Attachment #122011 for bug #22990

View | Details | Raw Unified | Return to bug 22990
Collapse All | Expand All




sub output_and_exit_if_error {
    my ( $query, $cookie, $template, $params ) = @_;
    my $error;
    if ( $params and exists $params->{module} ) {
        if ( $params->{module} eq 'members' ) {
            my $logged_in_user = $params->{logged_in_user};
            my $current_patron = $params->{current_patron};
            if ( not $current_patron ) {
                $error = 'unknown_patron';
            }
            elsif ( not $logged_in_user->can_see_patron_infos($current_patron) )
            {
                $error = 'cannot_see_patron_infos';
        if ( $params and exists $params->{module} ) {
            if ( $params->{module} eq 'members' ) {
                my $logged_in_user = $params->{logged_in_user};
                my $current_patron = $params->{current_patron};
                if ( not $current_patron ) {
                    $error = 'unknown_patron';
                }
                elsif( not $logged_in_user->can_see_patron_infos( $current_patron ) ) {
                    $error = 'cannot_see_patron_infos';
                }
            }
        }
        elsif ( $params->{module} eq 'cataloguing' ) {
            # We are testing the record to avoid additem to fetch the Koha::Biblio
            # But in the long term we will want to get a biblio in parameter
            $error = 'unknown_biblio' unless $params->{record};
        }
        elsif ( $params->{module} eq 'CSRF_TOKEN_CHECK' ) {
            $error = 'wrong_csrf_token'
              unless Koha::Token->new->check_csrf(
                {
                    session_id => scalar $query->cookie('CGISESSID'),
                    token      => scalar $query->param('csrf_token'),
                }
              );
            }
        }
    }
    output_and_exit( $query, $cookie, $template, $error ) if $error;
    return;

Lines 143-149 if ( $op eq 'add_form' ) { Link Here

(-)a/acqui/basketheader.pl (-2 / +2 lines)
143	} elsif ( $op eq 'add_validate' ) {	143	} elsif ( $op eq 'add_validate' ) {
144	#we are confirming the changes, save the basket	144	#we are confirming the changes, save the basket
145	#we are checking CSRF Token. Module CSRF_TOKEN_CHECK indicate for CSRF token checking,	145	#we are checking CSRF Token. Module CSRF_TOKEN_CHECK indicate for CSRF token checking,
146	output_and_exit_if_error( $input, $input->cookie('CGISESSID'), $template, { module => 'CSRF_TOKEN_CHECK', csrf_token => $input->param('csrf_token') } );	146	output_and_exit_if_error($input, $cookie, $template, { module => 'CSRF_TOKEN_CHECK' });
		147
147	if ( $is_an_edit ) {	148	if ( $is_an_edit ) {
148	ModBasketHeader(	149	ModBasketHeader(
149	$basketno,	150	$basketno,
150	-

Return to bug 22990

Lines 332-363 Others will be added here depending on the needs (for instance biblio does not e Link Here

(-)a/C4/Output.pm (-21 / +22 lines)
332	sub output_and_exit_if_error {	332	sub output_and_exit_if_error {
333	my ( $query, $cookie, $template, $params ) = @_;	333	my ( $query, $cookie, $template, $params ) = @_;
334	my $error;	334	my $error;
335	if ($params->{module} eq 'CSRF_TOKEN_CHECK') {	335	if ( $params and exists $params->{module} ) {
336	my $csrfcheck = Koha::Token->new->check_csrf( {	336	if ( $params->{module} eq 'members' ) {
337	session_id => scalar $cookie,	337	my $logged_in_user = $params->{logged_in_user};
338	token => scalar $params->{csrf_token},	338	my $current_patron = $params->{current_patron};
339	});	339	if ( not $current_patron ) {
340	unless ($csrfcheck) {	340	$error = 'unknown_patron';
341	$error = 'wrong_csrf_token';	341	}
342	}	342	elsif ( not $logged_in_user->can_see_patron_infos($current_patron) )
343		343	{
344	} else {	344	$error = 'cannot_see_patron_infos';
345	if ( $params and exists $params->{module} ) {
346	if ( $params->{module} eq 'members' ) {
347	my $logged_in_user = $params->{logged_in_user};
348	my $current_patron = $params->{current_patron};
349	if ( not $current_patron ) {
350	$error = 'unknown_patron';
351	}
352	elsif( not $logged_in_user->can_see_patron_infos( $current_patron ) ) {
353	$error = 'cannot_see_patron_infos';
354	}
355	}	345	}
356	} elsif ( $params->{module} eq 'cataloguing' ) {	346	}
		347	elsif ( $params->{module} eq 'cataloguing' ) {
357	# We are testing the record to avoid additem to fetch the Koha::Biblio	348	# We are testing the record to avoid additem to fetch the Koha::Biblio
358	# But in the long term we will want to get a biblio in parameter	349	# But in the long term we will want to get a biblio in parameter
359	$error = 'unknown_biblio' unless $params->{record};	350	$error = 'unknown_biblio' unless $params->{record};
360	}	351	}
		352	elsif ( $params->{module} eq 'CSRF_TOKEN_CHECK' ) {
		353	$error = 'wrong_csrf_token'
		354	unless Koha::Token->new->check_csrf(
		355	{
		356	session_id => scalar $query->cookie('CGISESSID'),
		357	token => scalar $query->param('csrf_token'),
		358	}
		359	);
		360	}
		361	}
361	}	362	}
362	output_and_exit( $query, $cookie, $template, $error ) if $error;	363	output_and_exit( $query, $cookie, $template, $error ) if $error;
363	return;	364	return;