View | Details | Raw Unified | Return to bug 34369
Collapse All | Expand All

(-)a/admin/preferences.pl (-1 / +2 lines)
Lines 25-31 use C4::Context; Link Here
25
use C4::Koha qw( getallthemes );
25
use C4::Koha qw( getallthemes );
26
use C4::Languages qw( getTranslatedLanguages );
26
use C4::Languages qw( getTranslatedLanguages );
27
use C4::ClassSource qw( GetClassSources GetClassSource );
27
use C4::ClassSource qw( GetClassSources GetClassSource );
28
use C4::Output qw( output_html_with_http_headers );
28
use C4::Output qw( output_html_with_http_headers output_and_exit_if_error );
29
use C4::Templates;
29
use C4::Templates;
30
use Koha::Acquisition::Currencies;
30
use Koha::Acquisition::Currencies;
31
use Koha::Database::Columns;
31
use Koha::Database::Columns;
Lines 348-353 $tab ||= 'accounting'; # Ideally this should be "local-use" but preferences.pl Link Here
348
my $highlighted;
348
my $highlighted;
349
349
350
if ( $op eq 'save' ) {
350
if ( $op eq 'save' ) {
351
    output_and_exit_if_error($input, $cookie, $template, { check => 'csrf_token' });
351
    foreach my $param ( $input->param() ) {
352
    foreach my $param ( $input->param() ) {
352
        my ( $pref ) = ( $param =~ /pref_(.*)/ );
353
        my ( $pref ) = ( $param =~ /pref_(.*)/ );
353
354
(-)a/admin/systempreferences.pl (-1 / +4 lines)
Lines 49-55 use C4::Context; Link Here
49
use C4::Koha qw( getallthemes );
49
use C4::Koha qw( getallthemes );
50
use C4::Languages qw( getTranslatedLanguages );
50
use C4::Languages qw( getTranslatedLanguages );
51
use C4::ClassSource qw( GetClassSources GetClassSource );
51
use C4::ClassSource qw( GetClassSources GetClassSource );
52
use C4::Output qw( output_html_with_http_headers );
52
use C4::Output qw( output_html_with_http_headers output_and_exit_if_error );
53
use YAML::XS;
53
use YAML::XS;
54
54
55
my %tabsysprefs; #we do no longer need to keep track of a tab per pref (yaml)
55
my %tabsysprefs; #we do no longer need to keep track of a tab per pref (yaml)
Lines 235-240 if ($op) { Link Here
235
}
235
}
236
236
237
if ( $op eq 'update_and_reedit' ) {
237
if ( $op eq 'update_and_reedit' ) {
238
    output_and_exit_if_error($input, $cookie, $template, { check => 'csrf_token' });
238
    foreach ( $input->param ) {
239
    foreach ( $input->param ) {
239
    }
240
    }
240
    my $value = '';
241
    my $value = '';
Lines 302-307 if ( $op eq 'add_form' ) { Link Here
302
################## ADD_VALIDATE ##################################
303
################## ADD_VALIDATE ##################################
303
    # called by add_form, used to insert/modify data in DB
304
    # called by add_form, used to insert/modify data in DB
304
} elsif ( $op eq 'add_validate' ) {
305
} elsif ( $op eq 'add_validate' ) {
306
    output_and_exit_if_error($input, $cookie, $template, { check => 'csrf_token' });
305
    # to handle multiple values
307
    # to handle multiple values
306
    my $value;
308
    my $value;
307
309
Lines 348-353 if ( $op eq 'add_form' ) { Link Here
348
################## DELETE_CONFIRMED ##################################
350
################## DELETE_CONFIRMED ##################################
349
    # called by delete_confirm, used to effectively confirm deletion of data in DB
351
    # called by delete_confirm, used to effectively confirm deletion of data in DB
350
} elsif ( $op eq 'delete_confirmed' ) {
352
} elsif ( $op eq 'delete_confirmed' ) {
353
    output_and_exit_if_error($input, $cookie, $template, { check => 'csrf_token' });
351
    C4::Context->delete_preference($searchfield);
354
    C4::Context->delete_preference($searchfield);
352
    # END $OP eq DELETE_CONFIRMED
355
    # END $OP eq DELETE_CONFIRMED
353
################## DEFAULT ##################################
356
################## DEFAULT ##################################
(-)a/koha-tmpl/intranet-tmpl/prog/en/modules/admin/preferences.tt (+1 lines)
Lines 53-58 Link Here
53
    <div class="prefs-tab">
53
    <div class="prefs-tab">
54
    <h2>[% TAB.tab_title | html %] preferences</h2>
54
    <h2>[% TAB.tab_title | html %] preferences</h2>
55
    <form action="/cgi-bin/koha/admin/preferences.pl" method="post">
55
    <form action="/cgi-bin/koha/admin/preferences.pl" method="post">
56
        [% INCLUDE 'csrf-token.inc' %]
56
        [% UNLESS ( searchfield ) %]<div id="toolbar"><button class="save-all btn btn-primary" type="submit">Save all [% TAB.tab_title | html %] preferences</button></div>[% END %]
57
        [% UNLESS ( searchfield ) %]<div id="toolbar"><button class="save-all btn btn-primary" type="submit">Save all [% TAB.tab_title | html %] preferences</button></div>[% END %]
57
        <input type="hidden" name="op" value="save" />
58
        <input type="hidden" name="op" value="save" />
58
        <input type="hidden" name="tab" value="[% TAB.tab_id | html %]" />
59
        <input type="hidden" name="tab" value="[% TAB.tab_id | html %]" />
