View | Details | Raw Unified | Return to bug 22990
Collapse All | Expand All

(-)a/C4/Auth.pm (+2 lines)
Lines 76-81 use Encode qw( encode is_utf8); Link Here
76
use C4::Auth_with_shibboleth;
76
use C4::Auth_with_shibboleth;
77
use Net::CIDR;
77
use Net::CIDR;
78
use C4::Log qw/logaction/;
78
use C4::Log qw/logaction/;
79
use Koha::Token;
79
80
80
# use utf8;
81
# use utf8;
81
use vars qw(@ISA @EXPORT @EXPORT_OK %EXPORT_TAGS $debug $ldap $cas $caslogout);
82
use vars qw(@ISA @EXPORT @EXPORT_OK %EXPORT_TAGS $debug $ldap $cas $caslogout);
Lines 309-314 sub get_template_and_user { Link Here
309
        $template->param( loggedinusernumber => $borrowernumber ); # FIXME Should be replaced with logged_in_user.borrowernumber
310
        $template->param( loggedinusernumber => $borrowernumber ); # FIXME Should be replaced with logged_in_user.borrowernumber
310
        $template->param( logged_in_user     => $patron );
311
        $template->param( logged_in_user     => $patron );
311
        $template->param( sessionID          => $sessionID );
312
        $template->param( sessionID          => $sessionID );
313
        $template->param( csrf_token => Koha::Token->new->generate_csrf({ session_id => scalar $sessionID }));
312
314
313
        if ( $in->{'type'} eq 'opac' ) {
315
        if ( $in->{'type'} eq 'opac' ) {
314
            require Koha::Virtualshelves;
316
            require Koha::Virtualshelves;
(-)a/C4/Output.pm (-10 / +21 lines)
Lines 33-38 use Scalar::Util qw( looks_like_number ); Link Here
33
use C4::Auth qw(get_template_and_user);
33
use C4::Auth qw(get_template_and_user);
34
use C4::Context;
34
use C4::Context;
35
use C4::Templates;
35
use C4::Templates;
36
use Koha::Token;
36
37
37
use vars qw(@ISA @EXPORT @EXPORT_OK %EXPORT_TAGS);
38
use vars qw(@ISA @EXPORT @EXPORT_OK %EXPORT_TAGS);
38
39
Lines 331-345 Others will be added here depending on the needs (for instance biblio does not e Link Here
331
sub output_and_exit_if_error {
332
sub output_and_exit_if_error {
332
    my ( $query, $cookie, $template, $params ) = @_;
333
    my ( $query, $cookie, $template, $params ) = @_;
333
    my $error;
334
    my $error;
334
    if ( $params and exists $params->{module} ) {
335
    if ($params->{module} eq 'CSRF_TOKEN_CHECK') {
335
        if ( $params->{module} eq 'members' ) {
336
        my $csrfcheck = Koha::Token->new->check_csrf( {
336
            my $logged_in_user = $params->{logged_in_user};
337
            session_id => scalar $cookie,
337
            my $current_patron = $params->{current_patron};
338
            token  => scalar $params->{csrf_token},
338
            if ( not $current_patron ) {
339
        });
339
                $error = 'unknown_patron';
340
        unless ($csrfcheck) {
340
            }
341
            $error = 'wrong_csrf_token';
341
            elsif( not $logged_in_user->can_see_patron_infos( $current_patron ) ) {
342
        }
342
                $error = 'cannot_see_patron_infos';
343
344
    } else {
345
        if ( $params and exists $params->{module} ) {
346
            if ( $params->{module} eq 'members' ) {
347
                my $logged_in_user = $params->{logged_in_user};
348
                my $current_patron = $params->{current_patron};
349
                if ( not $current_patron ) {
350
                    $error = 'unknown_patron';
351
                }
352
                elsif( not $logged_in_user->can_see_patron_infos( $current_patron ) ) {
353
                    $error = 'cannot_see_patron_infos';
354
                }
343
            }
355
            }
344
        } elsif ( $params->{module} eq 'cataloguing' ) {
356
        } elsif ( $params->{module} eq 'cataloguing' ) {
345
            # We are testing the record to avoid additem to fetch the Koha::Biblio
357
            # We are testing the record to avoid additem to fetch the Koha::Biblio
Lines 347-353 sub output_and_exit_if_error { Link Here
347
            $error = 'unknown_biblio' unless $params->{record};
359
            $error = 'unknown_biblio' unless $params->{record};
348
        }
360
        }
349
    }
361
    }
350
351
    output_and_exit( $query, $cookie, $template, $error ) if $error;
362
    output_and_exit( $query, $cookie, $template, $error ) if $error;
352
    return;
363
    return;
353
}
364
}
(-)a/acqui/basketheader.pl (+2 lines)
Lines 142-147 if ( $op eq 'add_form' ) { Link Here
142
#End Edit
142
#End Edit
143
} elsif ( $op eq 'add_validate' ) {
143
} elsif ( $op eq 'add_validate' ) {
144
#we are confirming the changes, save the basket
144
#we are confirming the changes, save the basket
145
#we are checking CSRF Token. Module CSRF_TOKEN_CHECK indicate for CSRF token checking,
146
    output_and_exit_if_error( $input, $input->cookie('CGISESSID'), $template, { module => 'CSRF_TOKEN_CHECK', csrf_token => $input->param('csrf_token') } );
145
    if ( $is_an_edit ) {
147
    if ( $is_an_edit ) {
146
        ModBasketHeader(
148
        ModBasketHeader(
147
            $basketno,
149
            $basketno,
(-)a/koha-tmpl/intranet-tmpl/prog/en/includes/csrf-token.inc (+1 lines)
Line 0 Link Here
1
<input type="hidden" name="csrf_token" value="[% csrf_token | html %]" />
(-)a/koha-tmpl/intranet-tmpl/prog/en/modules/acqui/basketheader.tt (-2 / +2 lines)
Lines 50-62 Link Here
50
<div class="main container-fluid">
50
<div class="main container-fluid">
51
    <div class="row">
51
    <div class="row">
52
        <div class="col-md-10 col-md-offset-1 col-lg-8 col-lg-offset-2">
52
        <div class="col-md-10 col-md-offset-1 col-lg-8 col-lg-offset-2">
53
53
    [% INCLUDE 'blocking_errors.inc' %]
54
    [% IF ( add_form ) %]
54
    [% IF ( add_form ) %]
55
        [% IF ( basketno ) %]
55
        [% IF ( basketno ) %]
56
            <h1>Edit basket [% basketname | html %]</h1>
56
            <h1>Edit basket [% basketname | html %]</h1>
57
        [% ELSE %]<h1>Add a basket to [% booksellername | html %]</h1>
57
        [% ELSE %]<h1>Add a basket to [% booksellername | html %]</h1>
58
        [% END %]
58
        [% END %]
59
    <form name="Aform" action="[% script_name | html %]" method="post" class="validated">
59
    <form name="Aform" action="[% script_name | html %]" method="post" class="validated">
60
        [% INCLUDE 'csrf-token.inc' %]
60
        <input type="hidden" name="booksellerid" value="[% booksellerid | html %]" />
61
        <input type="hidden" name="booksellerid" value="[% booksellerid | html %]" />
61
        <fieldset class="rows">
62
        <fieldset class="rows">
62
            <ol>
63
            <ol>
63
- 

Return to bug 22990