gitea
/
Koha-clms
1
0
Fork 0
Code Issues Pull Requests Packages Projects Releases Wiki Activity
Koha-clms/opac
History
Tomas Cohen Arazi 021a9bf216 Bug 25009: Avoid leakages in opac-showmarc.pl 
This patch cleans opac-showmarc.pl so it doesn't allow retrieving
records from import batches without requiring any permissions in the
OPAC.

it does so by just removing the code portion that does that.

It also cleans the record fetch operation and how the record processor
is initialized to it actually works :-D

To test:
1. Perform a successful Z39.50 search in cataloguing (this fetches 20
   records usually)
2. Query your DB for a valid import_record_id:
  $ koha-mysql kohadev
  > SELECT * FROM import_records LIMIT 1;
3. Notice some of the MARCXML details (title, author, etc), and the
   import_record_id
4. Point your browser to the opac-showmarc.pl URL like this:
   http://kohadev.mydnsname.org:8080/cgi-bin/koha/opac-showmarc.pl?importid=20
=> FAIL: You get the record! (Bonus: no field/subfield takes place)
5. Hide some obvious subfield on the framework for a known (to you)
   biblionumber
6. Point your browser to:
   http://kohadev.mydnsname.org:8080/cgi-bin/koha/opac-showmarc.pl?id=<biblionumber_here>
=> FAIL: No filtering takes place
7. Apply this patch
8. Repeat 4
=> SUCCESS: You get an error because you did a bad request (no id param)
9. Repeat 6
=> SUCCESS: Subfield filtering actually works!
10. Sign off :-D

Signed-off-by: Tomas Cohen Arazi <tomascohen@theke.io>

Signed-off-by: Jonathan Druart <jonathan.druart@bugs.koha-community.org>

Signed-off-by: Katrin Fischer <katrin.fischer.83@web.de>

Signed-off-by: Joy Nelson <joy@bywatersolutions.com>
(cherry picked from commit d3ba9dc0fe)

