Attachment #155984 for bug #34478

View | Details | Raw Unified | Return to bug 34478
Collapse All | Expand All

Lines 34-40 use URI::Escape; Link Here

(-)a/C4/Output.pm (-1 lines)
34	use C4::Auth qw( get_template_and_user );	34	use C4::Auth qw( get_template_and_user );
35	use C4::Context;	35	use C4::Context;
36	use C4::Templates;	36	use C4::Templates;
37	use Koha::Token;
38		37
39	our (@ISA, @EXPORT_OK);	38	our (@ISA, @EXPORT_OK);
40		39




use Koha::Authority::Types;
use Koha::SearchEngine::Search;
use Koha::SearchEngine::QueryBuilder;
use Koha::Token;
use Koha::XSLT::Base;
use Koha::Z3950Servers;


        }
    );

    output_and_exit( $query, $cookie, $template, 'wrong_csrf_token' )
        unless Koha::Token->new->check_csrf({
            session_id => scalar $query->cookie('CGISESSID'),
            token  => scalar $query->param('csrf_token'),
        });

    DelAuthority({ authid => $authid });
    # FIXME No error handling here, DelAuthority needs adjustments
    $pending_deletion_authid = $authid;




use C4::Templates;
use Koha::Biblios;
use Koha::Email;
use Koha::Token;

my $query = CGI->new;


my $dbh = C4::Context->dbh;

if ($email_add) {
    output_and_exit( $query, $cookie, $template, 'wrong_csrf_token' )
      unless Koha::Token->new->check_csrf(
        {
            session_id => scalar $query->cookie('CGISESSID'),
            token      => scalar $query->param('csrf_token'),
        }
      );

    my $patron     = Koha::Patrons->find($borrowernumber);
    my $user_email = $patron->notice_email_address;




use Koha::Illrequest::Workflow::Availability;
use Koha::Illrequest::Workflow::TypeDisclaimer;
use Koha::Libraries;
use Koha::Token;

use Try::Tiny qw( catch try );
use URI::Escape qw( uri_escape_utf8 );

            prefilters => join("&", @tpl_arr)
        );
    } elsif ( $op eq "save_comment" ) {
        die "Wrong CSRF token" unless Koha::Token->new->check_csrf({
           session_id => scalar $cgi->cookie('CGISESSID'),
           token      => scalar $cgi->param('csrf_token'),
        });
        my $comment = Koha::Illcomment->new({
            illrequest_id  => scalar $params->{illrequest_id},
            borrowernumber => $patronnumber,





use Koha::ApiKeys;
use Koha::Patrons;
use Koha::Token;

my $cgi = CGI->new;



my $op = $cgi->param('op') // '';

if ( $op eq 'generate' or
     $op eq 'delete' or
     $op eq 'revoke' or
     $op eq 'activate' ) {

    output_and_exit( $cgi, $cookie, $template, 'wrong_csrf_token' )
        unless Koha::Token->new->check_csrf({
            session_id => scalar $cgi->cookie('CGISESSID'),
            token      => scalar $cgi->param('csrf_token'),
        });
}

if ($op) {
    if ( $op eq 'generate' ) {
        my $description = $cgi->param('description') // '';




use CGI;

use C4::Auth qw( checkauth );
use Koha::Token;

my $cgi = CGI->new;


my $type = 'intranet';
my ($user, $cookie) = C4::Auth::checkauth($cgi, $authnotrequired, $flags, $type);

my $csrf_token_is_valid = Koha::Token->new->check_csrf( {
    session_id => scalar $cgi->cookie('CGISESSID'),
    token  => scalar $cgi->param('csrf_token'),
});
unless ($csrf_token_is_valid) {
    print $cgi->header('text/plain', '403 Forbidden');
    print 'Wrong CSRF token';
    exit;
}

my $borrowernumber = $cgi->param('borrowernumber');
my $accountlines_id = $cgi->param('accountlines_id');





use Koha::Account::CreditTypes;
use Koha::AdditionalFields;

use Koha::Token;

my $input = CGI->new;
my ( $template, $loggedinuser, $cookie ) = get_template_and_user(
    {


my $add = $input->param('add');
if ($add) {
    output_and_exit( $input, $cookie, $template, 'wrong_csrf_token' )
      unless Koha::Token->new->check_csrf(
        {
            session_id => scalar $input->cookie('CGISESSID'),
            token      => scalar $input->param('csrf_token'),
        }
      );

