|
Lines 20-26
use Modern::Perl;
Link Here
|
| 20 |
use CGI qw ( -utf8 ); |
20 |
use CGI qw ( -utf8 ); |
| 21 |
use Digest::MD5 qw( md5_base64 md5_hex ); |
21 |
use Digest::MD5 qw( md5_base64 md5_hex ); |
| 22 |
use String::Random qw( random_string ); |
22 |
use String::Random qw( random_string ); |
| 23 |
use WWW::CSRF qw(generate_csrf_token check_csrf_token CSRF_OK); |
|
|
| 24 |
|
23 |
|
| 25 |
use C4::Auth; |
24 |
use C4::Auth; |
| 26 |
use C4::Output; |
25 |
use C4::Output; |
|
Lines 33-38
use C4::Scrubber;
Link Here
|
| 33 |
use Email::Valid; |
32 |
use Email::Valid; |
| 34 |
use Koha::DateUtils; |
33 |
use Koha::DateUtils; |
| 35 |
use Koha::Patron::Images; |
34 |
use Koha::Patron::Images; |
|
|
35 |
use Koha::Token; |
| 36 |
|
36 |
|
| 37 |
my $cgi = new CGI; |
37 |
my $cgi = new CGI; |
| 38 |
my $dbh = C4::Context->dbh; |
38 |
my $dbh = C4::Context->dbh; |
|
Lines 182-189
if ( $action eq 'create' ) {
Link Here
|
| 182 |
elsif ( $action eq 'update' ) { |
182 |
elsif ( $action eq 'update' ) { |
| 183 |
|
183 |
|
| 184 |
my $borrower = GetMember( borrowernumber => $borrowernumber ); |
184 |
my $borrower = GetMember( borrowernumber => $borrowernumber ); |
| 185 |
my $csrf_status = check_csrf_token($borrower->{userid}, md5_base64(C4::Context->config('pass')), scalar $cgi->param('csrf_token')); |
185 |
die "Wrong CSRF token" |
| 186 |
die "Wrong CSRF token" unless ($csrf_status == CSRF_OK); |
186 |
unless Koha::Token->new->check( |
|
|
187 |
id => $borrower->{userid}, |
| 188 |
secret => md5_base64( C4::Context->config('pass') ), |
| 189 |
token => scalar $cgi->param('csrf_token'), |
| 190 |
); |
| 187 |
|
191 |
|
| 188 |
my %borrower = ParseCgiForBorrower($cgi); |
192 |
my %borrower = ParseCgiForBorrower($cgi); |
| 189 |
|
193 |
|
|
Lines 197-203
elsif ( $action eq 'update' ) {
Link Here
|
| 197 |
empty_mandatory_fields => \@empty_mandatory_fields, |
201 |
empty_mandatory_fields => \@empty_mandatory_fields, |
| 198 |
invalid_form_fields => $invalidformfields, |
202 |
invalid_form_fields => $invalidformfields, |
| 199 |
borrower => \%borrower, |
203 |
borrower => \%borrower, |
| 200 |
csrf_token => generate_csrf_token($borrower->{userid}, md5_base64(C4::Context->config('pass'))), |
204 |
csrf_token => Koha::Token->new->generate({ |
|
|
205 |
CSRF => 1, |
| 206 |
id => $borrower->{userid}, |
| 207 |
secret => md5_base64( C4::Context->config('pass') ), |
| 208 |
}), |
| 201 |
); |
209 |
); |
| 202 |
|
210 |
|
| 203 |
$template->param( action => 'edit' ); |
211 |
$template->param( action => 'edit' ); |
|
Lines 229-235
elsif ( $action eq 'update' ) {
Link Here
|
| 229 |
action => 'edit', |
237 |
action => 'edit', |
| 230 |
nochanges => 1, |
238 |
nochanges => 1, |
| 231 |
borrower => GetMember( borrowernumber => $borrowernumber ), |
239 |
borrower => GetMember( borrowernumber => $borrowernumber ), |
| 232 |
csrf_token => generate_csrf_token($borrower->{userid}, md5_base64(C4::Context->config('pass'))) |
240 |
csrf_token => Koha::Token->new->generate({ |
|
|
241 |
CSRF => 1, |
| 242 |
id => $borrower->{userid}, |
| 243 |
secret => md5_base64( C4::Context->config('pass') ), |
| 244 |
}), |
| 233 |
); |
245 |
); |
| 234 |
} |
246 |
} |
| 235 |
} |
247 |
} |
|
Lines 249-255
elsif ( $action eq 'edit' ) { #Display logged in borrower's data
Link Here
|
| 249 |
borrower => $borrower, |
261 |
borrower => $borrower, |
| 250 |
guarantor => scalar Koha::Patrons->find($borrowernumber)->guarantor(), |
262 |
guarantor => scalar Koha::Patrons->find($borrowernumber)->guarantor(), |
| 251 |
hidden => GetHiddenFields( $mandatory, 'modification' ), |
263 |
hidden => GetHiddenFields( $mandatory, 'modification' ), |
| 252 |
csrf_token => generate_csrf_token($borrower->{userid}, md5_base64(C4::Context->config('pass'))) |
264 |
csrf_token => Koha::Token->new->generate({ |
|
|
265 |
CSRF => 1, |
| 266 |
id => $borrower->{userid}, |
| 267 |
secret => md5_base64( C4::Context->config('pass') ), |
| 268 |
}), |
| 253 |
); |
269 |
); |
| 254 |
|
270 |
|
| 255 |
if (C4::Context->preference('OPACpatronimages')) { |
271 |
if (C4::Context->preference('OPACpatronimages')) { |