Signed-off-by: Lucas Gass <lucas@bywatersolutions.com>
 		2020-04-22 19:58:52 +00:00
..
clubs Bug 22542: Force back button to display personal data 2019-05-02 13:43:48 +00:00
errors Bug 19991: use Modern::Perl in OPAC perl scripts 2018-08-30 13:40:32 +00:00
external/overdrive bug_16034 Koha::ExternalContent::OverDrive - a wrapper around WebService::ILS::Overdrive::Patron 2017-02-21 19:58:20 +00:00
rss adding file just for creating the rss directory 2007-08-02 08:50:43 +00:00
sci Bug 22739: Test SelfCheckInTimeout <> 0, not just defined 2019-04-25 10:05:00 +00:00
sco Bug 22943: (QA follow-up) Add new cases 2020-04-10 16:36:59 +00:00
svc Bug 22542: Force back button to display personal data 2019-05-02 13:43:48 +00:00
ilsdi.pl Bug 23156: Add pagination to checkouts in ILS-DI GetPatronInfo service 2019-07-25 13:31:30 +02:00
maintenance.pl Bug 17989: Include full path logic in _get_template_file 2017-11-01 13:10:17 -03:00
oai.pl Bug 14939: Modularize OAI Server existing classes 2015-12-31 15:15:05 +00:00
opac-ISBDdetail.pl Bug 23248: (QA follow-up) Consolidate 404s 2019-07-25 15:41:01 +02:00
opac-MARCdetail.pl Bug 5103: Refactor the code to avoid repetition 2020-04-10 15:51:50 +00:00
opac-account-pay-paypal-return.pl Bug 22600: Add 'interface' to accountlines 2019-04-10 19:43:11 +00:00
opac-account-pay-return.pl Bug 19173: Make OPAC online payments pluggable 2017-09-19 14:15:52 -03:00
opac-account-pay.pl Bug 22542: Force back button to display personal data 2019-05-02 13:43:48 +00:00
opac-account.pl Bug 23115: Tweak display of totals on 'Fines and charges' page 2019-07-24 08:57:45 +02:00
opac-addbybiblionumber.pl Bug 22542: Force back button to display personal data 2019-05-02 13:43:48 +00:00
opac-alert-subscribe.pl Bug 22542: Force back button to display personal data 2019-05-02 13:43:48 +00:00
opac-article-request-cancel.pl Bug 22068: (QA follow-up) Return meaningful error codes 2019-04-10 19:58:31 +00:00
opac-authorities-home.pl Bug 19991: use Modern::Perl in OPAC perl scripts 2018-08-30 13:40:32 +00:00
opac-authoritiesdetail.pl Bug 21871: (QA follow-up) C4::Biblio qw(GetMarcUrls) 2019-01-30 12:12:21 +00:00
opac-basket.pl Bug 23530: Fix cart showing only hidden items 2019-09-09 10:17:35 +02:00
opac-blocked.pl Bug 11944: use CGI( -utf8 ) everywhere 2015-01-13 13:07:21 -03:00
opac-browser.pl Bug 19991: use Modern::Perl in OPAC perl scripts 2018-08-30 13:40:32 +00:00
opac-changelanguage.pl Bug 21299: (QA follow-up) Rename module and subroutine 2018-11-07 21:52:17 +00:00
opac-course-details.pl Bug 9978: Replace license header with the correct license (GPLv3+) 2015-04-20 09:59:38 -03:00
opac-course-reserves.pl Bug 9978: Replace license header with the correct license (GPLv3+) 2015-04-20 09:59:38 -03:00
opac-detail.pl Bug 14419: [19.05.x] (squashed) Expanding facets (Show more) performs a new search 2020-01-10 20:41:36 +00:00
opac-discharge.pl Bug 23723: using exit inside eval to stop sending output to browser doesn't work under plack 2019-11-08 15:23:58 +01:00
opac-downloadcart.pl Bug 14385: Squash of a lot of patches rebased 2018-11-02 10:33:12 +00:00
opac-downloadshelf.pl Bug 14385: Squash of a lot of patches rebased 2018-11-02 10:33:12 +00:00
opac-export.pl Bug 22075: Fix encoding problem with RIS export in OPAC 2019-04-11 11:47:17 +00:00
opac-ics.pl Bug 19991: use Modern::Perl in OPAC perl scripts 2018-08-30 13:40:32 +00:00
opac-idref.pl Bug 19640: fix OPAC IdRef webservice display 2017-12-07 09:37:09 -03:00
opac-illrequests.pl Bug 22542: Force back button to display personal data 2019-05-02 13:43:48 +00:00
opac-image.pl Bug 19991: use Modern::Perl in OPAC perl scripts 2018-08-30 13:40:32 +00:00
opac-imageviewer.pl Bug 19991: use Modern::Perl in OPAC perl scripts 2018-08-30 13:40:32 +00:00
opac-issue-note.pl Bug 17698: (RM follow-up) Pass lang variable so letter can be translated 2019-05-23 15:43:54 +00:00
opac-main.pl Bug 22318: Example implementation: OpacNavRight system preference 2019-04-18 10:47:03 +00:00