# Note: If the logged in user is not allowed to see this patron an invoice can be forced
# Here we are trusting librarians not to hack the system




use CGI qw ( -utf8 );
use C4::Members;
use C4::Accounts;
use Koha::Token;

use Koha::Patrons;
use Koha::Items;


my $add = $input->param('add');
if ($add) {
    output_and_exit( $input, $cookie, $template, 'wrong_csrf_token' )
      unless Koha::Token->new->check_csrf(
        {
            session_id => scalar $input->cookie('CGISESSID'),
            token      => scalar $input->param('csrf_token'),
        }
      );

    # Note: If the logged in user is not allowed to see this patron an invoice can be forced
    # Here we are trusting librarians not to hack the system
    my $desc       = $input->param('desc');




use Koha::Patrons;

use C4::Output qw( output_and_exit_if_error output_and_exit output_html_with_http_headers );
use Koha::Token;

my $input = CGI->new;



if ($input->param('newflags')) {

    output_and_exit( $input, $cookie, $template,  'wrong_csrf_token' )
        unless Koha::Token->new->check_csrf({
            session_id => scalar $input->cookie('CGISESSID'),
            token  => scalar $input->param('csrf_token'),
        });


    my $dbh=C4::Context->dbh();

    my @perms = $input->multi_param('flag');




use C4::Output qw( output_and_exit_if_error output_and_exit output_html_with_http_headers );
use C4::Context;
use CGI qw ( -utf8 );
use Koha::Token;

use Koha::Patrons;
use Koha::Patron::Categories;


if ( $newpassword and not @errors) {

    output_and_exit( $input, $cookie, $template,  'wrong_csrf_token' )
        unless Koha::Token->new->check_csrf({
            session_id => scalar $input->cookie('CGISESSID'),
            token  => scalar $input->param('csrf_token'),
        });

    try {
        $patron->set_password({ password => $newpassword });
        $patron->userid($new_user_id)->store




use Koha::Patron::HouseboundRoles;
use Koha::Policy::Patrons::Cardnumber;
use Koha::Plugins;
use Koha::Token;
use Koha::SMS::Providers;

my $input = CGI->new;

my $extended_patron_attributes;
if ($op eq 'save' || $op eq 'insert'){

    output_and_exit( $input, $cookie, $template,  'wrong_csrf_token' )
        unless Koha::Token->new->check_csrf({
            session_id => scalar $input->cookie('CGISESSID'),
            token  => scalar $input->param('csrf_token'),
        });

    # If the cardnumber is blank, treat it as null.
    $newdata{'cardnumber'} = undef if $newdata{'cardnumber'} =~ /^\s*$/;





use Koha::Account;
use Koha::Account::Lines;
use Koha::AdditionalFields;
use Koha::Token;
use Koha::DateUtils qw( output_pref );

my $input = CGI->new();

            total_paid => $total_paid
        );
    } else {
        output_and_exit( $input, $cookie, $template,  'wrong_csrf_token' )
            unless Koha::Token->new->check_csrf( {
                session_id => $input->cookie('CGISESSID'),
                token  => scalar $input->param('csrf_token'),
            });

        my $url;
        my $pay_result;
        if ($pay_individual) {

Lines 24-30 use C4::Output qw( output_and_exit output_html_with_http_headers ); Link Here

(-)a/members/two_factor_auth.pl (-3 lines)
24		24
25	use Koha::Patrons;	25	use Koha::Patrons;
26	use Koha::Auth::TwoFactorAuth;	26	use Koha::Auth::TwoFactorAuth;
27	use Koha::Token;
28		27
29	my $cgi = CGI->new;	28	my $cgi = CGI->new;
30		29
Lines 57-64 else { Link Here
57	};	56	};
58		57
59	if ( $op eq 'disable-2FA' ) {	58	if ( $op eq 'disable-2FA' ) {
60	output_and_exit( $cgi, $cookie, $template, 'wrong_csrf_token' )
61	unless Koha::Token->new->check_csrf($csrf_pars);
62	my $auth =	59	my $auth =
63	Koha::Auth::TwoFactorAuth->new( { patron => $logged_in_user } );	60	Koha::Auth::TwoFactorAuth->new( { patron => $logged_in_user } );
64	$logged_in_user->secret(undef);	61	$logged_in_user->secret(undef);




