View | Details | Raw Unified | Return to bug 34478
Collapse All | Expand All

(-)a/C4/Output.pm (-1 lines)
Lines 34-40 use URI::Escape; Link Here
34
use C4::Auth qw( get_template_and_user );
34
use C4::Auth qw( get_template_and_user );
35
use C4::Context;
35
use C4::Context;
36
use C4::Templates;
36
use C4::Templates;
37
use Koha::Token;
38
37
39
our (@ISA, @EXPORT_OK);
38
our (@ISA, @EXPORT_OK);
40
39
(-)a/authorities/authorities-home.pl (-7 lines)
Lines 33-39 use C4::Languages; Link Here
33
use Koha::Authority::Types;
33
use Koha::Authority::Types;
34
use Koha::SearchEngine::Search;
34
use Koha::SearchEngine::Search;
35
use Koha::SearchEngine::QueryBuilder;
35
use Koha::SearchEngine::QueryBuilder;
36
use Koha::Token;
37
use Koha::XSLT::Base;
36
use Koha::XSLT::Base;
38
use Koha::Z3950Servers;
37
use Koha::Z3950Servers;
39
38
Lines 58-69 if ( $op eq "delete" ) { Link Here
58
        }
57
        }
59
    );
58
    );
60
59
61
    output_and_exit( $query, $cookie, $template, 'wrong_csrf_token' )
62
        unless Koha::Token->new->check_csrf({
63
            session_id => scalar $query->cookie('CGISESSID'),
64
            token  => scalar $query->param('csrf_token'),
65
        });
66
67
    DelAuthority({ authid => $authid });
60
    DelAuthority({ authid => $authid });
68
    # FIXME No error handling here, DelAuthority needs adjustments
61
    # FIXME No error handling here, DelAuthority needs adjustments
69
    $pending_deletion_authid = $authid;
62
    $pending_deletion_authid = $authid;
(-)a/basket/sendbasket.pl (-8 lines)
Lines 30-36 use C4::Output qw( output_and_exit output_html_with_http_headers ); Link Here
30
use C4::Templates;
30
use C4::Templates;
31
use Koha::Biblios;
31
use Koha::Biblios;
32
use Koha::Email;
32
use Koha::Email;
33
use Koha::Token;
34
33
35
my $query = CGI->new;
34
my $query = CGI->new;
36
35
Lines 49-61 my $email_add = $query->param('email_add'); Link Here
49
my $dbh = C4::Context->dbh;
48
my $dbh = C4::Context->dbh;
50
49
51
if ($email_add) {
50
if ($email_add) {
52
    output_and_exit( $query, $cookie, $template, 'wrong_csrf_token' )
53
      unless Koha::Token->new->check_csrf(
54
        {
55
            session_id => scalar $query->cookie('CGISESSID'),
56
            token      => scalar $query->param('csrf_token'),
57
        }
58
      );
59
51
60
    my $patron     = Koha::Patrons->find($borrowernumber);
52
    my $patron     = Koha::Patrons->find($borrowernumber);
61
    my $user_email = $patron->notice_email_address;
53
    my $user_email = $patron->notice_email_address;
(-)a/ill/ill-requests.pl (-5 lines)
Lines 30-36 use Koha::Illrequests; Link Here
30
use Koha::Illrequest::Workflow::Availability;
30
use Koha::Illrequest::Workflow::Availability;
31
use Koha::Illrequest::Workflow::TypeDisclaimer;
31
use Koha::Illrequest::Workflow::TypeDisclaimer;
32
use Koha::Libraries;
32
use Koha::Libraries;
33
use Koha::Token;
34
33
35
use Try::Tiny qw( catch try );
34
use Try::Tiny qw( catch try );
36
use URI::Escape qw( uri_escape_utf8 );
35
use URI::Escape qw( uri_escape_utf8 );
Lines 373-382 if ( $backends_available ) { Link Here
373
            prefilters => join("&", @tpl_arr)
372
            prefilters => join("&", @tpl_arr)
374
        );
373
        );
375
    } elsif ( $op eq "save_comment" ) {
374
    } elsif ( $op eq "save_comment" ) {
376
