Attachment #90102 for bug #22990

View | Details | Raw Unified | Return to bug 22990
Collapse All | Expand All

Lines 45-50 use List::MoreUtils qw/ any /; Link Here

(-)a/C4/Auth.pm (+2 lines)
45	use Encode qw( encode is_utf8);	45	use Encode qw( encode is_utf8);
46	use C4::Auth_with_shibboleth;	46	use C4::Auth_with_shibboleth;
47	use Net::CIDR;	47	use Net::CIDR;
		48	use Koha::Token;
48		49
49	# use utf8;	50	# use utf8;
50	use vars qw(@ISA @EXPORT @EXPORT_OK %EXPORT_TAGS $debug $ldap $cas $caslogout);	51	use vars qw(@ISA @EXPORT @EXPORT_OK %EXPORT_TAGS $debug $ldap $cas $caslogout);
Lines 272-277 sub get_template_and_user { Link Here
272	$template->param( loggedinusernumber => $borrowernumber ); # FIXME Should be replaced with logged_in_user.borrowernumber	273	$template->param( loggedinusernumber => $borrowernumber ); # FIXME Should be replaced with logged_in_user.borrowernumber
273	$template->param( logged_in_user => $patron );	274	$template->param( logged_in_user => $patron );
274	$template->param( sessionID => $sessionID );	275	$template->param( sessionID => $sessionID );
		276	$template->param( csrf_token => Koha::Token->new->generate_csrf({ session_id => scalar $sessionID }));
275		277
276	if ( $in->{'type'} eq 'opac' ) {	278	if ( $in->{'type'} eq 'opac' ) {
277	require Koha::Virtualshelves;	279	require Koha::Virtualshelves;





use C4::Context;
use C4::Templates;
use Koha::Token;

use vars qw(@ISA @EXPORT @EXPORT_OK %EXPORT_TAGS);


sub output_and_exit_if_error {
    my ( $query, $cookie, $template, $params ) = @_;
    my $error;
    if ($params->{module} eq 1) {
        $error = 'wrong_csrf_token';
        output_and_exit( $query, $cookie, $template, $error )
        unless Koha::Token->new->check_csrf( {
            session_id => scalar $cookie,
            token  => scalar $params->{csrf_token},
       });
    } else {
        if ( $params and exists $params->{module} ) {
            if ( $params->{module} eq 'members' ) {
                my $logged_in_user = $params->{logged_in_user};
                my $current_patron = $params->{current_patron};
                if ( not $current_patron ) {
                    $error = 'unknown_patron';
                }
                elsif( not $logged_in_user->can_see_patron_infos( $current_patron ) ) {
                    $error = 'cannot_see_patron_infos';
                }
            }
        } 
    }

        output_and_exit( $query, $cookie, $template, $error ) if $error;
        return;
    }
}

=item output_and_exit

Lines 142-147 if ( $op eq 'add_form' ) { Link Here

(-)a/acqui/basketheader.pl (+3 lines)
142	#End Edit	142	#End Edit
143	} elsif ( $op eq 'add_validate' ) {	143	} elsif ( $op eq 'add_validate' ) {
144	#we are confirming the changes, save the basket	144	#we are confirming the changes, save the basket
		145	#we are checking CSRF Token. Module 1 indicate for CSRF,
		146	output_and_exit_if_error( $input, $input->cookie('CGISESSID'), $template, { module => 1, csrf_token => $input->param('csrf_token') } );
		147
145	if ( $is_an_edit ) {	148	if ( $is_an_edit ) {
146	ModBasketHeader(	149	ModBasketHeader(
147	$basketno,	150	$basketno,

Line 0 Link Here

(-)a/koha-tmpl/intranet-tmpl/prog/en/includes/csrf-token.inc (+1 lines)
	1	<input type="hidden" name="csrf_token" value="[% csrf_token \| html %]" />

