Attachment #57957 for bug #17720

View | Details | Raw Unified | Return to bug 17720
Collapse All | Expand All

Lines 53-59 my $dbh = C4::Context->dbh; Link Here

(-)a/basket/sendbasket.pl (-2 / +2 lines)
53	if ( $email_add ) {	53	if ( $email_add ) {
54	die "Wrong CSRF token" unless Koha::Token->new->check_csrf({	54	die "Wrong CSRF token" unless Koha::Token->new->check_csrf({
55	id => C4::Context->userenv->{id},	55	id => C4::Context->userenv->{id},
56	secret => md5_base64( C4::Context->config('pass') ),	56	secret => md5_base64( Encode::encode( 'UTF-8', C4::Context->config('pass') ) ),
57	token => scalar $query->param('csrf_token'),	57	token => scalar $query->param('csrf_token'),
58	});	58	});
59	my $email = Koha::Email->new();	59	my $email = Koha::Email->new();
Lines 178-184 else { Link Here
178	virtualshelves => C4::Context->preference("virtualshelves"),	178	virtualshelves => C4::Context->preference("virtualshelves"),
179	csrf_token => Koha::Token->new->generate_csrf(	179	csrf_token => Koha::Token->new->generate_csrf(
180	{ id => C4::Context->userenv->{id},	180	{ id => C4::Context->userenv->{id},
181	secret => md5_base64( C4::Context->config('pass') ),	181	secret => md5_base64( Encode::encode( 'UTF-8', C4::Context->config('pass') ) ),
182	}	182	}
183	),	183	),
184	);	184	);





use CGI qw ( -utf8 );
use Digest::MD5 qw(md5_base64);
use Encode qw( encode );
use C4::Context;
use C4::Output;
use C4::Auth;

            op         => 'delete_confirm',
            csrf_token => Koha::Token->new->generate_csrf(
                {   id     => C4::Context->userenv->{id},
                    secret => md5_base64( Encode::encode( 'UTF-8', C4::Context->config('pass') ) ),
                }
            ),
        );

    die "Wrong CSRF token"
        unless Koha::Token->new->check_csrf({
            id     => C4::Context->userenv->{id},
            secret => md5_base64( Encode::encode( 'UTF-8', C4::Context->config('pass') ) ),
            token  => scalar $input->param('csrf_token'),
        });
    my $patron = Koha::Patrons->find( $member );




use Koha::Patron::Categories;

use Digest::MD5 qw(md5_base64);
use Encode qw( encode );

my $input = new CGI;


    die "Wrong CSRF token"
        unless Koha::Token->new->check_csrf({
            id     => C4::Context->userenv->{id},
            secret => md5_base64( Encode::encode( 'UTF-8', C4::Context->config('pass') ) ),
            token  => scalar $input->param('csrf_token'),
        });


    RoutingSerials             => C4::Context->preference('RoutingSerials'),
    csrf_token                 => Koha::Token->new->generate_csrf({
        id     => C4::Context->userenv->{id},
        secret => md5_base64( Encode::encode( 'UTF-8', C4::Context->config('pass') ) ),
    }),
);





use CGI qw ( -utf8 );
use List::MoreUtils qw/uniq/;
use Digest::MD5 qw(md5_base64);
use Encode qw( encode );

# internal modules
use C4::Auth;

    die "Wrong CSRF token"
        unless Koha::Token->new->check_csrf({
            id     => C4::Context->userenv->{id},
            secret => md5_base64( Encode::encode( 'UTF-8', C4::Context->config('pass') ) ),
            token  => scalar $input->param('csrf_token'),
        });


$template->param(
    csrf_token => Koha::Token->new->generate_csrf(
        {   id     => C4::Context->userenv->{id},
            secret => md5_base64( Encode::encode( 'UTF-8', C4::Context->config('pass') ) ),
        }
    ),
);