        die "Wrong CSRF token" unless Koha::Token->new->check_csrf({
377
           session_id => scalar $cgi->cookie('CGISESSID'),
378
           token      => scalar $cgi->param('csrf_token'),
379
        });
380
        my $comment = Koha::Illcomment->new({
375
        my $comment = Koha::Illcomment->new({
381
            illrequest_id  => scalar $params->{illrequest_id},
376
            illrequest_id  => scalar $params->{illrequest_id},
382
            borrowernumber => $patronnumber,
377
            borrowernumber => $patronnumber,
(-)a/members/apikeys.pl (-13 lines)
Lines 26-32 use C4::Output qw( output_and_exit output_html_with_http_headers ); Link Here
26
26
27
use Koha::ApiKeys;
27
use Koha::ApiKeys;
28
use Koha::Patrons;
28
use Koha::Patrons;
29
use Koha::Token;
30
29
31
my $cgi = CGI->new;
30
my $cgi = CGI->new;
32
31
Lines 60-77 if( $patron_id != $loggedinuser && !C4::Context->IsSuperLibrarian() ) { Link Here
60
59
61
my $op = $cgi->param('op') // '';
60
my $op = $cgi->param('op') // '';
62
61
63
if ( $op eq 'generate' or
64
     $op eq 'delete' or
65
     $op eq 'revoke' or
66
     $op eq 'activate' ) {
67
68
    output_and_exit( $cgi, $cookie, $template, 'wrong_csrf_token' )
69
        unless Koha::Token->new->check_csrf({
70
            session_id => scalar $cgi->cookie('CGISESSID'),
71
            token      => scalar $cgi->param('csrf_token'),
72
        });
73
}
74
75
if ($op) {
62
if ($op) {
76
    if ( $op eq 'generate' ) {
63
    if ( $op eq 'generate' ) {
77
        my $description = $cgi->param('description') // '';
64
        my $description = $cgi->param('description') // '';
(-)a/members/cancel-charge.pl (-11 lines)
Lines 20-26 use Modern::Perl; Link Here
20
use CGI;
20
use CGI;
21
21
22
use C4::Auth qw( checkauth );
22
use C4::Auth qw( checkauth );
23
use Koha::Token;
24
23
25
my $cgi = CGI->new;
24
my $cgi = CGI->new;
26
25
Lines 33-48 my $flags = { Link Here
33
my $type = 'intranet';
32
my $type = 'intranet';
34
my ($user, $cookie) = C4::Auth::checkauth($cgi, $authnotrequired, $flags, $type);
33
my ($user, $cookie) = C4::Auth::checkauth($cgi, $authnotrequired, $flags, $type);
35
34
36
my $csrf_token_is_valid = Koha::Token->new->check_csrf( {
37
    session_id => scalar $cgi->cookie('CGISESSID'),
38
    token  => scalar $cgi->param('csrf_token'),
39
});
40
unless ($csrf_token_is_valid) {
41
    print $cgi->header('text/plain', '403 Forbidden');
42
    print 'Wrong CSRF token';
43
    exit;
44
}
45
46
my $borrowernumber = $cgi->param('borrowernumber');
35
my $borrowernumber = $cgi->param('borrowernumber');
47
my $accountlines_id = $cgi->param('accountlines_id');
36
my $accountlines_id = $cgi->param('accountlines_id');
48
37
(-)a/members/mancredit.pl (-9 lines)
Lines 36-43 use Koha::Patron::Categories; Link Here
36
use Koha::Account::CreditTypes;
36
use Koha::Account::CreditTypes;
37
use Koha::AdditionalFields;
37
use Koha::AdditionalFields;
38
38
39
use Koha::Token;
40
41
my $input = CGI->new;
39
my $input = CGI->new;
42
my ( $template, $loggedinuser, $cookie ) = get_template_and_user(
40
my ( $template, $loggedinuser, $cookie ) = get_template_and_user(
43
    {
41
    {
Lines 70-82 my $library_id = Link Here
70
68
71
my $add = $input->param('add');
69
my $add = $input->param('add');
72
if ($add) {
70
if ($add) {
73
    output_and_exit( $input, $cookie, $template, 'wrong_csrf_token' )
