Attachment #90192 for bug #22990

View | Details | Raw Unified | Return to bug 22990
Collapse All | Expand All

Lines 45-50 use List::MoreUtils qw/ any /; Link Here

(-)a/C4/Auth.pm (+2 lines)
45	use Encode qw( encode is_utf8);	45	use Encode qw( encode is_utf8);
46	use C4::Auth_with_shibboleth;	46	use C4::Auth_with_shibboleth;
47	use Net::CIDR;	47	use Net::CIDR;
		48	use Koha::Token;
48		49
49	# use utf8;	50	# use utf8;
50	use vars qw(@ISA @EXPORT @EXPORT_OK %EXPORT_TAGS $debug $ldap $cas $caslogout);	51	use vars qw(@ISA @EXPORT @EXPORT_OK %EXPORT_TAGS $debug $ldap $cas $caslogout);
Lines 272-277 sub get_template_and_user { Link Here
272	$template->param( loggedinusernumber => $borrowernumber ); # FIXME Should be replaced with logged_in_user.borrowernumber	273	$template->param( loggedinusernumber => $borrowernumber ); # FIXME Should be replaced with logged_in_user.borrowernumber
273	$template->param( logged_in_user => $patron );	274	$template->param( logged_in_user => $patron );
274	$template->param( sessionID => $sessionID );	275	$template->param( sessionID => $sessionID );
		276	$template->param( csrf_token => Koha::Token->new->generate_csrf({ session_id => scalar $sessionID }));
275		277
276	if ( $in->{'type'} eq 'opac' ) {	278	if ( $in->{'type'} eq 'opac' ) {
277	require Koha::Virtualshelves;	279	require Koha::Virtualshelves;





use C4::Context;
use C4::Templates;
use Koha::Token;

use vars qw(@ISA @EXPORT @EXPORT_OK %EXPORT_TAGS);


sub output_and_exit_if_error {
    my ( $query, $cookie, $template, $params ) = @_;
    my $error;
    if ($params->{module} eq 'CSRF_TOKEN_CHECK') {
        my $csrfcheck = Koha::Token->new->check_csrf( {
            session_id => scalar $cookie,
            token  => scalar $params->{csrf_token},
        });
        unless ($csrfcheck) {
            $error = 'wrong_csrf_token';
        }

    } else {
        if ( $params and exists $params->{module} ) {
            if ( $params->{module} eq 'members' ) {
                my $logged_in_user = $params->{logged_in_user};
                my $current_patron = $params->{current_patron};
                if ( not $current_patron ) {
                    $error = 'unknown_patron';
                } 
                elsif( not $logged_in_user->can_see_patron_infos( $current_patron ) ) {
                    $error = 'cannot_see_patron_infos';
                }
            }
        }
    }

    output_and_exit( $query, $cookie, $template, $error ) if $error;
    return;
}

Lines 142-147 if ( $op eq 'add_form' ) { Link Here

(-)a/acqui/basketheader.pl (+2 lines)
142	#End Edit	142	#End Edit
143	} elsif ( $op eq 'add_validate' ) {	143	} elsif ( $op eq 'add_validate' ) {
144	#we are confirming the changes, save the basket	144	#we are confirming the changes, save the basket
		145	#we are checking CSRF Token. Module CSRF_TOKEN_CHECK indicate for CSRF token checking,
		146	output_and_exit_if_error( $input, $input->cookie('CGISESSID'), $template, { module => 'CSRF_TOKEN_CHECK', csrf_token => $input->param('csrf_token') } );
145	if ( $is_an_edit ) {	147	if ( $is_an_edit ) {
146	ModBasketHeader(	148	ModBasketHeader(
147	$basketno,	149	$basketno,

Line 0 Link Here

(-)a/koha-tmpl/intranet-tmpl/prog/en/includes/csrf-token.inc (+1 lines)
	1	<input type="hidden" name="csrf_token" value="[% csrf_token \| html %]" />




<div class="main container-fluid">
    <div class="row">
        <div class="col-md-10 col-md-offset-1 col-lg-8 col-lg-offset-2">
    [% INCLUDE 'blocking_errors.inc' %]
    [% IF ( add_form ) %]
        [% IF ( basketno ) %]
            <h1>Edit basket [% basketname | html %]</h1>
        [% ELSE %]<h1>Add a basket to [% booksellername | html %]</h1>
        [% END %]
    <form name="Aform" action="[% script_name | html %]" method="post" class="validated">
        [% INCLUDE 'csrf-token.inc' %]
        <input type="hidden" name="booksellerid" value="[% booksellerid | html %]" />
        <fieldset class="rows">
            <ol>
- 