Lines 37-42 use strict; Link Here

(-)a/members/moremember.pl (-1 / +2 lines)
37	#use warnings; FIXME - Bug 2505	37	#use warnings; FIXME - Bug 2505
38	use CGI qw ( -utf8 );	38	use CGI qw ( -utf8 );
39	use Digest::MD5 qw(md5_base64);	39	use Digest::MD5 qw(md5_base64);
		40	use Encode qw( encode );
40	use C4::Context;	41	use C4::Context;
41	use C4::Auth;	42	use C4::Auth;
42	use C4::Output;	43	use C4::Output;
Lines 275-281 $template->param( picture => 1 ) if $patron_image; Link Here
275	$template->param(	276	$template->param(
276	csrf_token => Koha::Token->new->generate_csrf({	277	csrf_token => Koha::Token->new->generate_csrf({
277	id => C4::Context->userenv->{id},	278	id => C4::Context->userenv->{id},
278	secret => md5_base64( C4::Context->config('pass') ),	279	secret => md5_base64( Encode::encode( 'UTF-8', C4::Context->config('pass') ) ),
279	}),	280	}),
280	);	281	);
281		282





use CGI qw ( -utf8 );
use Digest::MD5 qw( md5_base64 md5_hex );
use Encode qw( encode );
use String::Random qw( random_string );

use C4::Auth;

    die "Wrong CSRF token"
        unless Koha::Token->new->check_csrf({
            id     => $borrower->{userid},
            secret => md5_base64( Encode::encode( 'UTF-8', C4::Context->config('pass') ) ),
            token  => scalar $cgi->param('csrf_token'),
        });


            borrower               => \%borrower,
            csrf_token             => Koha::Token->new->generate_csrf({
                id     => $borrower->{userid},
                secret => md5_base64( Encode::encode( 'UTF-8', C4::Context->config('pass') ) ),
            }),
        );


                borrower => GetMember( borrowernumber => $borrowernumber ),
                csrf_token => Koha::Token->new->generate_csrf({
                    id     => $borrower->{userid},
                    secret => md5_base64( Encode::encode( 'UTF-8', C4::Context->config('pass') ) ),
                }),
            );
        }

        hidden => GetHiddenFields( $mandatory, 'modification' ),
        csrf_token => Koha::Token->new->generate_csrf({
            id     => $borrower->{userid},
            secret => md5_base64( Encode::encode( 'UTF-8', C4::Context->config('pass') ) ),
        }),
    );


Lines 55-61 my $dbh = C4::Context->dbh; Link Here

(-)a/opac/opac-sendbasket.pl (-2 / +2 lines)
55	if ( $email_add ) {	55	if ( $email_add ) {
56	die "Wrong CSRF token" unless Koha::Token->new->check_csrf({	56	die "Wrong CSRF token" unless Koha::Token->new->check_csrf({
57	id => C4::Context->userenv->{id},	57	id => C4::Context->userenv->{id},
58	secret => md5_base64( C4::Context->config('pass') ),	58	secret => md5_base64( Encode::encode( 'UTF-8', C4::Context->config('pass') ) ),
59	token => scalar $query->param('csrf_token'),	59	token => scalar $query->param('csrf_token'),
60	});	60	});
61	my $email = Koha::Email->new();	61	my $email = Koha::Email->new();
Lines 198-204 else { Link Here
198	virtualshelves => C4::Context->preference("virtualshelves"),	198	virtualshelves => C4::Context->preference("virtualshelves"),
199	csrf_token => Koha::Token->new->generate_csrf(	199	csrf_token => Koha::Token->new->generate_csrf(
200	{ id => C4::Context->userenv->{id},	200	{ id => C4::Context->userenv->{id},
201	secret => md5_base64( C4::Context->config('pass') ),	201	secret => md5_base64( Encode::encode( 'UTF-8', C4::Context->config('pass') ) ),
202	}	202	}
203	),	203	),
204	);	204	);

Lines 71-76 is( $retrieved_patron_1->cardnumber, $new_patron_1->cardnumber, 'Find a patron b Link Here