74
      unless Koha::Token->new->check_csrf(
75
        {
76
            session_id => scalar $input->cookie('CGISESSID'),
77
            token      => scalar $input->param('csrf_token'),
78
        }
79
      );
80
71
81
# Note: If the logged in user is not allowed to see this patron an invoice can be forced
72
# Note: If the logged in user is not allowed to see this patron an invoice can be forced
82
# Here we are trusting librarians not to hack the system
73
# Here we are trusting librarians not to hack the system
(-)a/members/maninvoice.pl (-9 lines)
Lines 31-37 use C4::Output qw( output_and_exit_if_error output_and_exit output_html_with_htt Link Here
31
use CGI qw ( -utf8 );
31
use CGI qw ( -utf8 );
32
use C4::Members;
32
use C4::Members;
33
use C4::Accounts;
33
use C4::Accounts;
34
use Koha::Token;
35
34
36
use Koha::Patrons;
35
use Koha::Patrons;
37
use Koha::Items;
36
use Koha::Items;
Lines 91-104 $template->param( Link Here
91
90
92
my $add = $input->param('add');
91
my $add = $input->param('add');
93
if ($add) {
92
if ($add) {
94
    output_and_exit( $input, $cookie, $template, 'wrong_csrf_token' )
95
      unless Koha::Token->new->check_csrf(
96
        {
97
            session_id => scalar $input->cookie('CGISESSID'),
98
            token      => scalar $input->param('csrf_token'),
99
        }
100
      );
101
102
    # Note: If the logged in user is not allowed to see this patron an invoice can be forced
93
    # Note: If the logged in user is not allowed to see this patron an invoice can be forced
103
    # Here we are trusting librarians not to hack the system
94
    # Here we are trusting librarians not to hack the system
104
    my $desc       = $input->param('desc');
95
    my $desc       = $input->param('desc');
(-)a/members/member-flags.pl (-8 lines)
Lines 15-21 use Koha::Patron::Categories; Link Here
15
use Koha::Patrons;
15
use Koha::Patrons;
16
16
17
use C4::Output qw( output_and_exit_if_error output_and_exit output_html_with_http_headers );
17
use C4::Output qw( output_and_exit_if_error output_and_exit output_html_with_http_headers );
18
use Koha::Token;
19
18
20
my $input = CGI->new;
19
my $input = CGI->new;
21
20
Lines 47-59 $member2{'borrowernumber'}=$member; Link Here
47
46
48
if ($input->param('newflags')) {
47
if ($input->param('newflags')) {
49
48
50
    output_and_exit( $input, $cookie, $template,  'wrong_csrf_token' )
51
        unless Koha::Token->new->check_csrf({
52
            session_id => scalar $input->cookie('CGISESSID'),
53
            token  => scalar $input->param('csrf_token'),
54
        });
55
56
57
    my $dbh=C4::Context->dbh();
49
    my $dbh=C4::Context->dbh();
58
50
59
    my @perms = $input->multi_param('flag');
51
    my @perms = $input->multi_param('flag');
(-)a/members/member-password.pl (-7 lines)
Lines 10-16 use C4::Auth qw( get_template_and_user ); Link Here
10
use C4::Output qw( output_and_exit_if_error output_and_exit output_html_with_http_headers );
10
use C4::Output qw( output_and_exit_if_error output_and_exit output_html_with_http_headers );
11
use C4::Context;
11
use C4::Context;
12
use CGI qw ( -utf8 );
12
use CGI qw ( -utf8 );
13
use Koha::Token;
14
13
15
use Koha::Patrons;
14
use Koha::Patrons;
16
use Koha::Patron::Categories;
15
use Koha::Patron::Categories;
