As per the discussion on the committers list and https://groups.google.com/forum/?utm_medium=email&utm_source=footer#!msg/islandora-dev/8eSxcOtSlX4/pw_VAFZbAgAJ as context this ticket is an attempt to close the holes that are currently open within Islandora / Islandora OpenSeadragon.
Note: This ticket is created as sensitive, Melissa Anez, Nick Ruest or whomever can deem to open it. Similarly, I will push to my fork referencing these JIRA tickets but won't open pulls for the time being.
Changes being made:
-Removing the "download_clip" endpoint from the Islandora module and moving it to the OpenSeadragon module as that's the only place it's actually used.
-Changes to what parameters are being passed through the 'clip' $_GET parameter. Previously a fully constructed URL was passed through representing the URL to Djatoka. Now only the rft_id/svc.region parameters for Djatoka will be set on the clip ID as well as the dimensions of the current image. Any other parameters passed through 'clip' $_GET parameter will be ignored (https://github.com/jordandukart/islandora_openseadragon/blob/7.x-ISLANDORA-1696/includes/utilities.inc#L30-L85 and https://github.com/jordandukart/islandora_openseadragon/blob/7.x-ISLANDORA-1696/js/islandora_openseadragon.js#L64-L71)
-The URL constructed will use the Djatoka URL configured through the admin page for the module. Note that I tested this with both a relative and absolute URL.
-Downloading a clip will only occur if the 'clip' $_GET parameter constitutes a valid URL otherwise will drupal_access_denied and watchdog if not. (https://github.com/jordandukart/islandora_openseadragon/blob/7.x-ISLANDORA-1696/islandora_openseadragon.module#L270-L301)
Compares to reference:
Islandora OpenSeadragon: https://github.com/Islandora/islandora_openseadragon/compare/7.x...jordandukart:7.x-ISLANDORA-1696?expand=1
Lastly, the https://github.com/Islandora/islandora/blob/7.x/islandora.module#L157-L165 menu path is only referenced in places in direct conjunction with clipping functionality of OpenSeadragon. Ideally we could pull this out into Islandora OpenSeadragon but this comes with complications. Seeing as it references a theme call in its callback (https://github.com/Islandora/islandora/blob/7.x/islandora.module#L684) all implementations (large image/newspaper sps) of this would have to be updated to reference the new islandora_openseadragon prefixed hook. Would have included this in this ticket but there is at least one custom module that has a implementation of this (Jared Whiklo's institution) and there could be more outside of dgi.