use Koha::Patron::Images;
use Koha::Patron::Categories;
use Koha::Policy::Patrons::Cardnumber;
use Koha::Token;
use Koha::AuthorisedValues;
my $cgi = CGI->new;
my $dbh = C4::Context->dbh;

elsif ( $action eq 'update' ) {

    my $borrower = Koha::Patrons->find( $borrowernumber )->unblessed;
    die "Wrong CSRF token"
        unless Koha::Token->new->check_csrf({
            session_id => scalar $cgi->cookie('CGISESSID'),
            token  => scalar $cgi->param('csrf_token'),
        });

    my %borrower = ParseCgiForBorrower($cgi);
    $borrower{borrowernumber} = $borrowernumber;




use C4::Form::MessagingPreferences;
use Koha::Patrons;
use Koha::SMS::Providers;
use Koha::Token;

my $query = CGI->new();
my $opac_messaging = C4::Context->preference('EnhancedMessagingPreferencesOPAC');

$messaging_options = C4::Members::Messaging::GetMessagingOptions() if $opac_messaging;

if ( defined $query->param('modify') && $query->param('modify') eq 'yes' ) {
    die "Wrong CSRF token" unless Koha::Token->new->check_csrf({
        session_id => scalar $query->cookie('CGISESSID'),
        token  => scalar $query->param('csrf_token'),
    });

    if( $opac_messaging ) {
        my $sms = $query->param('SMSnumber');




use Koha::Biblios;
use Koha::Email;
use Koha::Patrons;
use Koha::Token;

my $query = CGI->new;


my $email_add = $query->param('email_add');

if ( $email_add ) {
    die "Wrong CSRF token"
      unless Koha::Token->new->check_csrf(
        {
            session_id => scalar $query->cookie('CGISESSID'),
            token      => scalar $query->param('csrf_token'),
        }
      );

    my $patron     = Koha::Patrons->find($borrowernumber);
    my $user_email = $patron->notice_email_address;




use Koha::Patrons;
use Koha::Ratings;
use Koha::Recalls;
use Koha::Token;

use constant ATTRIBUTE_SHOW_BARCODE => 'SHOW_BCODE';


my $patron = Koha::Patrons->find( $borrowernumber );

if( $op eq 'update_arc' && C4::Context->preference("AllowPatronToControlAutorenewal") ){
    die "Wrong CSRF token"
        unless Koha::Token->new->check_csrf({
            session_id => scalar $query->cookie('CGISESSID'),
            token  => scalar $query->param('csrf_token'),
        });

    my $autorenew_checkouts = $query->param('borrower_autorenew_checkouts');
    $patron->autorenew_checkouts( $autorenew_checkouts )->store() if defined $autorenew_checkouts;
}




use C4::Members;
use Koha::Patron::Images;
use Koha::Patrons;
use Koha::Token;

my ( $query, $response ) = C4::Service->init( self_check => 'self_checkout_module' );



if ($patron_image) {

    unless (
        Koha::Token->new->check_csrf(
            {
                session_id => scalar $query->cookie('CGISESSID')
                  . $patron->cardnumber,
                id => $patron->userid,
                token => $csrf_token,
            }
        )
      )
    {

        print $query->header(-type => 'text/plain', -status => '403 Forbidden');
        exit;
    }
    print $query->header(
        -type           => $patron_image->mimetype,
        -Content_Length => length( $patron_image->imagefile )
- 

