View | Details | Raw Unified | Return to bug 22990
Collapse All | Expand All

(-)a/C4/Output.pm (-19 / +18 lines)
Lines 329-355 Others will be added here depending on the needs (for instance biblio does not e Link Here
329
sub output_and_exit_if_error {
329
sub output_and_exit_if_error {
330
    my ( $query, $cookie, $template, $params ) = @_;
330
    my ( $query, $cookie, $template, $params ) = @_;
331
    my $error;
331
    my $error;
332
    if ($params->{module} eq 'CSRF_TOKEN_CHECK') {
332
    if ( $params and exists $params->{module} ) {
333
        my $csrfcheck = Koha::Token->new->check_csrf( {
333
        if ( $params->{module} eq 'members' ) {
334
            session_id => scalar $cookie,
334
            my $logged_in_user = $params->{logged_in_user};
335
            token  => scalar $params->{csrf_token},
335
            my $current_patron = $params->{current_patron};
336
        });
336
            if ( not $current_patron ) {
337
        unless ($csrfcheck) {
337
                $error = 'unknown_patron';
338
            $error = 'wrong_csrf_token';
338
            }
339
            elsif ( not $logged_in_user->can_see_patron_infos($current_patron) )
340
            {
341
                $error = 'cannot_see_patron_infos';
342
            }
339
        }
343
        }
340
344
        elsif ( $params->{module} eq 'CSRF_TOKEN_CHECK' ) {
341
    } else {
345
            $error = 'wrong_csrf_token'
342
        if ( $params and exists $params->{module} ) {
346
              unless Koha::Token->new->check_csrf(
343
            if ( $params->{module} eq 'members' ) {
347
                {
344
                my $logged_in_user = $params->{logged_in_user};
348
                    session_id => scalar $query->cookie('CGISESSID'),
345
                my $current_patron = $params->{current_patron};
349
                    token      => scalar $query->param('csrf_token'),
346
                if ( not $current_patron ) {
347
                    $error = 'unknown_patron';
348
                } 
349
                elsif( not $logged_in_user->can_see_patron_infos( $current_patron ) ) {
350
                    $error = 'cannot_see_patron_infos';
351
                }
350
                }
352
            }
351
              );
353
        }
352
        }
354
    }
353
    }
355
    output_and_exit( $query, $cookie, $template, $error ) if $error;
354
    output_and_exit( $query, $cookie, $template, $error ) if $error;
(-)a/acqui/basketheader.pl (-2 / +2 lines)
Lines 143-149 if ( $op eq 'add_form' ) { Link Here
143
} elsif ( $op eq 'add_validate' ) {
143
} elsif ( $op eq 'add_validate' ) {
144
#we are confirming the changes, save the basket
144
#we are confirming the changes, save the basket
145
#we are checking CSRF Token. Module CSRF_TOKEN_CHECK indicate for CSRF token checking,
145
#we are checking CSRF Token. Module CSRF_TOKEN_CHECK indicate for CSRF token checking,
146
    output_and_exit_if_error( $input, $input->cookie('CGISESSID'), $template, { module => 'CSRF_TOKEN_CHECK', csrf_token => $input->param('csrf_token') } );
146
    output_and_exit_if_error($input, $cookie, $template, { module => 'CSRF_TOKEN_CHECK' });
147
147
    if ( $is_an_edit ) {
148
    if ( $is_an_edit ) {
148
        ModBasketHeader(
149
        ModBasketHeader(
149
            $basketno,
150
            $basketno,
150
- 

Return to bug 22990