gitea
/
Koha-clms
1
0
Fork 0
Code Issues Pull Requests Packages Projects Releases Wiki Activity

Bug 5087: Add server-side check 

If a user to access a CSV profile that is not available at the OPAC we
should redirect to 404.

It will also handle undefined csv_profiles

For instance:
kohadev.mydnsname.org:8080/cgi-bin/koha/opac-downloadshelf.pl?shelfnumber=1&format=3
kohadev.mydnsname.org:8080/cgi-bin/koha/opac-downloadcart.pl?bib_list=1/2/&format=3

Signed-off-by: Jonathan Druart <jonathan.druart@bugs.koha-community.org>
This commit is contained in:
Jonathan Druart 2020-07-23 11:15:24 +02:00
parent db15f4af8d
commit c2d45ac0f4
2 changed files with 13 additions and 0 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

6
opac/opac-downloadcart.pl
View File

@ -66,6 +66,12 @@ if ($bib_list && $format) {
# CSV
if ($format =~ /^\d+$/) {
my $csv_profile = Koha::CsvProfiles->find($format);
if ( not $csv_profile or $csv_profile->staff_only ) {
print $query->redirect('/cgi-bin/koha/errors/404.pl');
exit;
}
$output = marc2csv(\@bibs, $format);
# Other formats

7
opac/opac-downloadshelf.pl
View File

@ -75,6 +75,13 @@ if ( $shelf and $shelf->can_be_viewed( $borrowernumber ) ) {
# CSV
if ($format =~ /^\d+$/) {
my $csv_profile = Koha::CsvProfiles->find($format);
if ( not $csv_profile or $csv_profile->staff_only ) {
print $query->redirect('/cgi-bin/koha/errors/404.pl');
exit;
}
my @biblios;
while ( my $content = $contents->next ) {
push @biblios, $content->biblionumber;