Return to bug 34478

Lines 47-53 use Koha::Patron::HouseboundRole; Link Here

(-)a/members/memberentry.pl (-7 lines)
47	use Koha::Patron::HouseboundRoles;	47	use Koha::Patron::HouseboundRoles;
48	use Koha::Policy::Patrons::Cardnumber;	48	use Koha::Policy::Patrons::Cardnumber;
49	use Koha::Plugins;	49	use Koha::Plugins;
50	use Koha::Token;
51	use Koha::SMS::Providers;	50	use Koha::SMS::Providers;
52		51
53	my $input = CGI->new;	52	my $input = CGI->new;
Lines 279-290 $newdata{'lang'} = $input->param('lang') if defined($input->param('lang')) Link Here
279	my $extended_patron_attributes;	278	my $extended_patron_attributes;
280	if ($op eq 'save' \|\| $op eq 'insert'){	279	if ($op eq 'save' \|\| $op eq 'insert'){
281		280
282	output_and_exit( $input, $cookie, $template, 'wrong_csrf_token' )
283	unless Koha::Token->new->check_csrf({
284	session_id => scalar $input->cookie('CGISESSID'),
285	token => scalar $input->param('csrf_token'),
286	});
287
288	# If the cardnumber is blank, treat it as null.	281	# If the cardnumber is blank, treat it as null.
289	$newdata{'cardnumber'} = undef if $newdata{'cardnumber'} =~ /^\s*$/;	282	$newdata{'cardnumber'} = undef if $newdata{'cardnumber'} =~ /^\s*$/;
290		283

Lines 48-54 use Koha::Patron::Discharge; Link Here

(-)a/opac/opac-user.pl (-7 lines)
48	use Koha::Patrons;	48	use Koha::Patrons;
49	use Koha::Ratings;	49	use Koha::Ratings;
50	use Koha::Recalls;	50	use Koha::Recalls;
51	use Koha::Token;
52		51
53	use constant ATTRIBUTE_SHOW_BARCODE => 'SHOW_BCODE';	52	use constant ATTRIBUTE_SHOW_BARCODE => 'SHOW_BCODE';
54		53
Lines 90-101 $template->param( shibbolethAuthentication => C4::Context->config('useshibboleth Link Here
90	my $patron = Koha::Patrons->find( $borrowernumber );	89	my $patron = Koha::Patrons->find( $borrowernumber );
91		90
92	if( $op eq 'update_arc' && C4::Context->preference("AllowPatronToControlAutorenewal") ){	91	if( $op eq 'update_arc' && C4::Context->preference("AllowPatronToControlAutorenewal") ){
93	die "Wrong CSRF token"
94	unless Koha::Token->new->check_csrf({
95	session_id => scalar $query->cookie('CGISESSID'),
96	token => scalar $query->param('csrf_token'),
97	});
98
99	my $autorenew_checkouts = $query->param('borrower_autorenew_checkouts');	92	my $autorenew_checkouts = $query->param('borrower_autorenew_checkouts');
100	$patron->autorenew_checkouts( $autorenew_checkouts )->store() if defined $autorenew_checkouts;	93	$patron->autorenew_checkouts( $autorenew_checkouts )->store() if defined $autorenew_checkouts;
101	}	94	}

Lines 33-39 use C4::Languages; Link Here

(-)a/authorities/authorities-home.pl (-7 lines)
33	use Koha::Authority::Types;	33	use Koha::Authority::Types;
34	use Koha::SearchEngine::Search;	34	use Koha::SearchEngine::Search;
35	use Koha::SearchEngine::QueryBuilder;	35	use Koha::SearchEngine::QueryBuilder;
36	use Koha::Token;
37	use Koha::XSLT::Base;	36	use Koha::XSLT::Base;
38	use Koha::Z3950Servers;	37	use Koha::Z3950Servers;
39		38
Lines 58-69 if ( $op eq "delete" ) { Link Here
58	}	57	}
59	);	58	);
60		59
61	output_and_exit( $query, $cookie, $template, 'wrong_csrf_token' )
62	unless Koha::Token->new->check_csrf({
63	session_id => scalar $query->cookie('CGISESSID'),
64	token => scalar $query->param('csrf_token'),
65	});
66
67	DelAuthority({ authid => $authid });	60	DelAuthority({ authid => $authid });
68	# FIXME No error handling here, DelAuthority needs adjustments	61	# FIXME No error handling here, DelAuthority needs adjustments
69	$pending_deletion_authid = $authid;	62	$pending_deletion_authid = $authid;

Lines 30-36 use C4::Output qw( output_and_exit output_html_with_http_headers ); Link Here