Lines 57-68 push( @errors, 'NOMATCH' ) if ( ( $newpassword && $newpassword2 ) && ( $newpassw Link Here
57
56
58
if ( $newpassword and not @errors) {
57
if ( $newpassword and not @errors) {
59
58
60
    output_and_exit( $input, $cookie, $template,  'wrong_csrf_token' )
61
        unless Koha::Token->new->check_csrf({
62
            session_id => scalar $input->cookie('CGISESSID'),
63
            token  => scalar $input->param('csrf_token'),
64
        });
65
66
    try {
59
    try {
67
        $patron->set_password({ password => $newpassword });
60
        $patron->set_password({ password => $newpassword });
68
        $patron->userid($new_user_id)->store
61
        $patron->userid($new_user_id)->store
(-)a/members/memberentry.pl (-7 lines)
Lines 47-53 use Koha::Patron::HouseboundRole; Link Here
47
use Koha::Patron::HouseboundRoles;
47
use Koha::Patron::HouseboundRoles;
48
use Koha::Policy::Patrons::Cardnumber;
48
use Koha::Policy::Patrons::Cardnumber;
49
use Koha::Plugins;
49
use Koha::Plugins;
50
use Koha::Token;
51
use Koha::SMS::Providers;
50
use Koha::SMS::Providers;
52
51
53
my $input = CGI->new;
52
my $input = CGI->new;
Lines 279-290 $newdata{'lang'} = $input->param('lang') if defined($input->param('lang')) Link Here
279
my $extended_patron_attributes;
278
my $extended_patron_attributes;
280
if ($op eq 'save' || $op eq 'insert'){
279
if ($op eq 'save' || $op eq 'insert'){
281
280
282
    output_and_exit( $input, $cookie, $template,  'wrong_csrf_token' )
283
        unless Koha::Token->new->check_csrf({
284
            session_id => scalar $input->cookie('CGISESSID'),
285
            token  => scalar $input->param('csrf_token'),
286
        });
287
288
    # If the cardnumber is blank, treat it as null.
281
    # If the cardnumber is blank, treat it as null.
289
    $newdata{'cardnumber'} = undef if $newdata{'cardnumber'} =~ /^\s*$/;
282
    $newdata{'cardnumber'} = undef if $newdata{'cardnumber'} =~ /^\s*$/;
290
283
(-)a/members/paycollect.pl (-7 lines)
Lines 34-40 use Koha::AuthorisedValues; Link Here
34
use Koha::Account;
34
use Koha::Account;
35
use Koha::Account::Lines;
35
use Koha::Account::Lines;
36
use Koha::AdditionalFields;
36
use Koha::AdditionalFields;
37
use Koha::Token;
38
use Koha::DateUtils qw( output_pref );
37
use Koha::DateUtils qw( output_pref );
39
38
40
my $input = CGI->new();
39
my $input = CGI->new();
Lines 149-160 if ( $total_paid and $total_paid ne '0.00' ) { Link Here
149
            total_paid => $total_paid
148
            total_paid => $total_paid
150
        );
149
        );
151
    } else {
150
    } else {
152
        output_and_exit( $input, $cookie, $template,  'wrong_csrf_token' )
153
            unless Koha::Token->new->check_csrf( {
154
                session_id => $input->cookie('CGISESSID'),
155
                token  => scalar $input->param('csrf_token'),
156
            });
157
158
        my $url;
151
        my $url;
159
        my $pay_result;
152
        my $pay_result;
160
        if ($pay_individual) {
153
        if ($pay_individual) {
(-)a/members/two_factor_auth.pl (-3 lines)
Lines 24-30 use C4::Output qw( output_and_exit output_html_with_http_headers ); Link Here
24
24
25
use Koha::Patrons;
25
use Koha::Patrons;
26
use Koha::Auth::TwoFactorAuth;
26
use Koha::Auth::TwoFactorAuth;
27
use Koha::Token;
28
27
29
my $cgi = CGI->new;
28
my $cgi = CGI->new;
30
29
