Bug 37370 - opac-export.pl can be used even if exporting disabled
Summary: opac-export.pl can be used even if exporting disabled
Status: RESOLVED FIXED
Alias: None
Product: Koha
Classification: Unclassified
Component: OPAC (show other bugs)
Version: Main
Hardware: All All
: P5 - low normal
Assignee: Tomás Cohen Arazi (tcohen)
QA Contact: Nick Clemens (kidclamp)
URL:
Keywords:
Depends on:
Blocks: 37679
  Show dependency tree / graph
 
Reported: 2024-07-16 12:08 UTC by Tomás Cohen Arazi (tcohen)
Modified: 2024-09-18 03:48 UTC (History)
15 users (show)

See Also:
Change sponsored?: ---
Patch complexity: Trivial patch
Documentation contact:
Documentation submission:
Text to go in the release notes:
Version(s) released in:
24.11.00,24.05.03,23.11.08,23.05.14,22.11.20
Circulation function:

Attachments
Bug 37370: Return 400 if OpacExportOptions does not contain the passed format (1.36 KB, patch)
2024-07-16 17:50 UTC, Tomás Cohen Arazi (tcohen) 		Details | Diff | Splinter Review
Bug 37370: Return 400 if OpacExportOptions does not contain the passed format (1.41 KB, patch)
2024-08-07 01:39 UTC, David Cook 		Details | Diff | Splinter Review
Bug 37370: Return 400 if OpacExportOptions does not contain the passed format (1.46 KB, patch)
2024-08-07 11:28 UTC, Nick Clemens (kidclamp) 		Details | Diff | Splinter Review
Show Obsolete (2) View All Add an attachment (proposed patch, testcase, etc.)

Note You need to log in before you can comment on or make changes to this bug.
Description Tomás Cohen Arazi (tcohen) 2024-07-16 12:08:32 UTC 
Even if all OpacExportOptions are disabled, bots can still hit the script and request any export format.
Comment 1 Tomás Cohen Arazi (tcohen) 2024-07-16 17:50:06 UTC 
Created attachment 169054 [details] [review]
Bug 37370: Return 400 if OpacExportOptions does not contain the passed format

Signed-off-by: Tomas Cohen Arazi <tomascohen@theke.io>
Comment 2 David Cook 2024-08-07 01:39:13 UTC 
Technically, we're returning 302 and then 400. I think it would be better if we just returned 400 immediately. 

In theory the following should work:
output_with_http_headers $query, $cookie, '', 'html', '400';

--

But I don't think that's a blocker. I just think we should stop redirecting to our error pages (especially since the Plack middleware will render the correct error page these days).
Comment 3 David Cook 2024-08-07 01:39:58 UTC 
Created attachment 170122 [details] [review]
Bug 37370: Return 400 if OpacExportOptions does not contain the passed format

Signed-off-by: Tomas Cohen Arazi <tomascohen@theke.io>
Signed-off-by: David Cook <dcook@prosentient.com.au>
Comment 4 Nick Clemens (kidclamp) 2024-08-07 11:28:36 UTC 
Created attachment 170133 [details] [review]
Bug 37370: Return 400 if OpacExportOptions does not contain the passed format

Signed-off-by: Tomas Cohen Arazi <tomascohen@theke.io>
Signed-off-by: David Cook <dcook@prosentient.com.au>
Signed-off-by: Nick Clemens <nick@bywatersolutions.com>
Comment 5 Tomás Cohen Arazi (tcohen) 2024-08-12 14:38:38 UTC 
Pushed to main for 24.11.

Nice work everyone, thanks!
Comment 6 Wainui Witika-Park 2024-09-18 03:48:56 UTC 
Not backporting to 23.05.x unless requested