|
Lines 33-38
use Scalar::Util qw( looks_like_number );
Link Here
|
| 33 |
use C4::Auth qw( get_template_and_user ); |
33 |
use C4::Auth qw( get_template_and_user ); |
| 34 |
use C4::Context; |
34 |
use C4::Context; |
| 35 |
use C4::Templates; |
35 |
use C4::Templates; |
|
|
36 |
use Koha::Token; |
| 36 |
|
37 |
|
| 37 |
our (@ISA, @EXPORT_OK); |
38 |
our (@ISA, @EXPORT_OK); |
| 38 |
|
39 |
|
|
Lines 311-319
sub is_ajax {
Link Here
|
| 311 |
To executed at the beginning of scripts to stop the script at this point if |
312 |
To executed at the beginning of scripts to stop the script at this point if |
| 312 |
some errors are found. |
313 |
some errors are found. |
| 313 |
|
314 |
|
| 314 |
Tests for module 'members': |
315 |
A series of tests can be run for a given module, or a specific check. |
| 315 |
* patron is not defined (we are looking for a patron that does no longer exist/never existed) |
316 |
Params "module" and "check" are mutually exclusive. |
| 316 |
* The logged in user cannot see patron's infos (feature 'cannot_see_patron_infos') |
317 |
|
|
|
318 |
Tests for modules: |
| 319 |
* members: |
| 320 |
- Patron is not defined (we are looking for a patron that does no longer exist/never existed) |
| 321 |
- The logged in user cannot see patron's infos (feature 'cannot_see_patron_infos') |
| 322 |
|
| 323 |
Tests for specific check: |
| 324 |
* csrf_token |
| 325 |
will test if the csrf_token CGI param is valid |
| 317 |
|
326 |
|
| 318 |
Others will be added here depending on the needs (for instance biblio does not exist will be useful). |
327 |
Others will be added here depending on the needs (for instance biblio does not exist will be useful). |
| 319 |
|
328 |
|
|
Lines 329-344
sub output_and_exit_if_error {
Link Here
|
| 329 |
if ( not $current_patron ) { |
338 |
if ( not $current_patron ) { |
| 330 |
$error = 'unknown_patron'; |
339 |
$error = 'unknown_patron'; |
| 331 |
} |
340 |
} |
| 332 |
elsif( not $logged_in_user->can_see_patron_infos( $current_patron ) ) { |
341 |
elsif ( not $logged_in_user->can_see_patron_infos($current_patron) ) |
|
|
342 |
{ |
| 333 |
$error = 'cannot_see_patron_infos'; |
343 |
$error = 'cannot_see_patron_infos'; |
| 334 |
} |
344 |
} |
| 335 |
} elsif ( $params->{module} eq 'cataloguing' ) { |
345 |
} |
|
|
346 |
elsif ( $params->{module} eq 'cataloguing' ) { |
| 336 |
# We are testing the record to avoid additem to fetch the Koha::Biblio |
347 |
# We are testing the record to avoid additem to fetch the Koha::Biblio |
| 337 |
# But in the long term we will want to get a biblio in parameter |
348 |
# But in the long term we will want to get a biblio in parameter |
| 338 |
$error = 'unknown_biblio' unless $params->{record}; |
349 |
$error = 'unknown_biblio' unless $params->{record}; |
| 339 |
} |
350 |
} |
| 340 |
} |
351 |
} |
| 341 |
|
352 |
elsif ( $params and exists $params->{check} ) { |
|
|
353 |
if ( $params->{check} eq 'csrf_token' ) { |
| 354 |
$error = 'wrong_csrf_token' |
| 355 |
unless Koha::Token->new->check_csrf( |
| 356 |
{ |
| 357 |
session_id => scalar $query->cookie('CGISESSID'), |
| 358 |
token => scalar $query->param('csrf_token'), |
| 359 |
} |
| 360 |
); |
| 361 |
} |
| 362 |
} |
| 342 |
output_and_exit( $query, $cookie, $template, $error ) if $error; |
363 |
output_and_exit( $query, $cookie, $template, $error ) if $error; |
| 343 |
return; |
364 |
return; |
| 344 |
} |
365 |
} |