Lines 17-22 Link Here

(-)a/koha-tmpl/intranet-tmpl/prog/en/modules/acqui/basketheader.tt (-1 / +2 lines)
17	<body id="acq_basketheader" class="acq">	17	<body id="acq_basketheader" class="acq">
18	[% INCLUDE 'header.inc' %]	18	[% INCLUDE 'header.inc' %]
19	[% INCLUDE 'acquisitions-search.inc' %]	19	[% INCLUDE 'acquisitions-search.inc' %]
		20	[% INCLUDE 'blocking_errors.inc' %]
20		21
21	<div id="breadcrumbs">	22	<div id="breadcrumbs">
22	<a href="/cgi-bin/koha/mainpage.pl">Home</a> &rsaquo;	23	<a href="/cgi-bin/koha/mainpage.pl">Home</a> &rsaquo;
Lines 39-44 Link Here
39	[% ELSE %]<h1>Add a basket to [% booksellername \| html %]</h1>	40	[% ELSE %]<h1>Add a basket to [% booksellername \| html %]</h1>
40	[% END %]	41	[% END %]
41	<form name="Aform" action="[% script_name \| html %]" method="post" class="validated">	42	<form name="Aform" action="[% script_name \| html %]" method="post" class="validated">
		43	[% INCLUDE 'csrf-token.inc' %]
42	<input type="hidden" name="booksellerid" value="[% booksellerid \| html %]" />	44	<input type="hidden" name="booksellerid" value="[% booksellerid \| html %]" />
43	<fieldset class="rows">	45	<fieldset class="rows">
44	<ol>	46	<ol>
45	-

Return to bug 22990

Lines 33-38 use Scalar::Util qw( looks_like_number ); Link Here

(-)a/C4/Output.pm (-13 / +23 lines)
33		33
34	use C4::Context;	34	use C4::Context;
35	use C4::Templates;	35	use C4::Templates;
		36	use Koha::Token;
36		37
37	use vars qw(@ISA @EXPORT @EXPORT_OK %EXPORT_TAGS);	38	use vars qw(@ISA @EXPORT @EXPORT_OK %EXPORT_TAGS);
38		39
Lines 328-348 Others will be added here depending on the needs (for instance biblio does not e Link Here
328	sub output_and_exit_if_error {	329	sub output_and_exit_if_error {
329	my ( $query, $cookie, $template, $params ) = @_;	330	my ( $query, $cookie, $template, $params ) = @_;
330	my $error;	331	my $error;
331	if ( $params and exists $params->{module} ) {	332	if ($params->{module} eq 1) {
332	if ( $params->{module} eq 'members' ) {	333	$error = 'wrong_csrf_token';
333	my $logged_in_user = $params->{logged_in_user};	334	output_and_exit( $query, $cookie, $template, $error )
334	my $current_patron = $params->{current_patron};	335	unless Koha::Token->new->check_csrf( {
335	if ( not $current_patron ) {	336	session_id => scalar $cookie,
336	$error = 'unknown_patron';	337	token => scalar $params->{csrf_token},
337	}	338	});
338	elsif( not $logged_in_user->can_see_patron_infos( $current_patron ) ) {	339	} else {
339	$error = 'cannot_see_patron_infos';	340	if ( $params and exists $params->{module} ) {
		341	if ( $params->{module} eq 'members' ) {
		342	my $logged_in_user = $params->{logged_in_user};
		343	my $current_patron = $params->{current_patron};
		344	if ( not $current_patron ) {
		345	$error = 'unknown_patron';
		346	}
		347	elsif( not $logged_in_user->can_see_patron_infos( $current_patron ) ) {
		348	$error = 'cannot_see_patron_infos';
		349	}
340	}	350	}
341	}	351	}
342	}
343		352
344	output_and_exit( $query, $cookie, $template, $error ) if $error;	353	output_and_exit( $query, $cookie, $template, $error ) if $error;
345	return;	354	return;
		355	}
346	}	356	}
347		357
348	=item output_and_exit	358	=item output_and_exit