Return to bug 22990

Lines 33-38 use Scalar::Util qw( looks_like_number ); Link Here

(-)a/C4/Output.pm (-10 / +21 lines)
33		33
34	use C4::Context;	34	use C4::Context;
35	use C4::Templates;	35	use C4::Templates;
		36	use Koha::Token;
36		37
37	use vars qw(@ISA @EXPORT @EXPORT_OK %EXPORT_TAGS);	38	use vars qw(@ISA @EXPORT @EXPORT_OK %EXPORT_TAGS);
38		39
Lines 328-346 Others will be added here depending on the needs (for instance biblio does not e Link Here
328	sub output_and_exit_if_error {	329	sub output_and_exit_if_error {
329	my ( $query, $cookie, $template, $params ) = @_;	330	my ( $query, $cookie, $template, $params ) = @_;
330	my $error;	331	my $error;
331	if ( $params and exists $params->{module} ) {	332	if ($params->{module} eq 'CSRF_TOKEN_CHECK') {
332	if ( $params->{module} eq 'members' ) {	333	my $csrfcheck = Koha::Token->new->check_csrf( {
333	my $logged_in_user = $params->{logged_in_user};	334	session_id => scalar $cookie,
334	my $current_patron = $params->{current_patron};	335	token => scalar $params->{csrf_token},
335	if ( not $current_patron ) {	336	});
336	$error = 'unknown_patron';	337	unless ($csrfcheck) {
337	}	338	$error = 'wrong_csrf_token';
338	elsif( not $logged_in_user->can_see_patron_infos( $current_patron ) ) {	339	}
339	$error = 'cannot_see_patron_infos';	340
		341	} else {
		342	if ( $params and exists $params->{module} ) {
		343	if ( $params->{module} eq 'members' ) {
		344	my $logged_in_user = $params->{logged_in_user};
		345	my $current_patron = $params->{current_patron};
		346	if ( not $current_patron ) {
		347	$error = 'unknown_patron';
		348	}
		349	elsif( not $logged_in_user->can_see_patron_infos( $current_patron ) ) {
		350	$error = 'cannot_see_patron_infos';
		351	}
340	}	352	}
341	}	353	}
342	}	354	}
343
344	output_and_exit( $query, $cookie, $template, $error ) if $error;	355	output_and_exit( $query, $cookie, $template, $error ) if $error;
345	return;	356	return;
346	}	357	}

Lines 32-44 Link Here

(-)a/koha-tmpl/intranet-tmpl/prog/en/modules/acqui/basketheader.tt (-2 / +2 lines)
32	<div class="main container-fluid">	32	<div class="main container-fluid">
33	<div class="row">	33	<div class="row">
34	<div class="col-md-10 col-md-offset-1 col-lg-8 col-lg-offset-2">	34	<div class="col-md-10 col-md-offset-1 col-lg-8 col-lg-offset-2">
35		35	[% INCLUDE 'blocking_errors.inc' %]
36	[% IF ( add_form ) %]	36	[% IF ( add_form ) %]
37	[% IF ( basketno ) %]	37	[% IF ( basketno ) %]
38	<h1>Edit basket [% basketname \| html %]</h1>	38	<h1>Edit basket [% basketname \| html %]</h1>
39	[% ELSE %]<h1>Add a basket to [% booksellername \| html %]</h1>	39	[% ELSE %]<h1>Add a basket to [% booksellername \| html %]</h1>
40	[% END %]	40	[% END %]
41	<form name="Aform" action="[% script_name \| html %]" method="post" class="validated">	41	<form name="Aform" action="[% script_name \| html %]" method="post" class="validated">
		42	[% INCLUDE 'csrf-token.inc' %]
42	<input type="hidden" name="booksellerid" value="[% booksellerid \| html %]" />	43	<input type="hidden" name="booksellerid" value="[% booksellerid \| html %]" />
43	<fieldset class="rows">	44	<fieldset class="rows">
44	<ol>	45	<ol>
45	-