Bug 20083: Information disclosure when (mis)using the MARC Preview feature

[koha.git] / catalogue / showmarc.pl

diff --git a/catalogue/showmarc.pl b/catalogue/showmarc.pl
index 6239b71..13bde06 100755 (executable)
--- a/catalogue/showmarc.pl
+++ b/catalogue/showmarc.pl
@@ -1,82 +1,85 @@
 #!/usr/bin/perl
 
-# $Id: showmarc.pl,v 1.1.2.1 2007/06/18 21:57:23 rangi Exp $
-
-
-# Koha library project  www.koha.org
-
-# Licensed under the GPL
+# Koha library project  www.koha-community.org
 
 # Copyright 2007 Liblime
+# Parts copyright 2010 BibLibre
 #
 # This file is part of Koha.
 #
 # Koha is free software; you can redistribute it and/or modify it under the
 # terms of the GNU General Public License as published by the Free Software
-# Foundation; either version 2 of the License, or (at your option) any later
+# Foundation; either version 3 of the License, or (at your option) any later
 # version.
 #
 # Koha is distributed in the hope that it will be useful, but WITHOUT ANY
 # WARRANTY; without even the implied warranty of MERCHANTABILITY or FITNESS FOR
 # A PARTICULAR PURPOSE.  See the GNU General Public License for more details.
 #
-# You should have received a copy of the GNU General Public License along with
-# Koha; if not, write to the Free Software Foundation, Inc., 59 Temple Place,
-# Suite 330, Boston, MA  02111-1307 USA
+# You should have received a copy of the GNU General Public License along
+# with Koha; if not, write to the Free Software Foundation, Inc.,
+# 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301 USA.
 
-use strict;
+use Modern::Perl;
 
 # standard or CPAN modules used
-use CGI qw(:standard);
+use CGI qw(:standard -utf8);
 use DBI;
+use Encode;
 
 # Koha modules used
 use C4::Context;
 use C4::Output;
 use C4::Auth;
 use C4::Biblio;
-use XML::LibXSLT;
-use XML::LibXML;
-
-my $userid = $ENV{'REMOTE_USER'};
-
-my $input       = new CGI;
-my $biblionumber = $input->param('id');
-my $view               = $input->param('viewas');
+use C4::ImportBatch;
+use C4::XSLT ();
 
+my $input= new CGI;
 my ( $template, $loggedinuser, $cookie ) = get_template_and_user(
-    {
-        template_name   => "catalogue/showmarc.tmpl",
-        query           => $input,
-        type            => "intranet",
-        authnotrequired => 0,
-        flagsrequired   => { acquisition => 1  },
-        debug           => 1,
-    }
+  {
+    template_name   => "catalogue/showmarc.tt",
+    query           => $input,
+    type            => "intranet",
+    authnotrequired => 0,
+    flagsrequired   => { catalogue => 1  },
+    debug           => 1,
+  }
 );
 
-$template->param( SCRIPT_NAME => $ENV{'SCRIPT_NAME'}, );
-if($view eq 'card') {
-my $xmlrecord = GetXmlBiblio($biblionumber);
-
-my $xslfile = C4::Context->config('intranetdir')."/koha-tmpl/intranet-tmpl/prog/en/xslt/compact.xsl";
-my $parser = XML::LibXML->new();
-my $xslt = XML::LibXSLT->new();
-my $source = $parser->parse_string($xmlrecord);
-my $style_doc = $parser->parse_file($xslfile);
-my $stylesheet = $xslt->parse_stylesheet($style_doc);
-my $results = $stylesheet->transform($source);
-my $newxmlrecord = $stylesheet->output_string($results);
-#warn $newxmlrecord;
-print "Content-type: text/html\n\n";
-print $newxmlrecord;
-
-} else {
+my $biblionumber= $input->param('id');
+my $importid= $input->param('importid');
+my $view= $input->param('viewas')||'';
 
-my $record =GetMarcBiblio($biblionumber); 
-
-my $formatted = $record->as_formatted;
-$template->param( MARC_FORMATTED => $formatted );
+my $record;
+if ($importid) {
+    $record = C4::ImportBatch::GetRecordFromImportBiblio( $importid, 'embed_items' );
+}
+else {
+    $record =GetMarcBiblio({ biblionumber => $biblionumber });
+}
+if(!ref $record) {
+    print $input->redirect("/cgi-bin/koha/errors/404.pl");
+    exit;
+}
 
-output_html_with_http_headers $input, $cookie, $template->output;
+if($view eq 'card' || $view eq 'html') {
+    my $xml = $importid ? $record->as_xml(): GetXmlBiblio($biblionumber);
+    my $xsl;
+    if ( $view eq 'card' ){
+        $xsl = C4::Context->preference('marcflavour') eq 'UNIMARC'
+              ? 'UNIMARC_compact.xsl' : 'compact.xsl';
+    }
+    else {
+        $xsl = 'plainMARC.xsl';
+    }
+    my $htdocs = C4::Context->config('intrahtdocs');
+    my ($theme, $lang) = C4::Templates::themelanguage($htdocs, $xsl, 'intranet', $input);
+    $xsl = "$htdocs/$theme/$lang/xslt/$xsl";
+    print $input->header(-charset => 'UTF-8'),
+          Encode::encode_utf8(C4::XSLT::engine->transform($xml, $xsl));
+}
+else {
+    $template->param( MARC_FORMATTED => $record->as_formatted );
+    output_html_with_http_headers $input, $cookie, $template->output;
 }