[Bug 30803] New: output_error should not assume a 404 status
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=30803 Bug ID: 30803 Summary: output_error should not assume a 404 status Change sponsored?: --- Product: Koha Version: master Hardware: All OS: All Status: NEW Severity: normal Priority: P5 - low Component: Architecture, internals, and plumbing Assignee: koha-bugs@lists.koha-community.org Reporter: m.de.rooy@rijksmuseum.nl QA Contact: testopia@bugs.koha-community.org See comments on bug 30261.
There is a fundamental flaw in output_error: output_with_http_headers $query, $cookie, $template->output, 'html', '404 Not Found'; Although we pass $error, it always outputs a 404. I tried sending a 403, and it does not work!
The 404 from output_error is caught by Plack middleware and it will output the 404 error document. In this case the OPAC 404 error document!
-- You are receiving this mail because: You are watching all bug changes. You are the assignee for the bug.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=30803 Marcel de Rooy <m.de.rooy@rijksmuseum.nl> changed: What |Removed |Added ---------------------------------------------------------------------------- CC| |dcook@prosentient.com.au, | |jonathan.druart+koha@gmail. | |com -- You are receiving this mail because: You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=30803 Marcel de Rooy <m.de.rooy@rijksmuseum.nl> changed: What |Removed |Added ---------------------------------------------------------------------------- See Also| |https://bugs.koha-community | |.org/bugzilla3/show_bug.cgi | |?id=30261 -- You are receiving this mail because: You are watching all bug changes. You are the assignee for the bug.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=30803 Jonathan Druart <jonathan.druart+koha@gmail.com> changed: What |Removed |Added ---------------------------------------------------------------------------- Depends on| |23329 Referenced Bugs: https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=23329 [Bug 23329] tracklinks.pl accepts any url from a parameter for proxying if not tracking -- You are receiving this mail because: You are watching all bug changes. You are the assignee for the bug.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=30803 David Cook <dcook@prosentient.com.au> changed: What |Removed |Added ---------------------------------------------------------------------------- See Also| |https://bugs.koha-community | |.org/bugzilla3/show_bug.cgi | |?id=41599 -- You are receiving this mail because: You are watching all bug changes. You are the assignee for the bug.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=30803 David Cook <dcook@prosentient.com.au> changed: What |Removed |Added ---------------------------------------------------------------------------- Status|NEW |Needs Signoff -- You are receiving this mail because: You are watching all bug changes. You are the assignee for the bug.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=30803 --- Comment #1 from David Cook <dcook@prosentient.com.au> --- Created attachment 191332 --> https://bugs.koha-community.org/bugzilla3/attachment.cgi?id=191332&action=edit Bug 30803: Don't hardcode 404 into output_error This patch removes the hardcoded "404 Not Found" status code and reason phrase from output_error and instead uses just the code passed into the function. Test Plan: 0. Apply patch and koha-plack --restart kohadev 1. Go to http://localhost:8080/cgi-bin/koha/tracklinks.pl?uri=https%3A%2F%2Ftest.com&biblionumber=29 2. Note normal OPAC 404 error Bonus points: 1. Change 404 to 403 in the first output_error in opac/tracklinks.pl 2. koha-plack --restart kohadev 3. Go to http://localhost:8080/cgi-bin/koha/tracklinks.pl?uri=https%3A%2F%2Ftest.com&biblionumber=29 4. Note normal OPAC 403 error -- You are receiving this mail because: You are the assignee for the bug. You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=30803 David Cook <dcook@prosentient.com.au> changed: What |Removed |Added ---------------------------------------------------------------------------- Assignee|koha-bugs@lists.koha-commun |dcook@prosentient.com.au |ity.org | -- You are receiving this mail because: You are the assignee for the bug. You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=30803 David Cook <dcook@prosentient.com.au> changed: