Summary: | opac-showmarc.pl allows fetching data directly from import batches | ||
---|---|---|---|
Product: | Koha | Reporter: | Tomás Cohen Arazi (tcohen) <tomascohen> |
Component: | Architecture, internals, and plumbing | Assignee: | Tomás Cohen Arazi (tcohen) <tomascohen> |
Status: | CLOSED FIXED | QA Contact: | |
Severity: | critical | ||
Priority: | P5 - low | CC: | 1joynelson, fridolin.somers, hayleypelham, jonathan.druart, lucas, martin.renvoize, nick |
Version: | unspecified | ||
Hardware: | All | ||
OS: | All | ||
Change sponsored?: | --- | Patch complexity: | Small patch |
Documentation contact: | Documentation submission: | ||
Text to go in the release notes: | Version(s) released in: |
20.05.00, 19.11.05, 19.05.10, 18.11.16
|
|
Circulation function: | |||
Attachments: |
Bug 25009: Avoid leakages in opac-showmarc.pl
Bug 25009: Avoid leakages in opac-showmarc.pl Bug 25009: Avoid leakages in opac-showmarc.pl Bug 25009: [18.11.x] Add missing biblio_metadata stuffs |
Description
Tomás Cohen Arazi (tcohen)
2020-03-27 21:10:22 UTC
Created attachment 102020 [details] [review] Bug 25009: Avoid leakages in opac-showmarc.pl This patch cleans opac-showmarc.pl so it doesn't allow retrieving records from import batches without requiring any permissions in the OPAC. it does so by just removing the code portion that does that. It also cleans the record fetch operation and how the record processor is initialized to it actually works :-D To test: 1. Perform a successful Z39.50 search in cataloguing (this fetches 20 records usually) 2. Query your DB for a valid import_record_id: $ koha-mysql kohadev > SELECT * FROM import_records LIMIT 1; 3. Notice some of the MARCXML details (title, author, etc), and the import_record_id 4. Point your browser to the opac-showmarc.pl URL like this: http://kohadev.mydnsname.org:8080/cgi-bin/koha/opac-showmarc.pl?importid=20 => FAIL: You get the record! (Bonus: no field/subfield takes place) 5. Hide some obvious subfield on the framework for a known (to you) biblionumber 6. Point your browser to: http://kohadev.mydnsname.org:8080/cgi-bin/koha/opac-showmarc.pl?id=<biblionumber_here> => FAIL: No filtering takes place 7. Apply this patch 8. Repeat 4 => SUCCESS: You get an error because you did a bad request (no id param) 9. Repeat 6 => SUCCESS: Subfield filtering actually works! 10. Sign off :-D Signed-off-by: Tomas Cohen Arazi <tomascohen@theke.io> Created attachment 102076 [details] [review] Bug 25009: Avoid leakages in opac-showmarc.pl This patch cleans opac-showmarc.pl so it doesn't allow retrieving records from import batches without requiring any permissions in the OPAC. it does so by just removing the code portion that does that. It also cleans the record fetch operation and how the record processor is initialized to it actually works :-D To test: 1. Perform a successful Z39.50 search in cataloguing (this fetches 20 records usually) 2. Query your DB for a valid import_record_id: $ koha-mysql kohadev > SELECT * FROM import_records LIMIT 1; 3. Notice some of the MARCXML details (title, author, etc), and the import_record_id 4. Point your browser to the opac-showmarc.pl URL like this: http://kohadev.mydnsname.org:8080/cgi-bin/koha/opac-showmarc.pl?importid=20 => FAIL: You get the record! (Bonus: no field/subfield takes place) 5. Hide some obvious subfield on the framework for a known (to you) biblionumber 6. Point your browser to: http://kohadev.mydnsname.org:8080/cgi-bin/koha/opac-showmarc.pl?id=<biblionumber_here> => FAIL: No filtering takes place 7. Apply this patch 8. Repeat 4 => SUCCESS: You get an error because you did a bad request (no id param) 9. Repeat 6 => SUCCESS: Subfield filtering actually works! 10. Sign off :-D Signed-off-by: Tomas Cohen Arazi <tomascohen@theke.io> Signed-off-by: Jonathan Druart <jonathan.druart@bugs.koha-community.org> Created attachment 102832 [details] [review] Bug 25009: Avoid leakages in opac-showmarc.pl This patch cleans opac-showmarc.pl so it doesn't allow retrieving records from import batches without requiring any permissions in the OPAC. it does so by just removing the code portion that does that. It also cleans the record fetch operation and how the record processor is initialized to it actually works :-D To test: 1. Perform a successful Z39.50 search in cataloguing (this fetches 20 records usually) 2. Query your DB for a valid import_record_id: $ koha-mysql kohadev > SELECT * FROM import_records LIMIT 1; 3. Notice some of the MARCXML details (title, author, etc), and the import_record_id 4. Point your browser to the opac-showmarc.pl URL like this: http://kohadev.mydnsname.org:8080/cgi-bin/koha/opac-showmarc.pl?importid=20 => FAIL: You get the record! (Bonus: no field/subfield takes place) 5. Hide some obvious subfield on the framework for a known (to you) biblionumber 6. Point your browser to: http://kohadev.mydnsname.org:8080/cgi-bin/koha/opac-showmarc.pl?id=<biblionumber_here> => FAIL: No filtering takes place 7. Apply this patch 8. Repeat 4 => SUCCESS: You get an error because you did a bad request (no id param) 9. Repeat 6 => SUCCESS: Subfield filtering actually works! 10. Sign off :-D Signed-off-by: Tomas Cohen Arazi <tomascohen@theke.io> Signed-off-by: Jonathan Druart <jonathan.druart@bugs.koha-community.org> Signed-off-by: Katrin Fischer <katrin.fischer.83@web.de> Pushed to 19.11.x for 19.11.05 This patch applies cleanly to 18.11.x, however from step 6 I only get 404 errors, including after I have applied the patch. Can someone please let me know where I've gone wrong or verify for me that this patch works for 18.11.x? (In reply to Hayley Mapley from comment #5) > This patch applies cleanly to 18.11.x, however from step 6 I only get 404 > errors, including after I have applied the patch. Can someone please let me > know where I've gone wrong or verify for me that this patch works for > 18.11.x? Sorry, 400 errors rather (when hitting those URLs) (In reply to Hayley Mapley from comment #6) > (In reply to Hayley Mapley from comment #5) > > This patch applies cleanly to 18.11.x, however from step 6 I only get 404 > > errors, including after I have applied the patch. Can someone please let me > > know where I've gone wrong or verify for me that this patch works for > > 18.11.x? > > Sorry, 400 errors rather (when hitting those URLs) I can take a look tomorrow! Created attachment 103474 [details] [review] Bug 25009: [18.11.x] Add missing biblio_metadata stuffs It adds methods, DBIC rs and Exceptions class for biblio metadata. Note that schema is marcflavour in 18.11 Hayley, could you try again with that patch? Thanks Jonathan, looks more as expected now! Backported to 18.11.x for 18.11.16 Nice work everyone! Pushed to master for 20.05 |