Attachment #122012 for bug #22990

View | Details | Raw Unified | Return to bug 22990
Collapse All | Expand All




            # But in the long term we will want to get a biblio in parameter
            $error = 'unknown_biblio' unless $params->{record};
        }
    }
    elsif ( $params->{check} eq 'csrf_token' ) {
        $error = 'wrong_csrf_token'
          unless Koha::Token->new->check_csrf(
            {
                session_id => scalar $query->cookie('CGISESSID'),
                token      => scalar $query->param('csrf_token'),
              );
            }
          );
    }
    output_and_exit( $query, $cookie, $template, $error ) if $error;
    return;

Lines 142-149 if ( $op eq 'add_form' ) { Link Here

(-)a/acqui/basketheader.pl (-3 / +2 lines)
142	#End Edit	142	#End Edit
143	} elsif ( $op eq 'add_validate' ) {	143	} elsif ( $op eq 'add_validate' ) {
144	#we are confirming the changes, save the basket	144	#we are confirming the changes, save the basket
145	#we are checking CSRF Token. Module CSRF_TOKEN_CHECK indicate for CSRF token checking,	145	#we are checking CSRF Token.
146	output_and_exit_if_error($input, $cookie, $template, { module => 'CSRF_TOKEN_CHECK' });	146	output_and_exit_if_error($input, $cookie, $template, { check => 'csrf_token' });
147		147
148	if ( $is_an_edit ) {	148	if ( $is_an_edit ) {
149	ModBasketHeader(	149	ModBasketHeader(
150	-

Return to bug 22990

Lines 349-364 sub output_and_exit_if_error { Link Here

(-)a/C4/Output.pm (-9 / +8 lines)
349	# But in the long term we will want to get a biblio in parameter	349	# But in the long term we will want to get a biblio in parameter
350	$error = 'unknown_biblio' unless $params->{record};	350	$error = 'unknown_biblio' unless $params->{record};
351	}	351	}
352	elsif ( $params->{module} eq 'CSRF_TOKEN_CHECK' ) {	352	}
353	$error = 'wrong_csrf_token'	353	elsif ( $params->{check} eq 'csrf_token' ) {
354	unless Koha::Token->new->check_csrf(	354	$error = 'wrong_csrf_token'
355	{	355	unless Koha::Token->new->check_csrf(
356	session_id => scalar $query->cookie('CGISESSID'),	356	{
357	token => scalar $query->param('csrf_token'),	357	session_id => scalar $query->cookie('CGISESSID'),
358	}	358	token => scalar $query->param('csrf_token'),
359	);
360	}	359	}
361	}	360	);
362	}	361	}
363	output_and_exit( $query, $cookie, $template, $error ) if $error;	362	output_and_exit( $query, $cookie, $template, $error ) if $error;
364	return;	363	return;