(-)a/t/db_dependent/Koha/Patrons.t (+1 lines)
71	subtest 'guarantees' => sub {	71	subtest 'guarantees' => sub {
72	plan tests => 8;	72	plan tests => 8;
73	my $guarantees = $new_patron_1->guarantees;	73	my $guarantees = $new_patron_1->guarantees;
		74	use Data::Printer colored => 1; warn p $guarantees->unblessed;
74	is( ref($guarantees), 'Koha::Patrons', 'Koha::Patron->guarantees should return a Koha::Patrons result set in a scalar context' );	75	is( ref($guarantees), 'Koha::Patrons', 'Koha::Patron->guarantees should return a Koha::Patrons result set in a scalar context' );
75	is( $guarantees->count, 0, 'new_patron_1 should have 0 guarantee' );	76	is( $guarantees->count, 0, 'new_patron_1 should have 0 guarantee' );
76	my @guarantees = $new_patron_1->guarantees;	77	my @guarantees = $new_patron_1->guarantees;




# č

use CGI qw ( -utf8 );
# use encoding 'utf8';    # don't do this
use Digest::MD5 qw(md5_base64);
use Encode qw( encode );

my (@errors, @feedback);
my $extended = C4::Context->preference('ExtendedPatronAttributes');

    die "Wrong CSRF token"
        unless Koha::Token->new->check_csrf({
            id     => C4::Context->userenv->{id},
            secret => md5_base64( Encode::encode( 'UTF-8', C4::Context->config('pass') ) ),
            token  => scalar $input->param('csrf_token'),
        });


    $template->param(
        csrf_token => Koha::Token->new->generate_csrf(
            {   id     => C4::Context->userenv->{id},
                secret => md5_base64( Encode::encode( 'UTF-8', C4::Context->config('pass') ) ),
            }
        ),
    );




use CGI qw ( -utf8 );
use GD;
use Digest::MD5 qw(md5_base64);
use Encode qw( encode );
use C4::Context;
use C4::Auth;
use C4::Output;

    die "Wrong CSRF token"
        unless Koha::Token->new->check_csrf({
            id     => C4::Context->userenv->{id},
            secret => md5_base64( Encode::encode( 'UTF-8', C4::Context->config('pass') ) ),
            token  => scalar $input->param('csrf_token'),
        });


    die "Wrong CSRF token"
        unless Koha::Token->new->check_csrf({
            id     => C4::Context->userenv->{id},
            secret => md5_base64( Encode::encode( 'UTF-8', C4::Context->config('pass') ) ),
            token  => scalar $input->param('csrf_token'),
        });


    $template->param(
        csrf_token => Koha::Token->new->generate_csrf({
            id     => C4::Context->userenv->{id},
            secret => md5_base64( Encode::encode( 'UTF-8', C4::Context->config('pass') ) ),
        }),
    );
    output_html_with_http_headers $input, $cookie, $template->output;
- 

Return to bug 17720

Lines 26-31 use warnings; Link Here

(-)a/members/memberentry.pl (-2 / +3 lines)
26	use CGI qw ( -utf8 );	26	use CGI qw ( -utf8 );
27	use List::MoreUtils qw/uniq/;	27	use List::MoreUtils qw/uniq/;
28	use Digest::MD5 qw(md5_base64);	28	use Digest::MD5 qw(md5_base64);
		29	use Encode qw( encode );
29		30
30	# internal modules	31	# internal modules
31	use C4::Auth;	32	use C4::Auth;
Lines 290-296 if ($op eq 'save' \|\| $op eq 'insert'){ Link Here
290	die "Wrong CSRF token"	291	die "Wrong CSRF token"
291	unless Koha::Token->new->check_csrf({	292	unless Koha::Token->new->check_csrf({
292	id => C4::Context->userenv->{id},	293	id => C4::Context->userenv->{id},
293	secret => md5_base64( C4::Context->config('pass') ),	294	secret => md5_base64( Encode::encode( 'UTF-8', C4::Context->config('pass') ) ),
294	token => scalar $input->param('csrf_token'),	295	token => scalar $input->param('csrf_token'),
295	});	296	});
296		297
Lines 752-758 $template->param( Link Here
752	$template->param(	753	$template->param(
753	csrf_token => Koha::Token->new->generate_csrf(	754	csrf_token => Koha::Token->new->generate_csrf(
754	{ id => C4::Context->userenv->{id},	755	{ id => C4::Context->userenv->{id},
755	secret => md5_base64( C4::Context->config('pass') ),	756	secret => md5_base64( Encode::encode( 'UTF-8', C4::Context->config('pass') ) ),
756	}	757	}
757	),	758	),
758	);	759	);

