Attachment #124926 for bug #22990

View | Details | Raw Unified | Return to bug 22990
Collapse All | Expand All




            # But in the long term we will want to get a biblio in parameter
            $error = 'unknown_biblio' unless $params->{record};
        }
    }
    elsif ( $params->{check} eq 'csrf_token' ) {
        $error = 'wrong_csrf_token'
          unless Koha::Token->new->check_csrf(
            {
                session_id => scalar $query->cookie('CGISESSID'),
                token      => scalar $query->param('csrf_token'),
              );
            }
          );
    }
    output_and_exit( $query, $cookie, $template, $error ) if $error;
    return;

Lines 141-148 if ( $op eq 'add_form' ) { Link Here

(-)a/acqui/basketheader.pl (-3 / +2 lines)
141	#End Edit	141	#End Edit
142	} elsif ( $op eq 'add_validate' ) {	142	} elsif ( $op eq 'add_validate' ) {
143	#we are confirming the changes, save the basket	143	#we are confirming the changes, save the basket
144	#we are checking CSRF Token. Module CSRF_TOKEN_CHECK indicate for CSRF token checking,	144	#we are checking CSRF Token.
145	output_and_exit_if_error($input, $cookie, $template, { module => 'CSRF_TOKEN_CHECK' });	145	output_and_exit_if_error($input, $cookie, $template, { check => 'csrf_token' });
146		146
147	if ( $is_an_edit ) {	147	if ( $is_an_edit ) {
148	ModBasketHeader(	148	ModBasketHeader(
149	-

Return to bug 22990

Lines 340-355 sub output_and_exit_if_error { Link Here

(-)a/C4/Output.pm (-9 / +8 lines)
340	# But in the long term we will want to get a biblio in parameter	340	# But in the long term we will want to get a biblio in parameter
341	$error = 'unknown_biblio' unless $params->{record};	341	$error = 'unknown_biblio' unless $params->{record};
342	}	342	}
343	elsif ( $params->{module} eq 'CSRF_TOKEN_CHECK' ) {	343	}
344	$error = 'wrong_csrf_token'	344	elsif ( $params->{check} eq 'csrf_token' ) {
345	unless Koha::Token->new->check_csrf(	345	$error = 'wrong_csrf_token'
346	{	346	unless Koha::Token->new->check_csrf(
347	session_id => scalar $query->cookie('CGISESSID'),	347	{
348	token => scalar $query->param('csrf_token'),	348	session_id => scalar $query->cookie('CGISESSID'),
349	}	349	token => scalar $query->param('csrf_token'),
350	);
351	}	350	}
352	}	351	);
353	}	352	}
354	output_and_exit( $query, $cookie, $template, $error ) if $error;	353	output_and_exit( $query, $cookie, $template, $error ) if $error;
355	return;	354	return;