Attachment #124925 for bug #22990

View | Details | Raw Unified | Return to bug 22990
Collapse All | Expand All




sub output_and_exit_if_error {
    my ( $query, $cookie, $template, $params ) = @_;
    my $error;
    if ( $params and exists $params->{module} ) {
        if ( $params->{module} eq 'members' ) {
            my $logged_in_user = $params->{logged_in_user};
            my $current_patron = $params->{current_patron};
            if ( not $current_patron ) {
                $error = 'unknown_patron';
            }
            elsif ( not $logged_in_user->can_see_patron_infos($current_patron) )
            {
                $error = 'cannot_see_patron_infos';
        if ( $params and exists $params->{module} ) {
            if ( $params->{module} eq 'members' ) {
                my $logged_in_user = $params->{logged_in_user};
                my $current_patron = $params->{current_patron};
                if ( not $current_patron ) {
                    $error = 'unknown_patron';
                }
                elsif( not $logged_in_user->can_see_patron_infos( $current_patron ) ) {
                    $error = 'cannot_see_patron_infos';
                }
            }
        }
        elsif ( $params->{module} eq 'cataloguing' ) {
            # We are testing the record to avoid additem to fetch the Koha::Biblio
            # But in the long term we will want to get a biblio in parameter
            $error = 'unknown_biblio' unless $params->{record};
        }
        elsif ( $params->{module} eq 'CSRF_TOKEN_CHECK' ) {
            $error = 'wrong_csrf_token'
              unless Koha::Token->new->check_csrf(
                {
                    session_id => scalar $query->cookie('CGISESSID'),
                    token      => scalar $query->param('csrf_token'),
                }
              );
            }
        }
    }
    output_and_exit( $query, $cookie, $template, $error ) if $error;
    return;

Lines 142-148 if ( $op eq 'add_form' ) { Link Here

(-)a/acqui/basketheader.pl (-2 / +2 lines)
142	} elsif ( $op eq 'add_validate' ) {	142	} elsif ( $op eq 'add_validate' ) {
143	#we are confirming the changes, save the basket	143	#we are confirming the changes, save the basket
144	#we are checking CSRF Token. Module CSRF_TOKEN_CHECK indicate for CSRF token checking,	144	#we are checking CSRF Token. Module CSRF_TOKEN_CHECK indicate for CSRF token checking,
145	output_and_exit_if_error( $input, $input->cookie('CGISESSID'), $template, { module => 'CSRF_TOKEN_CHECK', csrf_token => $input->param('csrf_token') } );	145	output_and_exit_if_error($input, $cookie, $template, { module => 'CSRF_TOKEN_CHECK' });
		146
146	if ( $is_an_edit ) {	147	if ( $is_an_edit ) {
147	ModBasketHeader(	148	ModBasketHeader(
148	$basketno,	149	$basketno,
149	-

Return to bug 22990

Lines 323-354 Others will be added here depending on the needs (for instance biblio does not e Link Here

(-)a/C4/Output.pm (-21 / +22 lines)
323	sub output_and_exit_if_error {	323	sub output_and_exit_if_error {
324	my ( $query, $cookie, $template, $params ) = @_;	324	my ( $query, $cookie, $template, $params ) = @_;
325	my $error;	325	my $error;
326	if ($params->{module} eq 'CSRF_TOKEN_CHECK') {	326	if ( $params and exists $params->{module} ) {
327	my $csrfcheck = Koha::Token->new->check_csrf( {	327	if ( $params->{module} eq 'members' ) {
328	session_id => scalar $cookie,	328	my $logged_in_user = $params->{logged_in_user};
329	token => scalar $params->{csrf_token},	329	my $current_patron = $params->{current_patron};
330	});	330	if ( not $current_patron ) {
331	unless ($csrfcheck) {	331	$error = 'unknown_patron';
332	$error = 'wrong_csrf_token';	332	}
333	}	333	elsif ( not $logged_in_user->can_see_patron_infos($current_patron) )
334		334	{
335	} else {	335	$error = 'cannot_see_patron_infos';
336	if ( $params and exists $params->{module} ) {
337	if ( $params->{module} eq 'members' ) {
338	my $logged_in_user = $params->{logged_in_user};
339	my $current_patron = $params->{current_patron};
340	if ( not $current_patron ) {
341	$error = 'unknown_patron';
342	}
343	elsif( not $logged_in_user->can_see_patron_infos( $current_patron ) ) {
344	$error = 'cannot_see_patron_infos';
345	}
346	}	336	}
347	} elsif ( $params->{module} eq 'cataloguing' ) {	337	}
		338	elsif ( $params->{module} eq 'cataloguing' ) {
348	# We are testing the record to avoid additem to fetch the Koha::Biblio	339	# We are testing the record to avoid additem to fetch the Koha::Biblio
349	# But in the long term we will want to get a biblio in parameter	340	# But in the long term we will want to get a biblio in parameter
350	$error = 'unknown_biblio' unless $params->{record};	341	$error = 'unknown_biblio' unless $params->{record};
351	}	342	}
		343	elsif ( $params->{module} eq 'CSRF_TOKEN_CHECK' ) {
		344	$error = 'wrong_csrf_token'
		345	unless Koha::Token->new->check_csrf(
		346	{
		347	session_id => scalar $query->cookie('CGISESSID'),
		348	token => scalar $query->param('csrf_token'),
		349	}
		350	);
		351	}
		352	}
352	}	353	}
353	output_and_exit( $query, $cookie, $template, $error ) if $error;	354	output_and_exit( $query, $cookie, $template, $error ) if $error;
354	return;	355	return;