Lines 26-31 use strict; Link Here

(-)a/members/deletemem.pl (-2 / +3 lines)
26		26
27	use CGI qw ( -utf8 );	27	use CGI qw ( -utf8 );
28	use Digest::MD5 qw(md5_base64);	28	use Digest::MD5 qw(md5_base64);
		29	use Encode qw( encode );
29	use C4::Context;	30	use C4::Context;
30	use C4::Output;	31	use C4::Output;
31	use C4::Auth;	32	use C4::Auth;
Lines 148-154 if ( $op eq 'delete_confirm' or $countissues > 0 or $flags->{'CHARGES'} or $is_ Link Here
148	op => 'delete_confirm',	149	op => 'delete_confirm',
149	csrf_token => Koha::Token->new->generate_csrf(	150	csrf_token => Koha::Token->new->generate_csrf(
150	{ id => C4::Context->userenv->{id},	151	{ id => C4::Context->userenv->{id},
151	secret => md5_base64( C4::Context->config('pass') ),	152	secret => md5_base64( Encode::encode( 'UTF-8', C4::Context->config('pass') ) ),
152	}	153	}
153	),	154	),
154	);	155	);
Lines 158-164 if ( $op eq 'delete_confirm' or $countissues > 0 or $flags->{'CHARGES'} or $is_ Link Here
158	die "Wrong CSRF token"	159	die "Wrong CSRF token"
159	unless Koha::Token->new->check_csrf({	160	unless Koha::Token->new->check_csrf({
160	id => C4::Context->userenv->{id},	161	id => C4::Context->userenv->{id},
161	secret => md5_base64( C4::Context->config('pass') ),	162	secret => md5_base64( Encode::encode( 'UTF-8', C4::Context->config('pass') ) ),
162	token => scalar $input->param('csrf_token'),	163	token => scalar $input->param('csrf_token'),
163	});	164	});
164	my $patron = Koha::Patrons->find( $member );	165	my $patron = Koha::Patrons->find( $member );

Lines 21-26 use Koha::Token; Link Here

(-)a/members/member-password.pl (-2 / +3 lines)
21	use Koha::Patron::Categories;	21	use Koha::Patron::Categories;
22		22
23	use Digest::MD5 qw(md5_base64);	23	use Digest::MD5 qw(md5_base64);
		24	use Encode qw( encode );
24		25
25	my $input = new CGI;	26	my $input = new CGI;
26		27
Lines 69-75 if ( $newpassword && !scalar(@errors) ) { Link Here
69	die "Wrong CSRF token"	70	die "Wrong CSRF token"
70	unless Koha::Token->new->check_csrf({	71	unless Koha::Token->new->check_csrf({
71	id => C4::Context->userenv->{id},	72	id => C4::Context->userenv->{id},
72	secret => md5_base64( C4::Context->config('pass') ),	73	secret => md5_base64( Encode::encode( 'UTF-8', C4::Context->config('pass') ) ),
73	token => scalar $input->param('csrf_token'),	74	token => scalar $input->param('csrf_token'),
74	});	75	});
75		76
Lines 151-157 $template->param( Link Here
151	RoutingSerials => C4::Context->preference('RoutingSerials'),	152	RoutingSerials => C4::Context->preference('RoutingSerials'),
152	csrf_token => Koha::Token->new->generate_csrf({	153	csrf_token => Koha::Token->new->generate_csrf({
153	id => C4::Context->userenv->{id},	154	id => C4::Context->userenv->{id},
154	secret => md5_base64( C4::Context->config('pass') ),	155	secret => md5_base64( Encode::encode( 'UTF-8', C4::Context->config('pass') ) ),
155	}),	156	}),
156	);	157	);
157		158

