Attachment #133238 for bug #22990

View | Details | Raw Unified | Return to bug 22990
Collapse All | Expand All

Lines 49-54 use C4::Auth_with_shibboleth qw( shib_ok get_login_shib login_shib_url logout_sh Link Here

(-)a/C4/Auth.pm (+2 lines)
49	use Net::CIDR;	49	use Net::CIDR;
50	use C4::Log qw( logaction );	50	use C4::Log qw( logaction );
51	use Koha::CookieManager;	51	use Koha::CookieManager;
		52	use Koha::Token;
52		53
53	# use utf8;	54	# use utf8;
54		55
Lines 299-304 sub get_template_and_user { Link Here
299	$template->param( loggedinusernumber => $borrowernumber ); # FIXME Should be replaced with logged_in_user.borrowernumber	300	$template->param( loggedinusernumber => $borrowernumber ); # FIXME Should be replaced with logged_in_user.borrowernumber
300	$template->param( logged_in_user => $patron );	301	$template->param( logged_in_user => $patron );
301	$template->param( sessionID => $sessionID );	302	$template->param( sessionID => $sessionID );
		303	$template->param( csrf_token => Koha::Token->new->generate_csrf({ session_id => scalar $sessionID }));
302		304
303	if ( $in->{'type'} eq 'opac' ) {	305	if ( $in->{'type'} eq 'opac' ) {
304	require Koha::Virtualshelves;	306	require Koha::Virtualshelves;




use C4::Auth qw( get_template_and_user );
use C4::Context;
use C4::Templates;
use Koha::Token;

our (@ISA, @EXPORT_OK);


sub output_and_exit_if_error {
    my ( $query, $cookie, $template, $params ) = @_;
    my $error;
    if ($params->{module} eq 'CSRF_TOKEN_CHECK') {
        my $csrfcheck = Koha::Token->new->check_csrf( {
            session_id => scalar $cookie,
            token  => scalar $params->{csrf_token},
        });
        unless ($csrfcheck) {
            $error = 'wrong_csrf_token';
        }

    } else {
        if ( $params and exists $params->{module} ) {
            if ( $params->{module} eq 'members' ) {
                my $logged_in_user = $params->{logged_in_user};
                my $current_patron = $params->{current_patron};
                if ( not $current_patron ) {
                    $error = 'unknown_patron';
                }
                elsif( not $logged_in_user->can_see_patron_infos( $current_patron ) ) {
                    $error = 'cannot_see_patron_infos';
                }
            }
        } elsif ( $params->{module} eq 'cataloguing' ) {
            # We are testing the record to avoid additem to fetch the Koha::Biblio

            $error = 'unknown_biblio' unless $params->{record};
        }
    }

    output_and_exit( $query, $cookie, $template, $error ) if $error;
    return;
}

Lines 141-146 if ( $op eq 'add_form' ) { Link Here

(-)a/acqui/basketheader.pl (+2 lines)
141	#End Edit	141	#End Edit
142	} elsif ( $op eq 'add_validate' ) {	142	} elsif ( $op eq 'add_validate' ) {
143	#we are confirming the changes, save the basket	143	#we are confirming the changes, save the basket
		144	#we are checking CSRF Token. Module CSRF_TOKEN_CHECK indicate for CSRF token checking,
		145	output_and_exit_if_error( $input, $input->cookie('CGISESSID'), $template, { module => 'CSRF_TOKEN_CHECK', csrf_token => $input->param('csrf_token') } );
144	if ( $is_an_edit ) {	146	if ( $is_an_edit ) {
145	ModBasketHeader(	147	ModBasketHeader(
146	$basketno,	148	$basketno,

Line 0 Link Here

(-)a/koha-tmpl/intranet-tmpl/prog/en/includes/csrf-token.inc (+1 lines)
	1	<input type="hidden" name="csrf_token" value="[% csrf_token \| html %]" />




<div class="main container-fluid">
    <div class="row">
        <div class="col-md-10 col-md-offset-1 col-lg-8 col-lg-offset-2">
    [% INCLUDE 'blocking_errors.inc' %]
    [% IF ( add_form ) %]
        [% IF ( basketno ) %]
            <h1>Edit basket [% basketname | html %]</h1>
        [% ELSE %]<h1>Add a basket to [% booksellername | html %]</h1>
        [% END %]
    <form name="Aform" action="[% script_name | html %]" method="post" class="validated">
        [% INCLUDE 'csrf-token.inc' %]
        <input type="hidden" name="booksellerid" value="[% booksellerid | html %]" />
        <fieldset class="rows">
            <ol>
- 