(-)a/basket/sendbasket.pl (-8 lines)
30	use C4::Templates;	30	use C4::Templates;
31	use Koha::Biblios;	31	use Koha::Biblios;
32	use Koha::Email;	32	use Koha::Email;
33	use Koha::Token;
34		33
35	my $query = CGI->new;	34	my $query = CGI->new;
36		35
Lines 49-61 my $email_add = $query->param('email_add'); Link Here
49	my $dbh = C4::Context->dbh;	48	my $dbh = C4::Context->dbh;
50		49
51	if ($email_add) {	50	if ($email_add) {
52	output_and_exit( $query, $cookie, $template, 'wrong_csrf_token' )
53	unless Koha::Token->new->check_csrf(
54	{
55	session_id => scalar $query->cookie('CGISESSID'),
56	token => scalar $query->param('csrf_token'),
57	}
58	);
59		51
60	my $patron = Koha::Patrons->find($borrowernumber);	52	my $patron = Koha::Patrons->find($borrowernumber);
61	my $user_email = $patron->notice_email_address;	53	my $user_email = $patron->notice_email_address;

Lines 30-36 use Koha::Illrequests; Link Here

(-)a/ill/ill-requests.pl (-5 lines)
30	use Koha::Illrequest::Workflow::Availability;	30	use Koha::Illrequest::Workflow::Availability;
31	use Koha::Illrequest::Workflow::TypeDisclaimer;	31	use Koha::Illrequest::Workflow::TypeDisclaimer;
32	use Koha::Libraries;	32	use Koha::Libraries;
33	use Koha::Token;
34		33
35	use Try::Tiny qw( catch try );	34	use Try::Tiny qw( catch try );
36	use URI::Escape qw( uri_escape_utf8 );	35	use URI::Escape qw( uri_escape_utf8 );
Lines 373-382 if ( $backends_available ) { Link Here
373	prefilters => join("&", @tpl_arr)	372	prefilters => join("&", @tpl_arr)
374	);	373	);
375	} elsif ( $op eq "save_comment" ) {	374	} elsif ( $op eq "save_comment" ) {
376	die "Wrong CSRF token" unless Koha::Token->new->check_csrf({
377	session_id => scalar $cgi->cookie('CGISESSID'),
378	token => scalar $cgi->param('csrf_token'),
379	});
380	my $comment = Koha::Illcomment->new({	375	my $comment = Koha::Illcomment->new({
381	illrequest_id => scalar $params->{illrequest_id},	376	illrequest_id => scalar $params->{illrequest_id},
382	borrowernumber => $patronnumber,	377	borrowernumber => $patronnumber,

Lines 26-32 use C4::Output qw( output_and_exit output_html_with_http_headers ); Link Here

(-)a/members/apikeys.pl (-13 lines)
26		26
27	use Koha::ApiKeys;	27	use Koha::ApiKeys;
28	use Koha::Patrons;	28	use Koha::Patrons;
29	use Koha::Token;
30		29
31	my $cgi = CGI->new;	30	my $cgi = CGI->new;
32		31
Lines 60-77 if( $patron_id != $loggedinuser && !C4::Context->IsSuperLibrarian() ) { Link Here
60		59
61	my $op = $cgi->param('op') // '';	60	my $op = $cgi->param('op') // '';
62		61
63	if ( $op eq 'generate' or
64	$op eq 'delete' or
65	$op eq 'revoke' or
66	$op eq 'activate' ) {
67
68	output_and_exit( $cgi, $cookie, $template, 'wrong_csrf_token' )
69	unless Koha::Token->new->check_csrf({
70	session_id => scalar $cgi->cookie('CGISESSID'),
71	token => scalar $cgi->param('csrf_token'),
72	});
73	}
74
75	if ($op) {	62	if ($op) {
76	if ( $op eq 'generate' ) {	63	if ( $op eq 'generate' ) {
77	my $description = $cgi->param('description') // '';	64	my $description = $cgi->param('description') // '';