Lines 19-24 use Modern::Perl; Link Here

(-)a/opac/opac-memberentry.pl (-4 / +5 lines)
19		19
20	use CGI qw ( -utf8 );	20	use CGI qw ( -utf8 );
21	use Digest::MD5 qw( md5_base64 md5_hex );	21	use Digest::MD5 qw( md5_base64 md5_hex );
		22	use Encode qw( encode );
22	use String::Random qw( random_string );	23	use String::Random qw( random_string );
23		24
24	use C4::Auth;	25	use C4::Auth;
Lines 200-206 elsif ( $action eq 'update' ) { Link Here
200	die "Wrong CSRF token"	201	die "Wrong CSRF token"
201	unless Koha::Token->new->check_csrf({	202	unless Koha::Token->new->check_csrf({
202	id => $borrower->{userid},	203	id => $borrower->{userid},
203	secret => md5_base64( C4::Context->config('pass') ),	204	secret => md5_base64( Encode::encode( 'UTF-8', C4::Context->config('pass') ) ),
204	token => scalar $cgi->param('csrf_token'),	205	token => scalar $cgi->param('csrf_token'),
205	});	206	});
206		207
Lines 221-227 elsif ( $action eq 'update' ) { Link Here
221	borrower => \%borrower,	222	borrower => \%borrower,
222	csrf_token => Koha::Token->new->generate_csrf({	223	csrf_token => Koha::Token->new->generate_csrf({
223	id => $borrower->{userid},	224	id => $borrower->{userid},
224	secret => md5_base64( C4::Context->config('pass') ),	225	secret => md5_base64( Encode::encode( 'UTF-8', C4::Context->config('pass') ) ),
225	}),	226	}),
226	);	227	);
227		228
Lines 262-268 elsif ( $action eq 'update' ) { Link Here
262	borrower => GetMember( borrowernumber => $borrowernumber ),	263	borrower => GetMember( borrowernumber => $borrowernumber ),
263	csrf_token => Koha::Token->new->generate_csrf({	264	csrf_token => Koha::Token->new->generate_csrf({
264	id => $borrower->{userid},	265	id => $borrower->{userid},
265	secret => md5_base64( C4::Context->config('pass') ),	266	secret => md5_base64( Encode::encode( 'UTF-8', C4::Context->config('pass') ) ),
266	}),	267	}),
267	);	268	);
268	}	269	}
Lines 285-291 elsif ( $action eq 'edit' ) { #Display logged in borrower's data Link Here
285	hidden => GetHiddenFields( $mandatory, 'modification' ),	286	hidden => GetHiddenFields( $mandatory, 'modification' ),
286	csrf_token => Koha::Token->new->generate_csrf({	287	csrf_token => Koha::Token->new->generate_csrf({
287	id => $borrower->{userid},	288	id => $borrower->{userid},
288	secret => md5_base64( C4::Context->config('pass') ),	289	secret => md5_base64( Encode::encode( 'UTF-8', C4::Context->config('pass') ) ),
289	}),	290	}),
290	);	291	);
291		292

