cadf5aea81
There are still some leaks, but it is not as a result
of the filter, but rather a result of poorly written
template files.
Bug fixing template files is beyond the scope of this
set of patches.
TEST PLAN
---------
1) Backup your DB
2) run the following SQL on your DB.
> UPDATE marc_subfield_structure set hidden=-8;
-- this should set EVERYTHING to hidden across the board.
3) In staff client, set OPACXSLTDetailsDisplay to blank
4) In OPAC, view any detail.
-- Normal view may mostly leak values still.
-- MARC view may leak values.
-- ISBD view may leak values.
5) In staff client, set OPACXSLTDetailsDisplay to default
6) In OPAC, view any detail.
-- same issues as step 4
-- 'View Plain' may leak too.
7) 'Save record' -> 'Dublin Core'
8) Apply this patch
9) run koha qa test tools
-- should be fine
10) prove -v t/db_dependent/Filter_MARC_ViewPolicy.t
-- should pass
-- this proves Koha/Filter/MARC/ViewPolicy.pm tweaks too
11) In OPAC, view any detail.
-- Normal view:
-- Material type comes from the LEADER field.
-- Lists this is on will still display
-- 'Tags from this library' will still display
-- Item information in table will still display
(THIS IS BEYOND SCOPE)
-- MARC view:
-- Record number is leaked
(THIS IS BEYOND SCOPE)
-- 'View plain' leaks LEADER field.
-- ISBD view may leak field headings, but not values.
(THIS IS BEYOND SCOPE)
12) In staff client, set OPACXSLTDetailsDisplay to blank
13) In OPAC, view any detail.
-- same kind of output as step 10
14) 'Save record' -> BIBTEXT
-- Should be next to nothing leaked.
15) 'Save record' -> Dublin Core
-- Should be the same or less leaked between the two versions.
-- (XML FILTERING IS BEYOND SCOPE)
16) In the staff client, go view the same record.
-- it should be mostly hidden in ISBD View.
17) run the following SQL on your DB.
> UPDATE marc_subfield_structure set hidden=1;
-- this should set EVERYTHING to hidden in OPAC, but not
the STAFF across the board.
18) Refresh the staff ISBD page
-- values should reappear.
19) View the ISBD details in the OPAC
-- values should still be hidden.
20) Check out the OPAC Cart and List
-- while the intermediate pages may still leak
the download links should leak very minimally.
-- (CARTS AND LISTS ARE BEYOND SCOPE, THOUGH
THE INTRANET ISBD AND SOME CART/LIST STUFF
WERE FIXED BECAUSE OF THE GetISBDView REFACTOR)
Expectations:
Before Patch - all the OPAC Detail pages will display things
After Patch - all the OPAC Detail pages will display much less,
and hopefully nothing (though there are known limits).
the ISBD detail page in the Staff client will be
filtered as well based on STAFF settings.
The saving/exporting should generate nearly empty
files.
Signed-off-by: Nick Clemens <nick@bywatersolutions.com>
Signed-off-by: Tomas Cohen Arazi <tomascohen@theke.io>
Signed-off-by: Kyle M Hall <kyle@bywatersolutions.com>
114 lines
3.3 KiB
Perl
Executable file
114 lines
3.3 KiB
Perl
Executable file
#!/usr/bin/perl
|
|
|
|
# Copyright 2009 BibLibre
|
|
#
|
|
# This file is part of Koha.
|
|
#
|
|
# Koha is free software; you can redistribute it and/or modify it
|
|
# under the terms of the GNU General Public License as published by
|
|
# the Free Software Foundation; either version 3 of the License, or
|
|
# (at your option) any later version.
|
|
#
|
|
# Koha is distributed in the hope that it will be useful, but
|
|
# WITHOUT ANY WARRANTY; without even the implied warranty of
|
|
# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
|
|
# GNU General Public License for more details.
|
|
#
|
|
# You should have received a copy of the GNU General Public License
|
|
# along with Koha; if not, see <http://www.gnu.org/licenses>.
|
|
|
|
use Modern::Perl;
|
|
|
|
use CGI qw ( -utf8 );
|
|
use Encode qw(encode);
|
|
|
|
use C4::Auth;
|
|
use C4::Biblio;
|
|
use C4::Items;
|
|
use C4::Output;
|
|
use C4::Record;
|
|
use C4::Ris;
|
|
use Koha::CsvProfiles;
|
|
use Koha::RecordProcessor;
|
|
|
|
use utf8;
|
|
my $query = new CGI;
|
|
|
|
my ( $template, $borrowernumber, $cookie ) = get_template_and_user (
|
|
{
|
|
template_name => "opac-downloadcart.tt",
|
|
query => $query,
|
|
type => "opac",
|
|
authnotrequired => ( C4::Context->preference("OpacPublic") ? 1 : 0 ),
|
|
}
|
|
);
|
|
|
|
my $bib_list = $query->param('bib_list');
|
|
my $format = $query->param('format');
|
|
my $dbh = C4::Context->dbh;
|
|
|
|
if ($bib_list && $format) {
|
|
|
|
my @bibs = split( /\//, $bib_list );
|
|
|
|
my $marcflavour = C4::Context->preference('marcflavour');
|
|
my $output;
|
|
my $extension;
|
|
my $type;
|
|
|
|
# CSV
|
|
if ($format =~ /^\d+$/) {
|
|
|
|
$output = marc2csv(\@bibs, $format);
|
|
|
|
# Other formats
|
|
} else {
|
|
my $record_processor = Koha::RecordProcessor->new({
|
|
filters => 'ViewPolicy'
|
|
});
|
|
foreach my $biblio (@bibs) {
|
|
|
|
my $record_unfiltered = GetMarcBiblio($biblio, 1);
|
|
my $record_filtered = $record_unfiltered->clone();
|
|
my $record =
|
|
$record_processor->process($record_filtered);
|
|
|
|
next unless $record;
|
|
|
|
if ($format eq 'iso2709') {
|
|
$output .= $record->as_usmarc();
|
|
}
|
|
elsif ($format eq 'ris') {
|
|
$output .= marc2ris($record);
|
|
}
|
|
elsif ($format eq 'bibtex') {
|
|
$output .= marc2bibtex($record, $biblio);
|
|
}
|
|
elsif ( $format eq 'isbd' ) {
|
|
my $framework = GetFrameworkCode( $biblio );
|
|
$output .= GetISBDView({
|
|
'record' => $record,
|
|
'template' => 'opac',
|
|
'framework' => $framework,
|
|
});
|
|
$extension = "txt";
|
|
$type = "text/plain";
|
|
}
|
|
}
|
|
}
|
|
|
|
# If it was a CSV export we change the format after the export so the file extension is fine
|
|
$format = "csv" if ($format =~ m/^\d+$/);
|
|
|
|
print $query->header(
|
|
-type => ($type) ? $type : 'application/octet-stream',
|
|
-'Content-Transfer-Encoding' => 'binary',
|
|
-attachment => ($extension) ? "cart.$format.$extension" : "cart.$format"
|
|
);
|
|
print $output;
|
|
|
|
} else {
|
|
$template->param(csv_profiles => [ Koha::CsvProfiles->search({ type => 'marc' }) ]);
|
|
$template->param(bib_list => $bib_list);
|
|
output_html_with_http_headers $query, $cookie, $template->output;
|
|
}
|