(-)a/koha-tmpl/intranet-tmpl/prog/en/modules/admin/systempreferences.tt (+5 lines)
Lines 81-86 Link Here
81
    [% END #/ WRAPPER breadcrumbs %]
81
    [% END #/ WRAPPER breadcrumbs %]
82
[% END #/ WRAPPER sub-header.inc %]
82
[% END #/ WRAPPER sub-header.inc %]
83
83
84
[% INCLUDE 'blocking_errors.inc' %]
85
84
<div class="main container-fluid">
86
<div class="main container-fluid">
85
    <div class="row">
87
    <div class="row">
86
        <div class="col-sm-10 col-sm-push-2">
88
        <div class="col-sm-10 col-sm-push-2">
Lines 92-97 Link Here
92
        [% ELSE %]
94
        [% ELSE %]
93
            <form action="[% script_name | html %]" name="Aform" method="post">
95
            <form action="[% script_name | html %]" name="Aform" method="post">
94
        [% END %]
96
        [% END %]
97
        [% INCLUDE 'csrf-token.inc' %]
95
        <fieldset class="rows"><legend>
98
        <fieldset class="rows"><legend>
96
        <h1>
99
        <h1>
97
        [% IF ( modify ) %]Modify
100
        [% IF ( modify ) %]Modify
Lines 287-292 Link Here
287
        [% Tvalue | html %]
290
        [% Tvalue | html %]
288
        </td></tr></table>
291
        </td></tr></table>
289
        <form class="inline" action="[% script_name | html %]" method="post">
292
        <form class="inline" action="[% script_name | html %]" method="post">
293
        [% INCLUDE 'csrf-token.inc' %]
290
        <input type="hidden" name="op" value="delete_confirmed" />
294
        <input type="hidden" name="op" value="delete_confirmed" />
291
        <input type="hidden" name="searchfield" value="[% searchfield | html %]" />
295
        <input type="hidden" name="searchfield" value="[% searchfield | html %]" />
292
        <input type="hidden" name="Tvalue" value="[% Tvalue | html %]" />
296
        <input type="hidden" name="Tvalue" value="[% Tvalue | html %]" />
Lines 335-340 Link Here
335
        [% ELSE %]
339
        [% ELSE %]
336
            <form action="/cgi-bin/koha/admin/systempreferences.pl" method="post">
340
            <form action="/cgi-bin/koha/admin/systempreferences.pl" method="post">
337
        [% END %]
341
        [% END %]
342
            [% INCLUDE 'csrf-token.inc' %]
338
                [% IF ( loo.type_free ) %]
343
                [% IF ( loo.type_free ) %]
339
                <input type="text" name="value" size="[% loo.fieldlength | html %]" value="[% loo.value | html %]" />
344
                <input type="text" name="value" size="[% loo.fieldlength | html %]" value="[% loo.value | html %]" />
340
                [% END %]
345
                [% END %]
(-)a/koha-tmpl/intranet-tmpl/prog/js/pages/preferences.js (+7 lines)
Lines 25-30 KOHA.Preferences = { Link Here
25
            humanMsg.displayAlert( __("Nothing to save") );
25
            humanMsg.displayAlert( __("Nothing to save") );
26
            return;
26
            return;
27
        }
27
        }
28
        let csrf_token_el = $( form ).find('input[name="csrf_token"]');
29
        if (csrf_token_el.length > 0){
30
            let csrf_token = csrf_token_el.val();
31
            if (csrf_token){
32
                data += '&' + 'csrf_token=' + csrf_token;
33
            }
34
        }
28
        KOHA.AJAX.MarkRunning($(form).find('.save-all'), __("Saving...") );
35
        KOHA.AJAX.MarkRunning($(form).find('.save-all'), __("Saving...") );
29
        KOHA.AJAX.Submit( {
36
        KOHA.AJAX.Submit( {
30
            data: data,
37
            data: data,
(-)a/svc/config/systempreferences (-1 / +14 lines)
Lines 23-28 use Modern::Perl; Link Here
23
use C4::Context;
23
use C4::Context;
24
use C4::Service;
24
use C4::Service;
25
use C4::Log;
25
use C4::Log;
26
use Koha::Token;
26
27
27
=head1 NAME
28
=head1 NAME
28
29
Lines 63-68 Used to set a single system preference. Link Here
63
64
64
sub set_preference {
65
sub set_preference {
65
    my ( $preference ) = @_;
66
    my ( $preference ) = @_;
67
    die "wrong_csrf_token\n" unless Koha::Token->new->check_csrf(
68
        {
69
            session_id => scalar $query->cookie('CGISESSID'),
70
            token      => scalar $query->param('csrf_token'),
71
        }
72
    );
66
73
67
    my $value = join( ',', $query->param( 'value' ) );
74
    my $value = join( ',', $query->param( 'value' ) );
68
    C4::Context->set_preference( $preference, $value );
75
    C4::Context->set_preference( $preference, $value );
Lines 122-127 pref_virtualshelves=0 Link Here
122
=cut
129
=cut
123
130
124
sub set_preferences {
131
sub set_preferences {
132
    die "wrong_csrf_token\n" unless Koha::Token->new->check_csrf(
133
        {
134
            session_id => scalar $query->cookie('CGISESSID'),
135
            token      => scalar $query->param('csrf_token'),
136
        }
137
    );
138
125
    foreach my $param ( $query->param() ) {
139
    foreach my $param ( $query->param() ) {
126
        my ( $pref ) = ( $param =~ /pref_(.*)/ );
140
        my ( $pref ) = ( $param =~ /pref_(.*)/ );
127
141
128
- 

Return to bug 34369