Bug 3652: close XSS vulnerabilities on biblionumber and authid

[koha.git] / opac / opac-showmarc.pl

diff --git a/opac/opac-showmarc.pl b/opac/opac-showmarc.pl
index 2e0be75..f06d3cd 100755 (executable)
--- a/opac/opac-showmarc.pl
+++ b/opac/opac-showmarc.pl
@@ -27,8 +27,11 @@
 use strict;
 use warnings;
 
+use open OUT=> ":encoding(UTF-8)", ':std';
+
 # standard or CPAN modules used
 use CGI;
+use Encode;
 
 # Koha modules used
 use C4::Context;
@@ -41,6 +44,7 @@ use XML::LibXML;
 
 my $input       = new CGI;
 my $biblionumber = $input->param('id');
+$biblionumber   = int($biblionumber);
 my $importid   = $input->param('importid');
 my $view               = $input->param('viewas') || 'marc';
 
@@ -48,7 +52,7 @@ my ( $template, $loggedinuser, $cookie ) = get_template_and_user({
         template_name   => "opac-showmarc.tmpl",
         query           => $input,
         type            => "opac",
-        authnotrequired => 1,
+        authnotrequired => ( C4::Context->preference("OpacPublic") ? 1 : 0 ),
         debug           => 1,
 });
 
@@ -59,18 +63,19 @@ if ($importid) {
        $record = MARC::Record->new_from_usmarc($marc) ;
        if($view eq 'card') {
                $xmlrecord = $record->as_xml();
-       } 
+       }
 }
 
-
 if ($view eq 'card' || $view eq 'html') {
     $xmlrecord = GetXmlBiblio($biblionumber) unless $xmlrecord;
     my $xslfile;
+    my $themelang = '/' . C4::Context->preference("opacthemes") .  '/' . C4::Templates::_current_language();
+
     if ($view eq 'card'){
-       $xslfile = C4::Context->config('opachtdocs')."/prog/en/xslt/compact.xsl";
+        $xslfile = C4::Context->config('opachtdocs').$themelang."/xslt/compact.xsl";
     }
     else { # must be html
-       $xslfile = C4::Context->config('opachtdocs')."/prog/en/xslt/MARC21slim2OPACMARCdetail.xsl";     
+        $xslfile = C4::Context->config('opachtdocs').$themelang."/xslt/MARC21slim2OPACMARCdetail.xsl";
     }
     my $parser = XML::LibXML->new();
     my $xslt   = XML::LibXSLT->new();
@@ -79,8 +84,8 @@ if ($view eq 'card' || $view eq 'html') {
     my $stylesheet = $xslt->parse_stylesheet($style_doc);
     my $results = $stylesheet->transform($source);
     my $newxmlrecord = $stylesheet->output_string($results);
-    print $input->header(), $newxmlrecord;
-    exit;
+    $newxmlrecord = Encode::decode_utf8($newxmlrecord) unless utf8::is_utf8($newxmlrecord);
+    print $input->header(-charset => 'UTF-8'), $newxmlrecord;
 } else {
     $record =GetMarcBiblio($biblionumber) unless $record; 
     $template->param( MARC_FORMATTED => $record->as_formatted );