Even if all OpacExportOptions are disabled, bots can still hit the script and request any export format.
Created attachment 169054 [details] [review] Bug 37370: Return 400 if OpacExportOptions does not contain the passed format Signed-off-by: Tomas Cohen Arazi <tomascohen@theke.io>
Technically, we're returning 302 and then 400. I think it would be better if we just returned 400 immediately. In theory the following should work: output_with_http_headers $query, $cookie, '', 'html', '400'; -- But I don't think that's a blocker. I just think we should stop redirecting to our error pages (especially since the Plack middleware will render the correct error page these days).
Created attachment 170122 [details] [review] Bug 37370: Return 400 if OpacExportOptions does not contain the passed format Signed-off-by: Tomas Cohen Arazi <tomascohen@theke.io> Signed-off-by: David Cook <dcook@prosentient.com.au>
Created attachment 170133 [details] [review] Bug 37370: Return 400 if OpacExportOptions does not contain the passed format Signed-off-by: Tomas Cohen Arazi <tomascohen@theke.io> Signed-off-by: David Cook <dcook@prosentient.com.au> Signed-off-by: Nick Clemens <nick@bywatersolutions.com>
Pushed to main for 24.11. Nice work everyone, thanks!
Not backporting to 23.05.x unless requested
This breaks Zotero integration as the Zotero browser extension expects to be able to call utf8 as a format. We find libraries don't want to visually show utf8 in the export menu, but do want Zotero to work.