The opac-export.pl script had a number of XSS vulnerabilities relating
to its error handling.
To test:
1) Go to /cgi-bin/koha/opac-export.pl?op=export&bib=2&format=<h2>evil</h2>
(substituting a valid biblionumber for the '2')
2) Notice that "evil" is rendered as an h2 heading.
3) Apply patch.
4) Notice that you now see the h2 tags, and they are not rendered by
the browser.
Signed-off-by: Chris Cormack <chrisc@catalyst.net.nz>
Signed-off-by: Paul Poulain <paul.poulain@biblibre.com>
Add an option for marcstd to the opac-export.pl and catalogue/export.pl
scripts. This new format removes all 9XX, X9X, XX9 fields and subfield $9
(with the exception of 490 in flavours of MARC other than UNIMARC). The work is
done in C4::Record::marc2marc.
This patch adds the new export option 'marcstd' for exporting MARC
records without 9xx, x9x and xx9 fields and subfields to the staff
detail page.
Testing plan:
1. Export a record in "MARC (Unicode/UTF-8)" format as a control
2. In the OPAC, run the following jQuery to add the marcstd option to the UI:
> $("#export #format").append("<option value='marcstd'>MARC (no 9xx)</option>");
3. Export the same record in "MARC (no 9xx)" format
4. Compare the two, noticing that any subfield $9 or fields including 9 (other
than 490 in flavours of MARC other than UNIMARC) have been removed
Signed-off-by: Marcel de Rooy <m.de.rooy@rijksmuseum.nl>
Works as advertised now.
Signed-off-by: Katrin Fischer <Katrin.Fischer.83@web.de>
Signed-off-by: Jared Camins-Esakov <jcamins@cpbibliography.com>
This patch squashes both the original patch and Katrin's follow-up adding
marcstd as an export option on the staff client.
Feb 13, 2012 (marcel): Amended this patch to resolved two definitions of $error in catalogue/export script.
Prior to this patch, RIS export was producing
effectively empty output.
Signed-off-by: Steven Callender <stevecallender@esilibrary.com>
Signed-off-by: Galen Charlton <gmc@esilibrary.com>
Signed-off-by: Chris Cormack <chrisc@catalyst.net.nz>
Added check on returned marc. If record does not exist, generate 404. (Prevents 500 errors by Googlebot on deleted records.)
Fixed typo, whitespace. Removed if on op=export. Added check on format.
Signed-off-by: Owen Leonard <oleonard@myacpl.org>
Signed-off-by: Ian Walls <ian.walls@bywatersolutions.com>
Signed-off-by: Chris Cormack <chrisc@catalyst.net.nz>
- The following export pages used to embed items when exporting,
this was no longer the case, so they were fixed :
Intranet :
- basket/downloadcart.pl,
- virtualshelves/downloadshelf.pl
- catalogue/export.pl
Opac :
- opac/opac-downloadcart.pl
- opac/opac-downloadshelf.pl
- opac/opac-export.pl
- Notes :
- GetMarcBiblio used to embed items data, this was no longer the case,
so an optional parameter was added to choose if items should be embedded or not.
This way, previous work on this bug is not broken, and this is a pretty usefull
feature, imho.
- An optional parameter has been added to SetUTF8Flag, to be able to use NFD during
normalization. This was required to make Unicode/UTF-8 export work again.
Signed-off-by: Claire Hernandez <claire.hernandez@biblibre.com>
Signed-off-by: Chris Cormack <chrisc@catalyst.net.nz>
Most Perl scripts (as opposed to modules) do
not need to require Exporter.
No user-visible or documentation changes.
Signed-off-by: Galen Charlton <galen.charlton@liblime.com>
HTML::Template is no more used, some were remaining,
fixing the "use ...;" to H::T::Pro only
Signed-off-by: Chris Cormack <crc@liblime.com>
Signed-off-by: Joshua Ferraro <jmf@liblime.com>
