Attachment #74496 for bug #20568

View | Details | Raw Unified | Return to bug 20568
Collapse All | Expand All




                <h1>API keys for [% INCLUDE 'patron-title.inc' %]</h1>
                <form id="add-api-key" action="/cgi-bin/koha/members/apikeys.pl" method="post" style="display:none">
                    <input type="hidden" name="patron_id" value="[% patron.id %]" />
                    <input type="hidden" name="csrf_token" value="[% csrf_token %]" />
                    <input type="hidden" name="op" value="generate" />
                    <fieldset class="brief">
                        <legend>Generate new client id/secret pair</legend>

                                            <form action="/cgi-bin/koha/members/apikeys.pl" method="post">
                                                <input type="hidden" name="patron_id" value="[% patron.id %]" />
                                                <input type="hidden" name="key" value="[% key.id %]" />
                                                <input type="hidden" name="csrf_token" value="[% csrf_token %]" />
                                                <input type="hidden" name="op" value="delete" />
                                                <button class="btn btn-default btn-xs delete" type="submit"><i class="fa fa-trash"></i> Delete</button>
                                            </form>
                                            <form action="/cgi-bin/koha/members/apikeys.pl" method="post">
                                                <input type="hidden" name="patron_id" value="[% patron.id %]" />
                                                <input type="hidden" name="key" value="[% key.id %]" />
                                                <input type="hidden" name="csrf_token" value="[% csrf_token %]" />
                                                [% IF key.active %]
                                                    <input type="hidden" name="op" value="revoke" />
                                                    <button class="btn btn-default btn-xs" type="submit"><i class="fa fa-remove"></i> Revoke</button>




                        <fieldset>
                            <legend>Generate new client id/secret pair</legend>
                            <input type="hidden" name="patron_id" value="[% patron.id %]" />
                            <input type="hidden" name="csrf_token" value="[% csrf_token %]" />
                            <input type="hidden" name="op" value="generate" />
                            <label for="description">Description: </label>
                            <input type="text" name="description" />

                                        <td>
                                            <form action="/cgi-bin/koha/opac-apikeys.pl" method="post" class="form-inline">
                                                <input type="hidden" name="key" value="[% key.id %]" />
                                                <input type="hidden" name="csrf_token" value="[% csrf_token %]" />
                                                <input type="hidden" name="op" value="delete" />
                                                <button class="btn btn-link btn-xs delete-key" type="submit"><i class="fa fa-trash"></i> Delete</button>
                                            </form>
                                            <form action="/cgi-bin/koha/opac-apikeys.pl" method="post" class="form-inline">
                                                <input type="hidden" name="key" value="[% key.id %]" />
                                                <input type="hidden" name="csrf_token" value="[% csrf_token %]" />
                                                [% IF key.active %]
                                                    <input type="hidden" name="op" value="revoke" />
                                                    <button class="btn btn-link btn-xs" type="submit"><i class="fa fa-remove"></i> Revoke</button>





use Koha::ApiKeys;
use Koha::Patrons;
use Koha::Token;

my $cgi = new CGI;


    exit;
}

my $op = $cgi->param('op') // '';

if ( $op eq 'generate' or
     $op eq 'delete' or
     $op eq 'revoke' or
     $op eq 'activate' ) {

    die "Wrong CSRF token"
    unless Koha::Token->new->check_csrf({
        session_id => scalar $cgi->cookie('CGISESSID'),
        token      => scalar $cgi->param('csrf_token'),
    });
}

if ($op) {
    if ( $op eq 'generate' ) {

my @api_keys = Koha::ApiKeys->search({ patron_id => $patron_id });

$template->param(
    api_keys   => \@api_keys,
    csrf_token => Koha::Token->new->generate_csrf({ session_id => scalar $cgi->cookie('CGISESSID') }),
    patron     => $patron
);

output_html_with_http_headers $cgi, $cookie, $template->output;





use Koha::ApiKeys;
use Koha::Patrons;
use Koha::Token;

my $cgi = new CGI;


    exit;
}

my $op = $cgi->param('op') // '';

if ( $op eq 'generate' or
     $op eq 'delete' or
     $op eq 'revoke' or
     $op eq 'activate' ) {

    die "Wrong CSRF token"
    unless Koha::Token->new->check_csrf({
        session_id => scalar $cgi->cookie('CGISESSID'),
        token      => scalar $cgi->param('csrf_token'),
    });
}

if ($op) {
    if ($op eq 'generate') {

$template->param(
    api_keys    => \@api_keys,
    apikeysview => 1,
    csrf_token  => Koha::Token->new->generate_csrf({ session_id => scalar $cgi->cookie('CGISESSID') }),
    patron      => $patron
);