Return to bug 22990

Lines 33-38 use Scalar::Util qw( looks_like_number ); Link Here

(-)a/C4/Output.pm (-10 / +21 lines)
33	use C4::Auth qw( get_template_and_user );	33	use C4::Auth qw( get_template_and_user );
34	use C4::Context;	34	use C4::Context;
35	use C4::Templates;	35	use C4::Templates;
		36	use Koha::Token;
36		37
37	our (@ISA, @EXPORT_OK);	38	our (@ISA, @EXPORT_OK);
38		39
Lines 322-336 Others will be added here depending on the needs (for instance biblio does not e Link Here
322	sub output_and_exit_if_error {	323	sub output_and_exit_if_error {
323	my ( $query, $cookie, $template, $params ) = @_;	324	my ( $query, $cookie, $template, $params ) = @_;
324	my $error;	325	my $error;
325	if ( $params and exists $params->{module} ) {	326	if ($params->{module} eq 'CSRF_TOKEN_CHECK') {
326	if ( $params->{module} eq 'members' ) {	327	my $csrfcheck = Koha::Token->new->check_csrf( {
327	my $logged_in_user = $params->{logged_in_user};	328	session_id => scalar $cookie,
328	my $current_patron = $params->{current_patron};	329	token => scalar $params->{csrf_token},
329	if ( not $current_patron ) {	330	});
330	$error = 'unknown_patron';	331	unless ($csrfcheck) {
331	}	332	$error = 'wrong_csrf_token';
332	elsif( not $logged_in_user->can_see_patron_infos( $current_patron ) ) {	333	}
333	$error = 'cannot_see_patron_infos';	334
		335	} else {
		336	if ( $params and exists $params->{module} ) {
		337	if ( $params->{module} eq 'members' ) {
		338	my $logged_in_user = $params->{logged_in_user};
		339	my $current_patron = $params->{current_patron};
		340	if ( not $current_patron ) {
		341	$error = 'unknown_patron';
		342	}
		343	elsif( not $logged_in_user->can_see_patron_infos( $current_patron ) ) {
		344	$error = 'cannot_see_patron_infos';
		345	}
334	}	346	}
335	} elsif ( $params->{module} eq 'cataloguing' ) {	347	} elsif ( $params->{module} eq 'cataloguing' ) {
336	# We are testing the record to avoid additem to fetch the Koha::Biblio	348	# We are testing the record to avoid additem to fetch the Koha::Biblio
Lines 338-344 sub output_and_exit_if_error { Link Here
338	$error = 'unknown_biblio' unless $params->{record};	350	$error = 'unknown_biblio' unless $params->{record};
339	}	351	}
340	}	352	}
341
342	output_and_exit( $query, $cookie, $template, $error ) if $error;	353	output_and_exit( $query, $cookie, $template, $error ) if $error;
343	return;	354	return;
344	}	355	}

Lines 50-62 Link Here

(-)a/koha-tmpl/intranet-tmpl/prog/en/modules/acqui/basketheader.tt (-2 / +2 lines)
50	<div class="main container-fluid">	50	<div class="main container-fluid">
51	<div class="row">	51	<div class="row">
52	<div class="col-md-10 col-md-offset-1 col-lg-8 col-lg-offset-2">	52	<div class="col-md-10 col-md-offset-1 col-lg-8 col-lg-offset-2">
53		53	[% INCLUDE 'blocking_errors.inc' %]
54	[% IF ( add_form ) %]	54	[% IF ( add_form ) %]
55	[% IF ( basketno ) %]	55	[% IF ( basketno ) %]
56	<h1>Edit basket [% basketname \| html %]</h1>	56	<h1>Edit basket [% basketname \| html %]</h1>
57	[% ELSE %]<h1>Add a basket to [% booksellername \| html %]</h1>	57	[% ELSE %]<h1>Add a basket to [% booksellername \| html %]</h1>
58	[% END %]	58	[% END %]
59	<form name="Aform" action="[% script_name \| html %]" method="post" class="validated">	59	<form name="Aform" action="[% script_name \| html %]" method="post" class="validated">
		60	[% INCLUDE 'csrf-token.inc' %]
60	<input type="hidden" name="booksellerid" value="[% booksellerid \| html %]" />	61	<input type="hidden" name="booksellerid" value="[% booksellerid \| html %]" />
61	<fieldset class="rows">	62	<fieldset class="rows">
62	<ol>	63	<ol>
63	-