Lines 20-26 use Modern::Perl; Link Here

(-)a/members/cancel-charge.pl (-11 lines)
20	use CGI;	20	use CGI;
21		21
22	use C4::Auth qw( checkauth );	22	use C4::Auth qw( checkauth );
23	use Koha::Token;
24		23
25	my $cgi = CGI->new;	24	my $cgi = CGI->new;
26		25
Lines 33-48 my $flags = { Link Here
33	my $type = 'intranet';	32	my $type = 'intranet';
34	my ($user, $cookie) = C4::Auth::checkauth($cgi, $authnotrequired, $flags, $type);	33	my ($user, $cookie) = C4::Auth::checkauth($cgi, $authnotrequired, $flags, $type);
35		34
36	my $csrf_token_is_valid = Koha::Token->new->check_csrf( {
37	session_id => scalar $cgi->cookie('CGISESSID'),
38	token => scalar $cgi->param('csrf_token'),
39	});
40	unless ($csrf_token_is_valid) {
41	print $cgi->header('text/plain', '403 Forbidden');
42	print 'Wrong CSRF token';
43	exit;
44	}
45
46	my $borrowernumber = $cgi->param('borrowernumber');	35	my $borrowernumber = $cgi->param('borrowernumber');
47	my $accountlines_id = $cgi->param('accountlines_id');	36	my $accountlines_id = $cgi->param('accountlines_id');
48		37

Lines 36-43 use Koha::Patron::Categories; Link Here

(-)a/members/mancredit.pl (-9 lines)
36	use Koha::Account::CreditTypes;	36	use Koha::Account::CreditTypes;
37	use Koha::AdditionalFields;	37	use Koha::AdditionalFields;
38		38
39	use Koha::Token;
40
41	my $input = CGI->new;	39	my $input = CGI->new;
42	my ( $template, $loggedinuser, $cookie ) = get_template_and_user(	40	my ( $template, $loggedinuser, $cookie ) = get_template_and_user(
43	{	41	{
Lines 70-82 my $library_id = Link Here
70		68
71	my $add = $input->param('add');	69	my $add = $input->param('add');
72	if ($add) {	70	if ($add) {
73	output_and_exit( $input, $cookie, $template, 'wrong_csrf_token' )
74	unless Koha::Token->new->check_csrf(
75	{
76	session_id => scalar $input->cookie('CGISESSID'),
77	token => scalar $input->param('csrf_token'),
78	}
79	);
80		71
81	# Note: If the logged in user is not allowed to see this patron an invoice can be forced	72	# Note: If the logged in user is not allowed to see this patron an invoice can be forced
82	# Here we are trusting librarians not to hack the system	73	# Here we are trusting librarians not to hack the system

Lines 31-37 use C4::Output qw( output_and_exit_if_error output_and_exit output_html_with_htt Link Here

(-)a/members/maninvoice.pl (-9 lines)
31	use CGI qw ( -utf8 );	31	use CGI qw ( -utf8 );
32	use C4::Members;	32	use C4::Members;
33	use C4::Accounts;	33	use C4::Accounts;
34	use Koha::Token;
35		34
36	use Koha::Patrons;	35	use Koha::Patrons;
37	use Koha::Items;	36	use Koha::Items;
Lines 91-104 $template->param( Link Here
91		90
92	my $add = $input->param('add');	91	my $add = $input->param('add');
93	if ($add) {	92	if ($add) {
94	output_and_exit( $input, $cookie, $template, 'wrong_csrf_token' )
95	unless Koha::Token->new->check_csrf(
96	{
97	session_id => scalar $input->cookie('CGISESSID'),
98	token => scalar $input->param('csrf_token'),
99	}
100	);
101
102	# Note: If the logged in user is not allowed to see this patron an invoice can be forced	93	# Note: If the logged in user is not allowed to see this patron an invoice can be forced
103	# Here we are trusting librarians not to hack the system	94	# Here we are trusting librarians not to hack the system
104	my $desc = $input->param('desc');	95	my $desc = $input->param('desc');

Lines 15-21 use Koha::Patron::Categories; Link Here

(-)a/members/member-flags.pl (-8 lines)
15	use Koha::Patrons;	15	use Koha::Patrons;
16		16
17	use C4::Output qw( output_and_exit_if_error output_and_exit output_html_with_http_headers );	17	use C4::Output qw( output_and_exit_if_error output_and_exit output_html_with_http_headers );
18	use Koha::Token;
19		18
20	my $input = CGI->new;	19	my $input = CGI->new;
21		20
Lines 47-59 $member2{'borrowernumber'}=$member; Link Here
47		46
48	if ($input->param('newflags')) {	47	if ($input->param('newflags')) {
49		48
50	output_and_exit( $input, $cookie, $template, 'wrong_csrf_token' )
51	unless Koha::Token->new->check_csrf({
52	session_id => scalar $input->cookie('CGISESSID'),
53	token => scalar $input->param('csrf_token'),
54	});
55
56
57	my $dbh=C4::Context->dbh();	49	my $dbh=C4::Context->dbh();
58		50
59	my @perms = $input->multi_param('flag');	51	my @perms = $input->multi_param('flag');

