Summary: | tracklinks.pl accepts any url from a parameter for proxying | ||
---|---|---|---|
Product: | Koha | Reporter: | Liz Rea <liz> |
Component: | Architecture, internals, and plumbing | Assignee: | Jonathan Druart <jonathan.druart> |
Status: | CLOSED FIXED | QA Contact: | Testopia <testopia> |
Severity: | major | ||
Priority: | P5 - low | CC: | fridolin.somers, jonathan.druart, nick, shoriful19 |
Version: | unspecified | ||
Hardware: | All | ||
OS: | All | ||
Change sponsored?: | --- | Patch complexity: | Small patch |
Documentation contact: | Documentation submission: | ||
Text to go in the release notes: | Version(s) released in: | ||
Circulation function: | |||
Bug Depends on: | |||
Bug Blocks: | 20218, 21018 | ||
Attachments: |
Bug 19847: Track links within the records and 404 for others
Bug 19847 - tracklinks.pl accepts any url from a CGI parameter for proxying Bug 19847: Track links within the records and 404 for others Bug 19847: Track links within the records and 404 for others |
Description
Liz Rea
2017-12-19 22:00:16 UTC
I think limiting to the links within records makes sense. How would you check that? Created attachment 69949 [details] [review] Bug 19847: Track links within the records and 404 for others Test plan: Behave like a robot, you will get 404 Be a human, you will be tracked Something like that? Created attachment 69975 [details] [review] Bug 19847 - tracklinks.pl accepts any url from a CGI parameter for proxying To replicate: Disable tracklinks in your system preferences go to, for example: http://<your name here>/cgi-bin/koha/tracklinks.pl?uri=http://google.com This will be passed through. This is the case we want to avoid. So will this: http://<your name here>/cgi-bin/koha/tracklinks.pl?uri=http://www.google.com&biblionumber=24 assuming you've got a biblionumber 24. This case is OK. Test with tracklinks set to track, and anonymous. Click both again. Both should still work. Apply this patch, and test: http://<your name here>/cgi-bin/koha/tracklinks.pl?uri=http://google.com This should not work with tracklinks on any setting - should 404. http://<your name here>/cgi-bin/koha/tracklinks.pl?uri=http://www.google.com&biblionumber=24 This should still work with tracklinks set to track or anonymous. Test also that from the OPAC detail and results pages that the links from those pages still work in all settings of tracklinks. oh drat you just beat me, took a little different approach, I only check we have a record and a biblionumber and don't bother with checking the urls come from the record. Your way is probably better. Created attachment 70167 [details] [review] Bug 19847: Track links within the records and 404 for others Test plan: Behave like a robot, you will get 404 Be a human, you will be tracked Signed-off-by: Katrin Fischer <katrin.fischer.83@web.de> Created attachment 70283 [details] [review] Bug 19847: Track links within the records and 404 for others Test plan: Behave like a robot, you will get 404 Be a human, you will be tracked Signed-off-by: Katrin Fischer <katrin.fischer.83@web.de> Signed-off-by: Nick Clemens <nick@bywatersolutions.com> Patch pushed to * master for 18.05 * 17.11.x for v17.11.02 * 17.05.x for v17.05.08 |