The system preferences need urgent CSRF protection to prevent external XSS injection and other undesirable consequences.
This one is a bit harder to exploit but I've done it previously...
It looks like preferenes.pl $op save doesn't get used anymore as an old school API is used instead and systempreferences.pl is used for "Local use preferences"... So we'll need to write a token out to preferences.pl, find it and send it in koha-tmpl/intranet-tmpl/prog/js/pages/preferences.js, and choke without it in ./svc/config/systempreferences
Bug 33289 is going to be a problem... since it doesn't have ready access to a CSRF token...
(In reply to David Cook from comment #6) > Bug 33289 is going to be a problem... since it doesn't have ready access to > a CSRF token... I actually bumped into this same problem with a Vue app I created on Wordpress that uses the Wordpress API: https://developer.wordpress.org/rest-api/using-the-rest-api/authentication/ I think the official way and the way I ended up doing was to use the server-side to print out a data structure containing the CSRF token in an inline Javascript element. Of course, that's going to be easier said than done in Koha. I imagine Jonathan will have more insight into handle CSRF for Bug 33289...
Created attachment 154121 [details] [review] Bug 34369: Require CSRF token for updating system preferences This patch adds the requirements that updating a system preference requires a CSRF token. (Also, adding and deleting local system preferences.) 0. Apply patch 1. koha-plack --reload kohadev 2. Add local system preference 3. Update local system preference 4. Delete local system preference 5. Update normal system preference 6. Note no errors
Created attachment 154122 [details] [review] Bug 34369: Pass csrf token from syspref API client (for Vue app)
(In reply to Jonathan Druart from comment #9) > Created attachment 154122 [details] [review] [review] > Bug 34369: Pass csrf token from syspref API client (for Vue app) This is not used for now (removed from bug 33606) but will be by bug 30708 (set sysprefs from the Vue app).
Thanks, Jonathan. I really appreciate that.
Created attachment 154163 [details] [review] Bug 34369: Require CSRF token for updating system preferences This patch adds the requirements that updating a system preference requires a CSRF token. (Also, adding and deleting local system preferences.) 0. Apply patch 1. koha-plack --reload kohadev 2. Add local system preference 3. Update local system preference 4. Delete local system preference 5. Update normal system preference 6. Note no errors Signed-off-by: Jonathan Druart <jonathan.druart@bugs.koha-community.org>
Created attachment 154164 [details] [review] Bug 34369: Pass csrf token from syspref API client (for Vue app) Signed-off-by: Jonathan Druart <jonathan.druart@bugs.koha-community.org>
Created attachment 154165 [details] [review] Bug 34369: Fix 'Did you mean' Signed-off-by: Jonathan Druart <jonathan.druart@bugs.koha-community.org>
Looking here now
Created attachment 154237 [details] [review] Bug 34369: Require CSRF token for updating system preferences This patch adds the requirements that updating a system preference requires a CSRF token. (Also, adding and deleting local system preferences.) 0. Apply patch 1. koha-plack --reload kohadev 2. Add local system preference 3. Update local system preference 4. Delete local system preference 5. Update normal system preference 6. Note no errors Signed-off-by: Jonathan Druart <jonathan.druart@bugs.koha-community.org> Signed-off-by: Marcel de Rooy <m.de.rooy@rijksmuseum.nl>
Created attachment 154238 [details] [review] Bug 34369: Pass csrf token from syspref API client (for Vue app) Signed-off-by: Jonathan Druart <jonathan.druart@bugs.koha-community.org> Signed-off-by: Marcel de Rooy <m.de.rooy@rijksmuseum.nl>
Created attachment 154239 [details] [review] Bug 34369: Fix 'Did you mean' Signed-off-by: Jonathan Druart <jonathan.druart@bugs.koha-community.org> Signed-off-by: Marcel de Rooy <m.de.rooy@rijksmuseum.nl>
In terms of CSRF fixes, this one should be a priority I think, since it has a large blast radius.
Note: I had to rebase it. If the dependencies are not backported, you might need to pick the patches from this report. Pushed to master for 23.11. Nice work everyone, thanks!