gitea
/
Koha-clms
1
0
Fork 0
Code Issues Pull Requests Packages Projects Releases Wiki Activity

Bug 41261: RMaint patch for 25.05.x-security 

This change adds data validation to the "unapi" API endpoint.

Test plan:
0. Apply the patch
1. Go to http://localhost:8080/cgi-bin/koha/unapi
2. Note the 400 HTTP response code
3. Go to http://localhost:8080/cgi-bin/koha/unapi?id=bad
4. Note the 400 HTTP response code
5. Go to http://localhost:8080/cgi-bin/koha/unapi?id=koha:biblionumber:1&format=bad
6. Note the XML response listing the available formats for that ID
7. Go to http://localhost:8080//cgi-bin/koha/unapi?id=koha:biblionumber:1
8. Note the XML response listing the available formats for that ID
9. Go to http://localhost:8080//cgi-bin/koha/unapi?format=mods
10. Note the 400 HTTP response code
11. Go to http://localhost:8080//cgi-bin/koha/unapi?id=koha:biblionumber:1&format=mods
12. Note the MODS format returned for biblionumber 1

Signed-off-by: Owen Leonard <oleonard@myacpl.org>
Signed-off-by: Baptiste Wojtkowski <baptiste.wojtkowski@biblibre.com>
Signed-off-by: Laura Escamilla <laura.escamilla@bywatersolutions.com>
Signed-off-by: Lucas Gass <lucas@bywatersolutions.com>
This commit is contained in:
David Cook 2026-03-10 04:00:24 +00:00 committed by Lucas Gass
parent d72715f010
commit e66a8bb617
No known key found for this signature in database
GPG Key ID: 60B447398B0D36CA
1 changed files with 17 additions and 5 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

22
opac/unapi
View File

@ -106,13 +106,22 @@ my $format_info = {
my $id = $cgi->param('id');
my $format = $cgi->param('format');
if (not defined $format) {
emit_formats($id, $format_to_stylesheet_map, $format_info, $cgi);
} elsif ($id) {
my $biblionumber;
if ( $id && $id =~ /koha:biblionumber:(\d+)/ ) {
$biblionumber = $1;
} else {
$id = undef;
}
unless ( $format && $format_info->{$format} ) {
$format = undef;
}
if ( $id && $format ) {
# koha:biblionumber:0152018484
if ($id =~ /koha:biblionumber:(\d+)/) {
my $biblionumber = $1;
if ($biblionumber) {
my $content;
@ -146,6 +155,9 @@ if (not defined $format) {
print $cgi->header( -status => '404 record not found');
exit 0;
}
} elsif ( $id && not defined $format ) {
emit_formats( $id, $format_to_stylesheet_map, $format_info, $cgi );
} else {
# supplied a format but no id - caller is doing it wrong
print $cgi->header( -status => '400 bad request - if you specify format, must specify id');