Lines 10-16 use C4::Auth qw( get_template_and_user ); Link Here

(-)a/members/member-password.pl (-7 lines)
10	use C4::Output qw( output_and_exit_if_error output_and_exit output_html_with_http_headers );	10	use C4::Output qw( output_and_exit_if_error output_and_exit output_html_with_http_headers );
11	use C4::Context;	11	use C4::Context;
12	use CGI qw ( -utf8 );	12	use CGI qw ( -utf8 );
13	use Koha::Token;
14		13
15	use Koha::Patrons;	14	use Koha::Patrons;
16	use Koha::Patron::Categories;	15	use Koha::Patron::Categories;
Lines 57-68 push( @errors, 'NOMATCH' ) if ( ( $newpassword && $newpassword2 ) && ( $newpassw Link Here
57		56
58	if ( $newpassword and not @errors) {	57	if ( $newpassword and not @errors) {
59		58
60	output_and_exit( $input, $cookie, $template, 'wrong_csrf_token' )
61	unless Koha::Token->new->check_csrf({
62	session_id => scalar $input->cookie('CGISESSID'),
63	token => scalar $input->param('csrf_token'),
64	});
65
66	try {	59	try {
67	$patron->set_password({ password => $newpassword });	60	$patron->set_password({ password => $newpassword });
68	$patron->userid($new_user_id)->store	61	$patron->userid($new_user_id)->store

Lines 34-40 use Koha::AuthorisedValues; Link Here

(-)a/members/paycollect.pl (-7 lines)
34	use Koha::Account;	34	use Koha::Account;
35	use Koha::Account::Lines;	35	use Koha::Account::Lines;
36	use Koha::AdditionalFields;	36	use Koha::AdditionalFields;
37	use Koha::Token;
38	use Koha::DateUtils qw( output_pref );	37	use Koha::DateUtils qw( output_pref );
39		38
40	my $input = CGI->new();	39	my $input = CGI->new();
Lines 149-160 if ( $total_paid and $total_paid ne '0.00' ) { Link Here
149	total_paid => $total_paid	148	total_paid => $total_paid
150	);	149	);
151	} else {	150	} else {
152	output_and_exit( $input, $cookie, $template, 'wrong_csrf_token' )
153	unless Koha::Token->new->check_csrf( {
154	session_id => $input->cookie('CGISESSID'),
155	token => scalar $input->param('csrf_token'),
156	});
157
158	my $url;	151	my $url;
159	my $pay_result;	152	my $pay_result;
160	if ($pay_individual) {	153	if ($pay_individual) {

Lines 43-49 use Koha::Patron::Attributes; Link Here

(-)a/opac/opac-memberentry.pl (-6 lines)
43	use Koha::Patron::Images;	43	use Koha::Patron::Images;
44	use Koha::Patron::Categories;	44	use Koha::Patron::Categories;
45	use Koha::Policy::Patrons::Cardnumber;	45	use Koha::Policy::Patrons::Cardnumber;
46	use Koha::Token;
47	use Koha::AuthorisedValues;	46	use Koha::AuthorisedValues;
48	my $cgi = CGI->new;	47	my $cgi = CGI->new;
49	my $dbh = C4::Context->dbh;	48	my $dbh = C4::Context->dbh;
Lines 310-320 if ( $action eq 'create' ) { Link Here
310	elsif ( $action eq 'update' ) {	309	elsif ( $action eq 'update' ) {
311		310
312	my $borrower = Koha::Patrons->find( $borrowernumber )->unblessed;	311	my $borrower = Koha::Patrons->find( $borrowernumber )->unblessed;
313	die "Wrong CSRF token"
314	unless Koha::Token->new->check_csrf({
315	session_id => scalar $cgi->cookie('CGISESSID'),
316	token => scalar $cgi->param('csrf_token'),
317	});
318		312
319	my %borrower = ParseCgiForBorrower($cgi);	313	my %borrower = ParseCgiForBorrower($cgi);
320	$borrower{borrowernumber} = $borrowernumber;	314	$borrower{borrowernumber} = $borrowernumber;