Lines 59-66 use Text::CSV; Link Here

(-)a/tools/import_borrowers.pl (-3 / +3 lines)
59	# č	59	# č
60		60
61	use CGI qw ( -utf8 );	61	use CGI qw ( -utf8 );
62	# use encoding 'utf8'; # don't do this
63	use Digest::MD5 qw(md5_base64);	62	use Digest::MD5 qw(md5_base64);
		63	use Encode qw( encode );
64		64
65	my (@errors, @feedback);	65	my (@errors, @feedback);
66	my $extended = C4::Context->preference('ExtendedPatronAttributes');	66	my $extended = C4::Context->preference('ExtendedPatronAttributes');
Lines 113-119 if ( $uploadborrowers && length($uploadborrowers) > 0 ) { Link Here
113	die "Wrong CSRF token"	113	die "Wrong CSRF token"
114	unless Koha::Token->new->check_csrf({	114	unless Koha::Token->new->check_csrf({
115	id => C4::Context->userenv->{id},	115	id => C4::Context->userenv->{id},
116	secret => md5_base64( C4::Context->config('pass') ),	116	secret => md5_base64( Encode::encode( 'UTF-8', C4::Context->config('pass') ) ),
117	token => scalar $input->param('csrf_token'),	117	token => scalar $input->param('csrf_token'),
118	});	118	});
119		119
Lines 392-398 if ( $uploadborrowers && length($uploadborrowers) > 0 ) { Link Here
392	$template->param(	392	$template->param(
393	csrf_token => Koha::Token->new->generate_csrf(	393	csrf_token => Koha::Token->new->generate_csrf(
394	{ id => C4::Context->userenv->{id},	394	{ id => C4::Context->userenv->{id},
395	secret => md5_base64( C4::Context->config('pass') ),	395	secret => md5_base64( Encode::encode( 'UTF-8', C4::Context->config('pass') ) ),
396	}	396	}
397	),	397	),
398	);	398	);

Lines 26-31 use File::Copy; Link Here

(-)a/tools/picture-upload.pl (-4 / +4 lines)
26	use CGI qw ( -utf8 );	26	use CGI qw ( -utf8 );
27	use GD;	27	use GD;
28	use Digest::MD5 qw(md5_base64);	28	use Digest::MD5 qw(md5_base64);
		29	use Encode qw( encode );
29	use C4::Context;	30	use C4::Context;
30	use C4::Auth;	31	use C4::Auth;
31	use C4::Output;	32	use C4::Output;
Lines 88-94 if ( ( $op eq 'Upload' ) && $uploadfile ) { Link Here
88	die "Wrong CSRF token"	89	die "Wrong CSRF token"
89	unless Koha::Token->new->check_csrf({	90	unless Koha::Token->new->check_csrf({
90	id => C4::Context->userenv->{id},	91	id => C4::Context->userenv->{id},
91	secret => md5_base64( C4::Context->config('pass') ),	92	secret => md5_base64( Encode::encode( 'UTF-8', C4::Context->config('pass') ) ),
92	token => scalar $input->param('csrf_token'),	93	token => scalar $input->param('csrf_token'),
93	});	94	});
94		95
Lines 176-182 elsif ( $op eq 'Delete' ) { Link Here
176	die "Wrong CSRF token"	177	die "Wrong CSRF token"
177	unless Koha::Token->new->check_csrf({	178	unless Koha::Token->new->check_csrf({
178	id => C4::Context->userenv->{id},	179	id => C4::Context->userenv->{id},
179	secret => md5_base64( C4::Context->config('pass') ),	180	secret => md5_base64( Encode::encode( 'UTF-8', C4::Context->config('pass') ) ),
180	token => scalar $input->param('csrf_token'),	181	token => scalar $input->param('csrf_token'),
181	});	182	});
182		183
Lines 195-201 else { Link Here
195	$template->param(	196	$template->param(
196	csrf_token => Koha::Token->new->generate_csrf({	197	csrf_token => Koha::Token->new->generate_csrf({
197	id => C4::Context->userenv->{id},	198	id => C4::Context->userenv->{id},
198	secret => md5_base64( C4::Context->config('pass') ),	199	secret => md5_base64( Encode::encode( 'UTF-8', C4::Context->config('pass') ) ),
199	}),	200	}),
200	);	201	);
201	output_html_with_http_headers $input, $cookie, $template->output;	202	output_html_with_http_headers $input, $cookie, $template->output;
202	-