https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=27961 --- Comment #1 from Aleisha Amohia <aleisha@catalyst.net.nz> --- Created attachment 118256 --> https://bugs.koha-community.org/bugzilla3/attachment.cgi?id=118256&action=edit Bug 27961: Ensure external URLs are filtered TT variables are used to build the link in items.uri . This is a problem particularly when TrackClicks is enabled because the items.uri value doesn't get escaped, resulting in a 404. To test: 1) Enable the TrackClicks system preference (set to Track or Track anonymously) 2) Find a record with an item 3) Edit the item and put an external URL under the Uniform Resource Identifier field 4) Go to that record in the OPAC 5) Click on Link to resource 6) Confirm you are not redirected to the URL and instead see a 404 7) Apply the patch and refresh the page 8) Click on Link to resource 9) Confirm you are redirected as expected 10) Go back to the staff client to edit your item. This time put two URLs in the Uniform Resource Identifier field, separated by ' | '. (Don't forget the spaces around the pipe, and don't forget to add a trailing slash to the URL). 11) Go back to the OPAC and refresh the page. 12) Confirm both URLs redirect as expected. Sponsored-by: Parliamentary Library New Zealand -- You are receiving this mail because: You are watching all bug changes.

https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=27961 Owen Leonard <oleonard@myacpl.org> changed: What |Removed |Added ---------------------------------------------------------------------------- Assignee|oleonard@myacpl.org |aleisha@catalyst.net.nz -- You are receiving this mail because: You are watching all bug changes.

https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=27961 --- Comment #4 from Aleisha Amohia <aleisha@catalyst.net.nz> --- (In reply to Henry Bolshaw from comment #3)

Hi Aleisha, I'm still getting some 404 errors when I add two URLs:

e.g.

https://bbc.co.uk/ | https://gu.com/

https://bbc.co.uk | https://gu.com

https://bbc.co.uk | https://gu.com/

Sometimes one link will work but not the other one.

Can you provide some examples of links that you think should work?

Actually this is a good point, it looks like it is broken in master as well (without applying this patch). I'll see if I can fix it with this patch.

Also for the test plan, do we need to test "trackclicks:track" and "trackclicks:track anonymously" separately or doesn't it make a difference?

From my understanding, it doesn't make a difference.

-- You are receiving this mail because: You are watching all bug changes.

https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=27961 Aleisha Amohia <aleisha@catalyst.net.nz> changed: What |Removed |Added ---------------------------------------------------------------------------- Status|ASSIGNED |Needs Signoff Depends on| |27979 --- Comment #5 from Aleisha Amohia <aleisha@catalyst.net.nz> --- I've written a patch for Bug 27979 to address the broken multiple URLs bug. This patch can be tested on top of that one Referenced Bugs: https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=27979 [Bug 27979] Multiple item URIs break redirect if TrackClicks enabled -- You are receiving this mail because: You are watching all bug changes.

https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=27961 David Nind <david@davidnind.com> changed: What |Removed |Added ---------------------------------------------------------------------------- Attachment #118256|0 |1 is obsolete| | --- Comment #6 from David Nind <david@davidnind.com> --- Created attachment 119091 --> https://bugs.koha-community.org/bugzilla3/attachment.cgi?id=119091&action=edit Bug 27961: Ensure external URLs are filtered TT variables are used to build the link in items.uri . This is a problem particularly when TrackClicks is enabled because the items.uri value doesn't get escaped, resulting in a 404. To test: 1) Enable the TrackClicks system preference (set to Track or Track anonymously) 2) Find a record with an item 3) Edit the item and put an external URL under the Uniform Resource Identifier field 4) Go to that record in the OPAC 5) Click on Link to resource 6) Confirm you are not redirected to the URL and instead see a 404 7) Apply the patch and refresh the page 8) Click on Link to resource 9) Confirm you are redirected as expected 10) Go back to the staff client to edit your item. This time put two URLs in the Uniform Resource Identifier field, separated by ' | '. (Don't forget the spaces around the pipe, and don't forget to add a trailing slash to the URL). 11) Go back to the OPAC and refresh the page. 12) Confirm both URLs redirect as expected. Sponsored-by: Parliamentary Library New Zealand Signed-off-by: David Nind <david@davidnind.com> -- You are receiving this mail because: You are watching all bug changes.

https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=27961 --- Comment #8 from Marcel de Rooy <m.de.rooy@rijksmuseum.nl> --- (In reply to Jonathan Druart from comment #7)

Caused by commit 26d4b7fd5e35f784f951c4f9e9bb084a9f4612a4 Bug 24699: Split items.uri in OPAC detail view ?

Marcel, can you have a look at it please?

Will do -- You are receiving this mail because: You are watching all bug changes.

https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=27961 Marcel de Rooy <m.de.rooy@rijksmuseum.nl> changed: What |Removed |Added ---------------------------------------------------------------------------- Status|BLOCKED |Passed QA -- You are receiving this mail because: You are watching all bug changes.

https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=27961 Jonathan Druart <jonathan.druart@bugs.koha-community.org> changed: What |Removed |Added ---------------------------------------------------------------------------- Severity|enhancement |normal -- You are receiving this mail because: You are watching all bug changes.

https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=27961 --- Comment #11 from Jonathan Druart <jonathan.druart@bugs.koha-community.org> --- Pushed to master for 21.05, thanks to everybody involved! -- You are receiving this mail because: You are watching all bug changes.

https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=27961 Andrew Fuerste-Henry <andrew@bywatersolutions.com> changed: What |Removed |Added ---------------------------------------------------------------------------- CC| |andrew@bywatersolutions.com --- Comment #13 from Andrew Fuerste-Henry <andrew@bywatersolutions.com> --- I'm not recreating the issue when following your test plan on 20.05. Additionally, the patch doesn't apply cleanly. Please rebase if needed. -- You are receiving this mail because: You are watching all bug changes.

https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=27961 --- Comment #14 from Aleisha Amohia <aleisha@catalyst.net.nz> --- Created attachment 120426 --> https://bugs.koha-community.org/bugzilla3/attachment.cgi?id=120426&action=edit Bug 27961: [20.05.x] Ensure external URLs are filtered TT variables are used to build the link in items.uri . This is a problem particularly when TrackClicks is enabled because the items.uri value doesn't get escaped, resulting in a 404. To test: 1) Enable the TrackClicks system preference (set to Track or Track anonymously) 2) Find a record with an item 3) Edit the item and put an external URL under the Uniform Resource Identifier field 4) Go to that record in the OPAC 5) Click on Link to resource 6) Confirm you are not redirected to the URL and instead see a 404 7) Apply the patch and refresh the page 8) Click on Link to resource 9) Confirm you are redirected as expected 10) Go back to the staff client to edit your item. This time put two URLs in the Uniform Resource Identifier field, separated by ' | '. (Don't forget the spaces around the pipe, and don't forget to add a trailing slash to the URL). 11) Go back to the OPAC and refresh the page. 12) Confirm both URLs redirect as expected. Sponsored-by: Parliamentary Library New Zealand -- You are receiving this mail because: You are watching all bug changes.

https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=27961 David Cook <dcook@prosentient.com.au> changed: What |Removed |Added ---------------------------------------------------------------------------- Depends on| |24699 See Also|https://bugs.koha-community | |.org/bugzilla3/show_bug.cgi | |?id=24699 | Referenced Bugs: https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=24699 [Bug 24699] Split items.uri on OPAC detail page -- You are receiving this mail because: You are watching all bug changes.