Lines 57-64 else { Link Here
57
    };
56
    };
58
57
59
    if ( $op eq 'disable-2FA' ) {
58
    if ( $op eq 'disable-2FA' ) {
60
        output_and_exit( $cgi, $cookie, $template, 'wrong_csrf_token' )
61
          unless Koha::Token->new->check_csrf($csrf_pars);
62
        my $auth =
59
        my $auth =
63
          Koha::Auth::TwoFactorAuth->new( { patron => $logged_in_user } );
60
          Koha::Auth::TwoFactorAuth->new( { patron => $logged_in_user } );
64
        $logged_in_user->secret(undef);
61
        $logged_in_user->secret(undef);
(-)a/opac/opac-memberentry.pl (-6 lines)
Lines 43-49 use Koha::Patron::Attributes; Link Here
43
use Koha::Patron::Images;
43
use Koha::Patron::Images;
44
use Koha::Patron::Categories;
44
use Koha::Patron::Categories;
45
use Koha::Policy::Patrons::Cardnumber;
45
use Koha::Policy::Patrons::Cardnumber;
46
use Koha::Token;
47
use Koha::AuthorisedValues;
46
use Koha::AuthorisedValues;
48
my $cgi = CGI->new;
47
my $cgi = CGI->new;
49
my $dbh = C4::Context->dbh;
48
my $dbh = C4::Context->dbh;
Lines 310-320 if ( $action eq 'create' ) { Link Here
310
elsif ( $action eq 'update' ) {
309
elsif ( $action eq 'update' ) {
311
310
312
    my $borrower = Koha::Patrons->find( $borrowernumber )->unblessed;
311
    my $borrower = Koha::Patrons->find( $borrowernumber )->unblessed;
313
    die "Wrong CSRF token"
314
        unless Koha::Token->new->check_csrf({
315
            session_id => scalar $cgi->cookie('CGISESSID'),
316
            token  => scalar $cgi->param('csrf_token'),
317
        });
318
312
319
    my %borrower = ParseCgiForBorrower($cgi);
313
    my %borrower = ParseCgiForBorrower($cgi);
320
    $borrower{borrowernumber} = $borrowernumber;
314
    $borrower{borrowernumber} = $borrowernumber;
(-)a/opac/opac-messaging.pl (-5 lines)
Lines 28-34 use C4::Members::Messaging; Link Here
28
use C4::Form::MessagingPreferences;
28
use C4::Form::MessagingPreferences;
29
use Koha::Patrons;
29
use Koha::Patrons;
30
use Koha::SMS::Providers;
30
use Koha::SMS::Providers;
31
use Koha::Token;
32
31
33
my $query = CGI->new();
32
my $query = CGI->new();
34
my $opac_messaging = C4::Context->preference('EnhancedMessagingPreferencesOPAC');
33
my $opac_messaging = C4::Context->preference('EnhancedMessagingPreferencesOPAC');
Lines 53-62 my $messaging_options; Link Here
53
$messaging_options = C4::Members::Messaging::GetMessagingOptions() if $opac_messaging;
52
$messaging_options = C4::Members::Messaging::GetMessagingOptions() if $opac_messaging;
54
53
55
if ( defined $query->param('modify') && $query->param('modify') eq 'yes' ) {
54
if ( defined $query->param('modify') && $query->param('modify') eq 'yes' ) {
56
    die "Wrong CSRF token" unless Koha::Token->new->check_csrf({
57
        session_id => scalar $query->cookie('CGISESSID'),
58
        token  => scalar $query->param('csrf_token'),
59
    });
60
55
61
    if( $opac_messaging ) {
56
    if( $opac_messaging ) {
62
        my $sms = $query->param('SMSnumber');
57
        my $sms = $query->param('SMSnumber');
(-)a/opac/opac-sendbasket.pl (-8 lines)
Lines 33-39 use C4::Templates; Link Here
33
use Koha::Biblios;
33
use Koha::Biblios;
34
use Koha::Email;
34
use Koha::Email;
35
use Koha::Patrons;
35
use Koha::Patrons;
36
use Koha::Token;
37
36
38
my $query = CGI->new;
37
my $query = CGI->new;
39
38