- 

Return to bug 20568

Lines 26-31 use C4::Output; Link Here

(-)a/members/apikeys.pl (-3 / +17 lines)
26		26
27	use Koha::ApiKeys;	27	use Koha::ApiKeys;
28	use Koha::Patrons;	28	use Koha::Patrons;
		29	use Koha::Token;
29		30
30	my $cgi = new CGI;	31	my $cgi = new CGI;
31		32
Lines 51-57 if ( not defined $patron ) { Link Here
51	exit;	52	exit;
52	}	53	}
53		54
54	my $op = $cgi->param('op');	55	my $op = $cgi->param('op') // '';
		56
		57	if ( $op eq 'generate' or
		58	$op eq 'delete' or
		59	$op eq 'revoke' or
		60	$op eq 'activate' ) {
		61
		62	die "Wrong CSRF token"
		63	unless Koha::Token->new->check_csrf({
		64	session_id => scalar $cgi->cookie('CGISESSID'),
		65	token => scalar $cgi->param('csrf_token'),
		66	});
		67	}
55		68
56	if ($op) {	69	if ($op) {
57	if ( $op eq 'generate' ) {	70	if ( $op eq 'generate' ) {
Lines 102-109 if ($op) { Link Here
102	my @api_keys = Koha::ApiKeys->search({ patron_id => $patron_id });	115	my @api_keys = Koha::ApiKeys->search({ patron_id => $patron_id });
103		116
104	$template->param(	117	$template->param(
105	api_keys => \@api_keys,	118	api_keys => \@api_keys,
106	patron => $patron	119	csrf_token => Koha::Token->new->generate_csrf({ session_id => scalar $cgi->cookie('CGISESSID') }),
		120	patron => $patron
107	);	121	);
108		122
109	output_html_with_http_headers $cgi, $cookie, $template->output;	123	output_html_with_http_headers $cgi, $cookie, $template->output;

Lines 26-31 use C4::Output; Link Here

(-)a/opac/opac-apikeys.pl (-2 / +15 lines)
26		26
27	use Koha::ApiKeys;	27	use Koha::ApiKeys;
28	use Koha::Patrons;	28	use Koha::Patrons;
		29	use Koha::Token;
29		30
30	my $cgi = new CGI;	31	my $cgi = new CGI;
31		32
Lines 47-53 if ( not defined $patron Link Here
47	exit;	48	exit;
48	}	49	}
49		50
50	my $op = $cgi->param('op');	51	my $op = $cgi->param('op') // '';
		52
		53	if ( $op eq 'generate' or
		54	$op eq 'delete' or
		55	$op eq 'revoke' or
		56	$op eq 'activate' ) {
		57
		58	die "Wrong CSRF token"
		59	unless Koha::Token->new->check_csrf({
		60	session_id => scalar $cgi->cookie('CGISESSID'),
		61	token => scalar $cgi->param('csrf_token'),
		62	});
		63	}
51		64
52	if ($op) {	65	if ($op) {
53	if ($op eq 'generate') {	66	if ($op eq 'generate') {
Lines 99-104 my @api_keys = Koha::ApiKeys->search({ patron_id => $patron_id }); Link Here
99	$template->param(	112	$template->param(
100	api_keys => \@api_keys,	113	api_keys => \@api_keys,
101	apikeysview => 1,	114	apikeysview => 1,
		115	csrf_token => Koha::Token->new->generate_csrf({ session_id => scalar $cgi->cookie('CGISESSID') }),
102	patron => $patron	116	patron => $patron
103	);	117	);
104		118
105	-

