subtest 'open redirection vulnerabilities in tracklinks' => sub { Link Here
58
    $biblio = $builder->build_sample_biblio();
56
    $biblio = $builder->build_sample_biblio();
59
    my $biblionumber3 = $biblio->biblionumber;
57
    my $biblionumber3 = $biblio->biblionumber;
60
    $record        = $biblio->metadata->record;
58
    $record        = $biblio->metadata->record;
61
    $new856 = MARC::Field->new( '856', '', '', u => "www.google.com" );
59
    $new856 = MARC::Field->new( '856', '', '', u => "http://www.google.com" );
62
    $record->insert_fields_ordered($new856);
60
    $record->insert_fields_ordered($new856);
63
    C4::Biblio::ModBiblio( $record, $biblionumber3 );
61
    C4::Biblio::ModBiblio( $record, $biblionumber3 );
64
62
65
    # URI at Item level
63
    # URI at Item level
66
    my $item = $builder->build_sample_item( { uri => 'www.google.com' } );
64
    my $item = $builder->build_sample_item( { uri => 'http://www.google.com' } );
67
    my $itemnumber1 = $item->itemnumber;
65
    my $itemnumber1 = $item->itemnumber;
68
66
69
    # Incorrect URI at Item level
67
    # Incorrect URI at Item level
Lines 132-137 subtest 'open redirection vulnerabilities in tracklinks' => sub { Link Here
132
      ->status_is( 404, "404 for itemnumber containing different URI" );
130
      ->status_is( 404, "404 for itemnumber containing different URI" );
133
    $t->get_ok( $opac . $good_itemnumber )
131
    $t->get_ok( $opac . $good_itemnumber )
134
      ->status_is( 302, "302 for itemnumber with matching URI" );
132
      ->status_is( 302, "302 for itemnumber with matching URI" );
135
136
    $schema->storage->txn_rollback;
137
};
133
};
138
- 

Return to bug 23329