Lines 49-61 my $bib_list = $query->param('bib_list') || ''; Link Here
49
my $email_add = $query->param('email_add');
48
my $email_add = $query->param('email_add');
50
49
51
if ( $email_add ) {
50
if ( $email_add ) {
52
    die "Wrong CSRF token"
53
      unless Koha::Token->new->check_csrf(
54
        {
55
            session_id => scalar $query->cookie('CGISESSID'),
56
            token      => scalar $query->param('csrf_token'),
57
        }
58
      );
59
51
60
    my $patron     = Koha::Patrons->find($borrowernumber);
52
    my $patron     = Koha::Patrons->find($borrowernumber);
61
    my $user_email = $patron->notice_email_address;
53
    my $user_email = $patron->notice_email_address;
(-)a/opac/opac-user.pl (-7 lines)
Lines 48-54 use Koha::Patron::Discharge; Link Here
48
use Koha::Patrons;
48
use Koha::Patrons;
49
use Koha::Ratings;
49
use Koha::Ratings;
50
use Koha::Recalls;
50
use Koha::Recalls;
51
use Koha::Token;
52
51
53
use constant ATTRIBUTE_SHOW_BARCODE => 'SHOW_BCODE';
52
use constant ATTRIBUTE_SHOW_BARCODE => 'SHOW_BCODE';
54
53
Lines 90-101 $template->param( shibbolethAuthentication => C4::Context->config('useshibboleth Link Here
90
my $patron = Koha::Patrons->find( $borrowernumber );
89
my $patron = Koha::Patrons->find( $borrowernumber );
91
90
92
if( $op eq 'update_arc' && C4::Context->preference("AllowPatronToControlAutorenewal") ){
91
if( $op eq 'update_arc' && C4::Context->preference("AllowPatronToControlAutorenewal") ){
93
    die "Wrong CSRF token"
94
        unless Koha::Token->new->check_csrf({
95
            session_id => scalar $query->cookie('CGISESSID'),
96
            token  => scalar $query->param('csrf_token'),
97
        });
98
99
    my $autorenew_checkouts = $query->param('borrower_autorenew_checkouts');
92
    my $autorenew_checkouts = $query->param('borrower_autorenew_checkouts');
100
    $patron->autorenew_checkouts( $autorenew_checkouts )->store() if defined $autorenew_checkouts;
93
    $patron->autorenew_checkouts( $autorenew_checkouts )->store() if defined $autorenew_checkouts;
101
}
94
}
(-)a/opac/sco/sco-patron-image.pl (-17 lines)
Lines 23-29 use C4::Service; Link Here
23
use C4::Members;
23
use C4::Members;
24
use Koha::Patron::Images;
24
use Koha::Patron::Images;
25
use Koha::Patrons;
25
use Koha::Patrons;
26
use Koha::Token;
27
26
28
my ( $query, $response ) = C4::Service->init( self_check => 'self_checkout_module' );
27
my ( $query, $response ) = C4::Service->init( self_check => 'self_checkout_module' );
29
28
Lines 49-69 my $patron_image = $patron->image; Link Here
49
48
50
if ($patron_image) {
49
if ($patron_image) {
51
50
52
    unless (
53
        Koha::Token->new->check_csrf(
54
            {
55
                session_id => scalar $query->cookie('CGISESSID')
56
                  . $patron->cardnumber,
57
                id => $patron->userid,
58
                token => $csrf_token,
59
            }
60
        )
61
      )
62
    {
63
64
        print $query->header(-type => 'text/plain', -status => '403 Forbidden');
65
        exit;
66
    }
67
    print $query->header(
51
    print $query->header(
68
        -type           => $patron_image->mimetype,
52
        -type           => $patron_image->mimetype,
69
        -Content_Length => length( $patron_image->imagefile )
53
        -Content_Length => length( $patron_image->imagefile )
70
- 

Return to bug 34478