Bug 20083: Information disclosure when (mis)using the MARC Preview feature

[koha.git] / catalogue / showmarc.pl

diff --git a/catalogue/showmarc.pl b/catalogue/showmarc.pl
index 1c453c4..13bde06 100755 (executable)
--- a/catalogue/showmarc.pl
+++ b/catalogue/showmarc.pl
@@ -9,7 +9,7 @@
 #
 # Koha is free software; you can redistribute it and/or modify it under the
 # terms of the GNU General Public License as published by the Free Software
-# Foundation; either version 2 of the License, or (at your option) any later
+# Foundation; either version 3 of the License, or (at your option) any later
 # version.
 #
 # Koha is distributed in the hope that it will be useful, but WITHOUT ANY
@@ -20,11 +20,10 @@
 # with Koha; if not, write to the Free Software Foundation, Inc.,
 # 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301 USA.
 
-use strict;
-use warnings;
+use Modern::Perl;
 
 # standard or CPAN modules used
-use CGI qw(:standard);
+use CGI qw(:standard -utf8);
 use DBI;
 use Encode;
 
@@ -34,48 +33,53 @@ use C4::Output;
 use C4::Auth;
 use C4::Biblio;
 use C4::ImportBatch;
-use XML::LibXSLT;
-use XML::LibXML;
+use C4::XSLT ();
 
 my $input= new CGI;
+my ( $template, $loggedinuser, $cookie ) = get_template_and_user(
+  {
+    template_name   => "catalogue/showmarc.tt",
+    query           => $input,
+    type            => "intranet",
+    authnotrequired => 0,
+    flagsrequired   => { catalogue => 1  },
+    debug           => 1,
+  }
+);
+
 my $biblionumber= $input->param('id');
 my $importid= $input->param('importid');
 my $view= $input->param('viewas')||'';
 
 my $record;
 if ($importid) {
-    my ($marc) = GetImportRecordMarc($importid);
-    $record = MARC::Record->new_from_usmarc($marc);
+    $record = C4::ImportBatch::GetRecordFromImportBiblio( $importid, 'embed_items' );
 }
 else {
-    $record =GetMarcBiblio($biblionumber);
+    $record =GetMarcBiblio({ biblionumber => $biblionumber });
+}
+if(!ref $record) {
+    print $input->redirect("/cgi-bin/koha/errors/404.pl");
+    exit;
 }
 
-if($view eq 'card') {
-    my $themelang = '/' . C4::Context->preference("opacthemes") .  '/' . C4::Templates::_current_language();
-    my $xmlrecord= $importid? $record->as_xml(): GetXmlBiblio($biblionumber);
-    my $xslfile =
-      C4::Context->config('intrahtdocs') . $themelang . "/xslt/compact.xsl";
-    my $parser       = XML::LibXML->new();
-    my $xslt         = XML::LibXSLT->new();
-    my $source       = $parser->parse_string($xmlrecord);
-    my $style_doc    = $parser->parse_file($xslfile);
-    my $stylesheet   = $xslt->parse_stylesheet($style_doc);
-    my $results      = $stylesheet->transform($source);
-    my $newxmlrecord = $stylesheet->output_string($results);
-    print $input->header(-charset => 'UTF-8'), Encode::encode_utf8($newxmlrecord);
+if($view eq 'card' || $view eq 'html') {
+    my $xml = $importid ? $record->as_xml(): GetXmlBiblio($biblionumber);
+    my $xsl;
+    if ( $view eq 'card' ){
+        $xsl = C4::Context->preference('marcflavour') eq 'UNIMARC'
+              ? 'UNIMARC_compact.xsl' : 'compact.xsl';
+    }
+    else {
+        $xsl = 'plainMARC.xsl';
+    }
+    my $htdocs = C4::Context->config('intrahtdocs');
+    my ($theme, $lang) = C4::Templates::themelanguage($htdocs, $xsl, 'intranet', $input);
+    $xsl = "$htdocs/$theme/$lang/xslt/$xsl";
+    print $input->header(-charset => 'UTF-8'),
+          Encode::encode_utf8(C4::XSLT::engine->transform($xml, $xsl));
 }
 else {
-    my ( $template, $loggedinuser, $cookie ) = get_template_and_user(
-      {
-        template_name   => "catalogue/showmarc.tmpl",
-        query           => $input,
-        type            => "intranet",
-        authnotrequired => 0,
-        flagsrequired   => { catalogue => 1  },
-        debug           => 1,
-      }
-    );
     $template->param( MARC_FORMATTED => $record->as_formatted );
     output_html_with_http_headers $input, $cookie, $template->output;
 }