opac-memberentry.pl Bug 24892: Resolve uninitialized warns from opac-memberentry 2020-04-13 19:54:32 +00:00
opac-messaging.pl Bug 24673: Add CSRF token support to opac-messaging.pl 2020-03-24 20:50:30 +00:00
opac-modrequest-suspend.pl Bug 19991: use Modern::Perl in OPAC perl scripts 2018-08-30 13:40:32 +00:00
opac-modrequest.pl Bug 19991: use Modern::Perl in OPAC perl scripts 2018-08-30 13:40:32 +00:00
opac-mymessages.pl Bug 19991: use Modern::Perl in OPAC perl scripts 2018-08-30 13:40:32 +00:00
opac-news-rss.pl Bug 16447: Remove occurrence of the borrow permission which does no longer exist 2016-05-05 21:28:14 +00:00
opac-overdrive-search.pl Bug 19991: use Modern::Perl in OPAC perl scripts 2018-08-30 13:40:32 +00:00
opac-passwd.pl Bug 10796: Use $category->effective_change_password in the OPAC 2019-04-12 02:32:07 +00:00
opac-password-recovery.pl Bug 21533: Do not allow password recovery for administrative locked patrons 2019-05-10 12:19:13 +00:00
opac-patron-consent.pl Bug 20819: Add your consents tab to opac-user 2018-09-20 13:45:26 +00:00
opac-patron-image.pl Bug 19991: use Modern::Perl in OPAC perl scripts 2018-08-30 13:40:32 +00:00
opac-privacy.pl Bug 19991: use Modern::Perl in OPAC perl scripts 2018-08-30 13:40:32 +00:00
opac-ratings-ajax.pl Bug 19991: use Modern::Perl in OPAC perl scripts 2018-08-30 13:40:32 +00:00
opac-ratings.pl Bug 19991: use Modern::Perl in OPAC perl scripts 2018-08-30 13:40:32 +00:00
opac-readingrecord.pl Bug 11969: Show patrons star rating on their reading history 2019-04-17 12:25:25 +00:00
opac-recordedbooks-search.pl Bug 17602: Fix few minor QA issues 2018-10-01 13:56:56 +00:00
opac-registration-verify.pl Bug 23253: Fix OpacNavRight for self reg by email 2019-08-28 15:24:30 +02:00
opac-renew.pl Bug 21206: Replace C4::Items::GetItem 2019-02-26 13:24:07 +00:00
opac-request-article.pl Bug 22542: Force back button to display personal data 2019-05-02 13:43:48 +00:00
opac-reserve.pl Bug 23467: Exit after output_html - opac-reserve.pl 2019-11-15 11:04:34 +01:00
opac-restrictedpage.pl Bug 16447: Remove occurrence of the borrow permission which does no longer exist 2016-05-05 21:28:14 +00:00
opac-retrieve-file.pl Bug 17501: Move getCategories and httpheaders from Upload.pm 2017-01-20 14:20:05 +00:00
opac-review.pl Bug 21986: Do not escape quotation marks when cataloguing 2018-12-14 13:33:28 +00:00
opac-routing-lists.pl Bug 21137: Replace BORROWER_INFO with logged_in_user 2018-08-14 12:43:12 +00:00
opac-search-history.pl Bug 12497: Fix OPAC search history reachable by URL even when disabled 2017-12-07 10:09:52 -03:00
opac-search.pl Bug 24506: Multibranch limit does not work with ElasticSearch 2020-03-09 20:34:54 +00:00
opac-sendbasket.pl Bug 22542: Force back button to display personal data 2019-05-02 13:43:48 +00:00
opac-sendshelf.pl Bug 22542: Force back button to display personal data 2019-05-02 13:43:48 +00:00
opac-serial-issues.pl Bug 23126: Display multi-line entries in subscrpitions correctly 2019-07-25 13:36:46 +02:00
opac-shareshelf.pl Bug 22542: Force back button to display personal data 2019-05-02 13:43:48 +00:00
opac-shelves.pl Bug 17526: Change grep to deal with malformed sortfield 2019-06-20 14:59:09 +02:00
opac-showmarc.pl Bug 25009: Avoid leakages in opac-showmarc.pl 2020-04-22 19:58:52 +00:00
opac-showreviews.pl Bug 19991: use Modern::Perl in OPAC perl scripts 2018-08-30 13:40:32 +00:00
opac-suggestions.pl Bug 22657: (QA follow-up) Restore previous version of regex 2019-05-15 16:58:50 +00:00
opac-tags.pl Bug 22420: Remove wrong calculation on approved tags 2019-05-07 10:48:23 +00:00
opac-tags_subject.pl Bug 19991: use Modern::Perl in OPAC perl scripts 2018-08-30 13:40:32 +00:00
opac-topissues.pl Bug 19991: use Modern::Perl in OPAC perl scripts 2018-08-30 13:40:32 +00:00
opac-user.pl Bug 22521: Update UI to use accountlines.status 2019-04-17 16:49:36 +00:00
tracklinks.pl Bug 23836: exit after output_error 2019-11-22 10:35:06 +00:00
unapi Bug 19991: use Modern::Perl in OPAC perl scripts 2018-08-30 13:40:32 +00:00