gitea
/
Koha-clms
1
0
Fork 0
Code Issues Pull Requests Packages Projects Releases Wiki Activity

Bug 25009: Avoid leakages in opac-showmarc.pl 

This patch cleans opac-showmarc.pl so it doesn't allow retrieving
records from import batches without requiring any permissions in the
OPAC.

it does so by just removing the code portion that does that.

It also cleans the record fetch operation and how the record processor
is initialized to it actually works :-D

To test:
1. Perform a successful Z39.50 search in cataloguing (this fetches 20
   records usually)
2. Query your DB for a valid import_record_id:
  $ koha-mysql kohadev
  > SELECT * FROM import_records LIMIT 1;
3. Notice some of the MARCXML details (title, author, etc), and the
   import_record_id
4. Point your browser to the opac-showmarc.pl URL like this:
   http://kohadev.mydnsname.org:8080/cgi-bin/koha/opac-showmarc.pl?importid=20
=> FAIL: You get the record! (Bonus: no field/subfield takes place)
5. Hide some obvious subfield on the framework for a known (to you)
   biblionumber
6. Point your browser to:
   http://kohadev.mydnsname.org:8080/cgi-bin/koha/opac-showmarc.pl?id=<biblionumber_here>
=> FAIL: No filtering takes place
7. Apply this patch
8. Repeat 4
=> SUCCESS: You get an error because you did a bad request (no id param)
9. Repeat 6
=> SUCCESS: Subfield filtering actually works!
10. Sign off :-D

Signed-off-by: Tomas Cohen Arazi <tomascohen@theke.io>

Signed-off-by: Jonathan Druart <jonathan.druart@bugs.koha-community.org>

Signed-off-by: Katrin Fischer <katrin.fischer.83@web.de>

Signed-off-by: Joy Nelson <joy@bywatersolutions.com>
(cherry picked from commit d3ba9dc0fe)

Signed-off-by: Lucas Gass <lucas@bywatersolutions.com>
This commit is contained in:
Tomas Cohen Arazi 2020-03-27 18:16:58 -03:00 committed by Lucas Gass
parent d10e44a9d7
commit 021a9bf216
1 changed files with 25 additions and 16 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

41
opac/opac-showmarc.pl
View File

@ -41,26 +41,35 @@ my ( $template, $loggedinuser, $cookie ) = get_template_and_user({
authnotrequired => ( C4::Context->preference("OpacPublic") ? 1 : 0 ),
debug => 1,
});
my $biblionumber = $input->param('id');
$biblionumber = int($biblionumber);
my $importid= $input->param('importid');
unless ( $biblionumber ) {
print $input->redirect("/cgi-bin/koha/errors/400.pl");
exit;
}
my $biblio;
$biblio = Koha::Biblios->find( $biblionumber, { prefetch => [ 'metadata' ] } );
unless ( $biblio ) {
print $input->redirect('/cgi-bin/koha/errors/404.pl');
exit;
}
my $view= $input->param('viewas') || 'marc';
my $record_processor = Koha::RecordProcessor->new({ filters => 'ViewPolicy' });
my $record_processor = Koha::RecordProcessor->new(
{
filters => 'ViewPolicy',
options => {
interface => 'opac',
frameworkcode => $biblio->frameworkcode
}
}
);
my $record;
if ($importid) {
my ($marc) = GetImportRecordMarc($importid);
$record = MARC::Record->new_from_usmarc($marc);
}
else {
$record = GetMarcBiblio({ biblionumber => $biblionumber });
my $framework = GetFrameworkCode($biblionumber);
$record_processor->options({
interface => 'opac',
frameworkcode => $framework
});
}
my $record = $biblio->metadata->record;
if(!ref $record) {
print $input->redirect("/cgi-bin/koha/errors/404.pl");