What |Removed |Added ---------------------------------------------------------------------------- Depends on| |41599 --- Comment #2 from David Cook <dcook@prosentient.com.au> --- Adding a dependency on bug 41599 because this fix would break reports/acquisitions_stats.pl in an error condition it seems... Referenced Bugs: https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=41599 [Bug 41599] reports/acquisitions_stats.pl calls output_error incorrectly -- You are receiving this mail because: You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=30803 David Cook <dcook@prosentient.com.au> changed: What |Removed |Added ---------------------------------------------------------------------------- Depends on|41599 | Blocks| |41599 --- Comment #3 from David Cook <dcook@prosentient.com.au> --- Actually, the thing with bug 41599 is a chicken and egg problem. It looks like "Possible SQL injection" will return a 200 error code which is fine for now. So may as well make bug 41599 depend on this one... Referenced Bugs: https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=41599 [Bug 41599] reports/acquisitions_stats.pl calls output_error incorrectly -- You are receiving this mail because: You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=30803 Jonathan Druart <jonathan.druart@gmail.com> changed: What |Removed |Added ---------------------------------------------------------------------------- Status|Needs Signoff |Signed Off -- You are receiving this mail because: You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=30803 Jonathan Druart <jonathan.druart@gmail.com> changed: What |Removed |Added ---------------------------------------------------------------------------- Attachment #191332|0 |1 is obsolete| | -- You are receiving this mail because: You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=30803 --- Comment #4 from Jonathan Druart <jonathan.druart@gmail.com> --- Created attachment 191339 --> https://bugs.koha-community.org/bugzilla3/attachment.cgi?id=191339&action=edit Bug 30803: Don't hardcode 404 into output_error This patch removes the hardcoded "404 Not Found" status code and reason phrase from output_error and instead uses just the code passed into the function. Test Plan: 0. Apply patch and koha-plack --restart kohadev 1. Go to http://localhost:8080/cgi-bin/koha/tracklinks.pl?uri=https%3A%2F%2Ftest.com&biblionumber=29 2. Note normal OPAC 404 error Bonus points: 1. Change 404 to 403 in the first output_error in opac/tracklinks.pl 2. koha-plack --restart kohadev 3. Go to http://localhost:8080/cgi-bin/koha/tracklinks.pl?uri=https%3A%2F%2Ftest.com&biblionumber=29 4. Note normal OPAC 403 error Signed-off-by: Jonathan Druart <jonathan.druart@bugs.koha-community.org> -- You are receiving this mail because: You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=30803 --- Comment #5 from Jonathan Druart <jonathan.druart@gmail.com> --- Created attachment 191340 --> https://bugs.koha-community.org/bugzilla3/attachment.cgi?id=191340&action=edit Bug 30803: Add tests Signed-off-by: Jonathan Druart <jonathan.druart@bugs.koha-community.org> -- You are receiving this mail because: You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=30803 --- Comment #6 from Jonathan Druart <jonathan.druart@gmail.com> --- Created attachment 191341 --> https://bugs.koha-community.org/bugzilla3/attachment.cgi?id=191341&action=edit Bug 30803: Raise exception if $error is not passed Signed-off-by: Jonathan Druart <jonathan.druart@bugs.koha-community.org> -- You are receiving this mail because: You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=30803 --- Comment #7 from Jonathan Druart <jonathan.druart@gmail.com> --- Bug 41599 must be pushed along with this one. -- You are receiving this mail because: You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=30803 Martin Renvoize (ashimema) <martin.renvoize@openfifth.co.uk> changed: What |Removed |Added ---------------------------------------------------------------------------- Attachment #191339|0 |1 is obsolete| | -- You are receiving this mail because: You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=30803 Martin Renvoize (ashimema) <martin.renvoize@openfifth.co.uk> changed: What |Removed |Added ---------------------------------------------------------------------------- Attachment #191340|0 |1 is