gitea
/
Koha-clms
1
0
Fork 0
Code Issues Pull Requests Packages Projects Releases Wiki Activity

Bug 41261: Valid inputs to unapi 

This change adds data validation to the "unapi" API endpoint.

Test plan:
0. Apply the patch
1. Go to http://localhost:8080/cgi-bin/koha/unapi
2. Note the 400 HTTP response code
3. Go to http://localhost:8080/cgi-bin/koha/unapi?id=bad
4. Note the 400 HTTP response code
5. Go to http://localhost:8080/cgi-bin/koha/unapi?id=koha:biblionumber:1&format=bad
6. Note the XML response listing the available formats for that ID
7. Go to http://localhost:8080//cgi-bin/koha/unapi?id=koha:biblionumber:1
8. Note the XML response listing the available formats for that ID
9. Go to http://localhost:8080//cgi-bin/koha/unapi?format=mods
10. Note the 400 HTTP response code
11. Go to http://localhost:8080//cgi-bin/koha/unapi?id=koha:biblionumber:1&format=mods
12. Note the MODS format returned for biblionumber 1

Signed-off-by: Owen Leonard <oleonard@myacpl.org>
Signed-off-by: Baptiste Wojtkowski <baptiste.wojtkowski@biblibre.com>
Signed-off-by: Jacob O'Mara <Jacob.omara@openfifth.co.uk>
This commit is contained in:
David Cook 2026-03-10 04:00:24 +00:00 committed by Jacob O'Mara
parent 4ccfe35f20
commit 7302a4d8f2
No known key found for this signature in database
1 changed files with 17 additions and 5 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

22
opac/unapi
View File

@ -115,13 +115,22 @@ my $format_info = {
my $id = $cgi->param('id');
my $format = $cgi->param('format');
if ( not defined $format ) {
emit_formats( $id, $format_to_stylesheet_map, $format_info, $cgi );
} elsif ($id) {
my $biblionumber;
if ( $id && $id =~ /koha:biblionumber:(\d+)/ ) {
$biblionumber = $1;
} else {
$id = undef;
}
unless ( $format && $format_info->{$format} ) {
$format = undef;
}
if ( $id && $format ) {
# koha:biblionumber:0152018484
if ( $id =~ /koha:biblionumber:(\d+)/ ) {
my $biblionumber = $1;
if ($biblionumber) {
my $content;
@ -159,6 +168,9 @@ if ( not defined $format ) {
print $cgi->header( -status => '404 record not found' );
exit 0;
}
} elsif ( $id && not defined $format ) {
emit_formats( $id, $format_to_stylesheet_map, $format_info, $cgi );
} else {
# supplied a format but no id - caller is doing it wrong