From 32e5c736e75277282e26212cbe4a56cff5df09fe Mon Sep 17 00:00:00 2001
From: David Cook <dcook@prosentient.com.au>
Date: Tue, 10 Mar 2026 04:00:24 +0000
Subject: [PATCH] Bug 41261: Valid inputs to unapi

This change adds data validation to the "unapi" API endpoint.

Test plan:
0. Apply the patch
1. Go to http://localhost:8080/cgi-bin/koha/unapi
2. Note the 400 HTTP response code
3. Go to http://localhost:8080/cgi-bin/koha/unapi?id=bad
4. Note the 400 HTTP response code
5. Go to http://localhost:8080/cgi-bin/koha/unapi?id=koha:biblionumber:1&format=bad
6. Note the XML response listing the available formats for that ID
7. Go to http://localhost:8080//cgi-bin/koha/unapi?id=koha:biblionumber:1
8. Note the XML response listing the available formats for that ID
9. Go to http://localhost:8080//cgi-bin/koha/unapi?format=mods
10. Note the 400 HTTP response code
11. Go to http://localhost:8080//cgi-bin/koha/unapi?id=koha:biblionumber:1&format=mods
12. Note the MODS format returned for biblionumber 1

Signed-off-by: Owen Leonard <oleonard@myacpl.org>
Signed-off-by: Baptiste Wojtkowski <baptiste.wojtkowski@biblibre.com>
Signed-off-by: Lucas Gass <lucas@bywatersolutions.com>
---
 opac/unapi | 22 +++++++++++++++++-----
 1 file changed, 17 insertions(+), 5 deletions(-)

diff --git a/opac/unapi b/opac/unapi
index 9a24e13006..83209e5eff 100755
--- a/opac/unapi
+++ b/opac/unapi
@@ -115,13 +115,22 @@ my $format_info = {
 my $id     = $cgi->param('id');
 my $format = $cgi->param('format');
 
-if ( not defined $format ) {
-    emit_formats( $id, $format_to_stylesheet_map, $format_info, $cgi );
-} elsif ($id) {
+my $biblionumber;
+
+if ( $id && $id =~ /koha:biblionumber:(\d+)/ ) {
+    $biblionumber = $1;
+} else {
+    $id = undef;
+}
+
+unless ( $format && $format_info->{$format} ) {
+    $format = undef;
+}
+
+if ( $id && $format ) {
 
     # koha:biblionumber:0152018484
-    if ( $id =~ /koha:biblionumber:(\d+)/ ) {
-        my $biblionumber = $1;
+    if ($biblionumber) {
 
         my $content;
 
@@ -159,6 +168,9 @@ if ( not defined $format ) {
         print $cgi->header( -status => '404 record not found' );
         exit 0;
     }
+} elsif ( $id && not defined $format ) {
+    emit_formats( $id, $format_to_stylesheet_map, $format_info, $cgi );
+
 } else {
 
     # supplied a format but no id - caller is doing it wrong