obsolete| | -- You are receiving this mail because: You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=30803 Martin Renvoize (ashimema) <martin.renvoize@openfifth.co.uk> changed: What |Removed |Added ---------------------------------------------------------------------------- Attachment #191341|0 |1 is obsolete| | -- You are receiving this mail because: You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=30803 --- Comment #8 from Martin Renvoize (ashimema) <martin.renvoize@openfifth.co.uk> --- Created attachment 193611 --> https://bugs.koha-community.org/bugzilla3/attachment.cgi?id=193611&action=edit Bug 30803: Don't hardcode 404 into output_error This patch removes the hardcoded "404 Not Found" status code and reason phrase from output_error and instead uses just the code passed into the function. Test Plan: 0. Apply patch and koha-plack --restart kohadev 1. Go to http://localhost:8080/cgi-bin/koha/tracklinks.pl?uri=https%3A%2F%2Ftest.com&biblionumber=29 2. Note normal OPAC 404 error Bonus points: 1. Change 404 to 403 in the first output_error in opac/tracklinks.pl 2. koha-plack --restart kohadev 3. Go to http://localhost:8080/cgi-bin/koha/tracklinks.pl?uri=https%3A%2F%2Ftest.com&biblionumber=29 4. Note normal OPAC 403 error Signed-off-by: Jonathan Druart <jonathan.druart@bugs.koha-community.org> Signed-off-by: Martin Renvoize <martin.renvoize@openfifth.co.uk> -- You are receiving this mail because: You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=30803 --- Comment #9 from Martin Renvoize (ashimema) <martin.renvoize@openfifth.co.uk> --- Created attachment 193612 --> https://bugs.koha-community.org/bugzilla3/attachment.cgi?id=193612&action=edit Bug 30803: Add tests Signed-off-by: Jonathan Druart <jonathan.druart@bugs.koha-community.org> Signed-off-by: Martin Renvoize <martin.renvoize@openfifth.co.uk> -- You are receiving this mail because: You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=30803 --- Comment #10 from Martin Renvoize (ashimema) <martin.renvoize@openfifth.co.uk> --- Created attachment 193613 --> https://bugs.koha-community.org/bugzilla3/attachment.cgi?id=193613&action=edit Bug 30803: Raise exception if $error is not passed Signed-off-by: Jonathan Druart <jonathan.druart@bugs.koha-community.org> Signed-off-by: Martin Renvoize <martin.renvoize@openfifth.co.uk> -- You are receiving this mail because: You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=30803 Martin Renvoize (ashimema) <martin.renvoize@openfifth.co.uk> changed: What |Removed |Added ---------------------------------------------------------------------------- QA Contact|testopia@bugs.koha-communit |martin.renvoize@openfifth.c |y.org |o.uk Status|Signed Off |Passed QA CC| |martin.renvoize@openfifth.c | |o.uk -- You are receiving this mail because: You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=30803 Lucas Gass (lukeg) <lucas@bywatersolutions.com> changed: What |Removed |Added ---------------------------------------------------------------------------- Version(s)| |26.05.00 released in| | Status|Passed QA |Pushed to main -- You are receiving this mail because: You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=30803 --- Comment #11 from Lucas Gass (lukeg) <lucas@bywatersolutions.com> --- Nice work everyone! Pushed to main for 26.05 -- You are receiving this mail because: You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=30803 David Cook <dcook@prosentient.com.au> changed: What |Removed |Added ---------------------------------------------------------------------------- Text to go in the| |This change fixes the release notes| |output_error function so | |that it requires a numeric | |input. -- You are receiving this mail because: You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=30803 Jacob O'Mara <jacob.omara@openfifth.co.uk> changed: What |Removed |Added ---------------------------------------------------------------------------- Status|Pushed to main |Pushed to stable Version(s)|26.05.00 |26.05.00,25.11.04 released in| | -- You are receiving this mail because: You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=30803 --- Comment #12 from Jacob O'Mara <jacob.omara@openfifth.co.uk> --- Thanks all, pushed to 25.11.x -- You are receiving this mail because: You are watching all bug changes.
participants (1)
-
bugzilla-daemon＠bugs.koha-community.org