Bug 25898: Prohibit indirect object notation
[koha.git] / opac / svc / overdrive_proxy
blob1404e9873cc56402aff3442f69260160104ee6c7
1 #!/usr/bin/perl
3 # Copyright 2013 ByWater
5 # This file is part of Koha.
7 # Koha is free software; you can redistribute it and/or modify it
8 # under the terms of the GNU General Public License as published by
9 # the Free Software Foundation; either version 3 of the License, or
10 # (at your option) any later version.
12 # Koha is distributed in the hope that it will be useful, but
13 # WITHOUT ANY WARRANTY; without even the implied warranty of
14 # MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
15 # GNU General Public License for more details.
17 # You should have received a copy of the GNU General Public License
18 # along with Koha; if not, see <http://www.gnu.org/licenses>.
20 =head1 NAME
22 svc/overdrive_proxy: Proxy OAuth'd requests to OverDrive
24 =head1 SYNOPSIS
26 svc/overdrive_proxy/libraries/9001 -> https://api.overdrive.com/v1/libraries/9001
28 =head1 DESCRIPTION
30 This service proxies incoming requests to the OverDrive OAuth API, to keep the
31 JS side from having to deal with cross-origin/authentication issues.
33 =cut
35 use Modern::Perl;
37 use CGI qw(-oldstyle_urls -utf8);
38 use JSON;
40 use C4::Context;
41 use C4::External::OverDrive;
42 use C4::Output;
44 use Koha;
46 my $query = CGI->new;
48 my $token;
50 if ( !(C4::Context->preference('OverDriveClientKey') && C4::Context->preference('OverDriveClientSecret')) || !( $token = GetOverDriveToken() ) ) {
51 print $query->header(
52 -status => '400 Bad Request',
55 print to_json({
56 error => 'invalid_client',
57 error_description => 'OverDrive login failed'
58 });
60 exit;
62 my $fixed_query = $query->query_string;
63 $fixed_query =~ tr/;/&/;
65 my $request = HTTP::Request::Common::GET( "https://api.overdrive.com/v1" . $query->path_info . '?' . $fixed_query );
66 $request->header( Authorization => $token );
68 my $ua = LWP::UserAgent->new( "Koha " . Koha::version() );
70 my $response = $ua->request( $request ) ;
71 if ( $response->code eq '500' ) {
72 print $query->header(
73 -status => '500 Internal Server Error'
76 warn "OverDrive request failed: " . $response->message;
77 print to_json({
78 error => 'invalid_client',
79 error_description => 'OverDrive request failed'
80 });
82 exit;
85 output_with_http_headers $query, undef, $response->content, 'json', $response->status_line;