Lines 28-34 use C4::Members::Messaging; Link Here

(-)a/opac/opac-messaging.pl (-5 lines)
28	use C4::Form::MessagingPreferences;	28	use C4::Form::MessagingPreferences;
29	use Koha::Patrons;	29	use Koha::Patrons;
30	use Koha::SMS::Providers;	30	use Koha::SMS::Providers;
31	use Koha::Token;
32		31
33	my $query = CGI->new();	32	my $query = CGI->new();
34	my $opac_messaging = C4::Context->preference('EnhancedMessagingPreferencesOPAC');	33	my $opac_messaging = C4::Context->preference('EnhancedMessagingPreferencesOPAC');
Lines 53-62 my $messaging_options; Link Here
53	$messaging_options = C4::Members::Messaging::GetMessagingOptions() if $opac_messaging;	52	$messaging_options = C4::Members::Messaging::GetMessagingOptions() if $opac_messaging;
54		53
55	if ( defined $query->param('modify') && $query->param('modify') eq 'yes' ) {	54	if ( defined $query->param('modify') && $query->param('modify') eq 'yes' ) {
56	die "Wrong CSRF token" unless Koha::Token->new->check_csrf({
57	session_id => scalar $query->cookie('CGISESSID'),
58	token => scalar $query->param('csrf_token'),
59	});
60		55
61	if( $opac_messaging ) {	56	if( $opac_messaging ) {
62	my $sms = $query->param('SMSnumber');	57	my $sms = $query->param('SMSnumber');

Lines 33-39 use C4::Templates; Link Here

(-)a/opac/opac-sendbasket.pl (-8 lines)
33	use Koha::Biblios;	33	use Koha::Biblios;
34	use Koha::Email;	34	use Koha::Email;
35	use Koha::Patrons;	35	use Koha::Patrons;
36	use Koha::Token;
37		36
38	my $query = CGI->new;	37	my $query = CGI->new;
39		38
Lines 49-61 my $bib_list = $query->param('bib_list') \|\| ''; Link Here
49	my $email_add = $query->param('email_add');	48	my $email_add = $query->param('email_add');
50		49
51	if ( $email_add ) {	50	if ( $email_add ) {
52	die "Wrong CSRF token"
53	unless Koha::Token->new->check_csrf(
54	{
55	session_id => scalar $query->cookie('CGISESSID'),
56	token => scalar $query->param('csrf_token'),
57	}
58	);
59		51
60	my $patron = Koha::Patrons->find($borrowernumber);	52	my $patron = Koha::Patrons->find($borrowernumber);
61	my $user_email = $patron->notice_email_address;	53	my $user_email = $patron->notice_email_address;

Lines 23-29 use C4::Service; Link Here

(-)a/opac/sco/sco-patron-image.pl (-17 lines)
23	use C4::Members;	23	use C4::Members;
24	use Koha::Patron::Images;	24	use Koha::Patron::Images;
25	use Koha::Patrons;	25	use Koha::Patrons;
26	use Koha::Token;
27		26
28	my ( $query, $response ) = C4::Service->init( self_check => 'self_checkout_module' );	27	my ( $query, $response ) = C4::Service->init( self_check => 'self_checkout_module' );
29		28
Lines 49-69 my $patron_image = $patron->image; Link Here
49		48
50	if ($patron_image) {	49	if ($patron_image) {
51		50
52	unless (
53	Koha::Token->new->check_csrf(
54	{
55	session_id => scalar $query->cookie('CGISESSID')
56	. $patron->cardnumber,
57	id => $patron->userid,
58	token => $csrf_token,
59	}
60	)
61	)
62	{
63
64	print $query->header(-type => 'text/plain', -status => '403 Forbidden');
65	exit;
66	}
67	print $query->header(	51	print $query->header(
68	-type => $patron_image->mimetype,	52	-type => $patron_image->mimetype,
69	-Content_Length => length( $patron_image->imagefile )	53	-Content_Length => length( $patron_image->imagefile )
70	-