Bug 37370

Summary: opac-export.pl can be used even if exporting disabled
Product: Koha Reporter: Tomás Cohen Arazi (tcohen) <tomascohen>
Component: OPACAssignee: Tomás Cohen Arazi (tcohen) <tomascohen>
Status: CLOSED FIXED QA Contact: Nick Clemens (kidclamp) <nick>
Severity: normal    
Priority: P5 - low CC: amitddng135, dcook, didier.gautheron, fridolin.somers, jonathan.druart, kyle, laurent.ducos, lisette, lucas, m.de.rooy, martin.renvoize, nick, philippe.blouin, tomascohen, wainuiwitikapark
Version: Main   
Hardware: All   
OS: All   
GIT URL: Change sponsored?: ---
Patch complexity: Trivial patch Documentation contact:
Documentation submission: Text to go in the release notes:
Version(s) released in:
24.11.00,24.05.03,23.11.08,23.05.14,22.11.20
Circulation function:
Bug Depends on:    
Bug Blocks: 37679    
Attachments: Bug 37370: Return 400 if OpacExportOptions does not contain the passed format
Bug 37370: Return 400 if OpacExportOptions does not contain the passed format
Bug 37370: Return 400 if OpacExportOptions does not contain the passed format

Description Tomás Cohen Arazi (tcohen) 2024-07-16 12:08:32 UTC
Even if all OpacExportOptions are disabled, bots can still hit the script and request any export format.
Comment 1 Tomás Cohen Arazi (tcohen) 2024-07-16 17:50:06 UTC
Created attachment 169054 [details] [review]
Bug 37370: Return 400 if OpacExportOptions does not contain the passed format

Signed-off-by: Tomas Cohen Arazi <tomascohen@theke.io>
Comment 2 David Cook 2024-08-07 01:39:13 UTC
Technically, we're returning 302 and then 400. I think it would be better if we just returned 400 immediately. 

In theory the following should work:
output_with_http_headers $query, $cookie, '', 'html', '400';

--

But I don't think that's a blocker. I just think we should stop redirecting to our error pages (especially since the Plack middleware will render the correct error page these days).
Comment 3 David Cook 2024-08-07 01:39:58 UTC
Created attachment 170122 [details] [review]
Bug 37370: Return 400 if OpacExportOptions does not contain the passed format

Signed-off-by: Tomas Cohen Arazi <tomascohen@theke.io>
Signed-off-by: David Cook <dcook@prosentient.com.au>
Comment 4 Nick Clemens (kidclamp) 2024-08-07 11:28:36 UTC
Created attachment 170133 [details] [review]
Bug 37370: Return 400 if OpacExportOptions does not contain the passed format

Signed-off-by: Tomas Cohen Arazi <tomascohen@theke.io>
Signed-off-by: David Cook <dcook@prosentient.com.au>
Signed-off-by: Nick Clemens <nick@bywatersolutions.com>
Comment 5 Tomás Cohen Arazi (tcohen) 2024-08-12 14:38:38 UTC
Pushed to main for 24.11.

Nice work everyone, thanks!
Comment 6 Wainui Witika-Park 2024-09-18 03:48:56 UTC
Not backporting to 23.05.x unless requested