Lines 25-30 Link Here

(-)a/koha-tmpl/intranet-tmpl/prog/en/modules/members/apikeys.tt (+3 lines)
25	<h1>API keys for [% INCLUDE 'patron-title.inc' %]</h1>	25	<h1>API keys for [% INCLUDE 'patron-title.inc' %]</h1>
26	<form id="add-api-key" action="/cgi-bin/koha/members/apikeys.pl" method="post" style="display:none">	26	<form id="add-api-key" action="/cgi-bin/koha/members/apikeys.pl" method="post" style="display:none">
27	<input type="hidden" name="patron_id" value="[% patron.id %]" />	27	<input type="hidden" name="patron_id" value="[% patron.id %]" />
		28	<input type="hidden" name="csrf_token" value="[% csrf_token %]" />
28	<input type="hidden" name="op" value="generate" />	29	<input type="hidden" name="op" value="generate" />
29	<fieldset class="brief">	30	<fieldset class="brief">
30	<legend>Generate new client id/secret pair</legend>	31	<legend>Generate new client id/secret pair</legend>
Lines 65-76 Link Here
65	<form action="/cgi-bin/koha/members/apikeys.pl" method="post">	66	<form action="/cgi-bin/koha/members/apikeys.pl" method="post">
66	<input type="hidden" name="patron_id" value="[% patron.id %]" />	67	<input type="hidden" name="patron_id" value="[% patron.id %]" />
67	<input type="hidden" name="key" value="[% key.id %]" />	68	<input type="hidden" name="key" value="[% key.id %]" />
		69	<input type="hidden" name="csrf_token" value="[% csrf_token %]" />
68	<input type="hidden" name="op" value="delete" />	70	<input type="hidden" name="op" value="delete" />
69	<button class="btn btn-default btn-xs delete" type="submit"><i class="fa fa-trash"></i> Delete</button>	71	<button class="btn btn-default btn-xs delete" type="submit"><i class="fa fa-trash"></i> Delete</button>
70	</form>	72	</form>
71	<form action="/cgi-bin/koha/members/apikeys.pl" method="post">	73	<form action="/cgi-bin/koha/members/apikeys.pl" method="post">
72	<input type="hidden" name="patron_id" value="[% patron.id %]" />	74	<input type="hidden" name="patron_id" value="[% patron.id %]" />
73	<input type="hidden" name="key" value="[% key.id %]" />	75	<input type="hidden" name="key" value="[% key.id %]" />
		76	<input type="hidden" name="csrf_token" value="[% csrf_token %]" />
74	[% IF key.active %]	77	[% IF key.active %]
75	<input type="hidden" name="op" value="revoke" />	78	<input type="hidden" name="op" value="revoke" />
76	<button class="btn btn-default btn-xs" type="submit"><i class="fa fa-remove"></i> Revoke</button>	79	<button class="btn btn-default btn-xs" type="submit"><i class="fa fa-remove"></i> Revoke</button>

Lines 35-40 Link Here

(-)a/koha-tmpl/opac-tmpl/bootstrap/en/modules/opac-apikeys.tt (+3 lines)
35	<fieldset>	35	<fieldset>
36	<legend>Generate new client id/secret pair</legend>	36	<legend>Generate new client id/secret pair</legend>
37	<input type="hidden" name="patron_id" value="[% patron.id %]" />	37	<input type="hidden" name="patron_id" value="[% patron.id %]" />
		38	<input type="hidden" name="csrf_token" value="[% csrf_token %]" />
38	<input type="hidden" name="op" value="generate" />	39	<input type="hidden" name="op" value="generate" />
39	<label for="description">Description: </label>	40	<label for="description">Description: </label>
40	<input type="text" name="description" />	41	<input type="text" name="description" />
Lines 64-74 Link Here
64	<td>	65	<td>
65	<form action="/cgi-bin/koha/opac-apikeys.pl" method="post" class="form-inline">	66	<form action="/cgi-bin/koha/opac-apikeys.pl" method="post" class="form-inline">
66	<input type="hidden" name="key" value="[% key.id %]" />	67	<input type="hidden" name="key" value="[% key.id %]" />
		68	<input type="hidden" name="csrf_token" value="[% csrf_token %]" />
67	<input type="hidden" name="op" value="delete" />	69	<input type="hidden" name="op" value="delete" />
68	<button class="btn btn-link btn-xs delete-key" type="submit"><i class="fa fa-trash"></i> Delete</button>	70	<button class="btn btn-link btn-xs delete-key" type="submit"><i class="fa fa-trash"></i> Delete</button>
69	</form>	71	</form>
70	<form action="/cgi-bin/koha/opac-apikeys.pl" method="post" class="form-inline">	72	<form action="/cgi-bin/koha/opac-apikeys.pl" method="post" class="form-inline">
71	<input type="hidden" name="key" value="[% key.id %]" />	73	<input type="hidden" name="key" value="[% key.id %]" />
		74	<input type="hidden" name="csrf_token" value="[% csrf_token %]" />
72	[% IF key.active %]	75	[% IF key.active %]
73	<input type="hidden" name="op" value="revoke" />	76	<input type="hidden" name="op" value="revoke" />
74	<button class="btn btn-link btn-xs" type="submit"><i class="fa fa-remove"></i> Revoke</button>	77	<button class="btn btn-link btn-xs" type="submit"><i class="fa fa-remove"></i> Revoke</button>