Lines 329-355
Others will be added here depending on the needs (for instance biblio does not e
Link Here
|
329 |
sub output_and_exit_if_error { |
329 |
sub output_and_exit_if_error { |
330 |
my ( $query, $cookie, $template, $params ) = @_; |
330 |
my ( $query, $cookie, $template, $params ) = @_; |
331 |
my $error; |
331 |
my $error; |
332 |
if ($params->{module} eq 'CSRF_TOKEN_CHECK') { |
332 |
if ( $params and exists $params->{module} ) { |
333 |
my $csrfcheck = Koha::Token->new->check_csrf( { |
333 |
if ( $params->{module} eq 'members' ) { |
334 |
session_id => scalar $cookie, |
334 |
my $logged_in_user = $params->{logged_in_user}; |
335 |
token => scalar $params->{csrf_token}, |
335 |
my $current_patron = $params->{current_patron}; |
336 |
}); |
336 |
if ( not $current_patron ) { |
337 |
unless ($csrfcheck) { |
337 |
$error = 'unknown_patron'; |
338 |
$error = 'wrong_csrf_token'; |
338 |
} |
|
|
339 |
elsif ( not $logged_in_user->can_see_patron_infos($current_patron) ) |
340 |
{ |
341 |
$error = 'cannot_see_patron_infos'; |
342 |
} |
339 |
} |
343 |
} |
340 |
|
344 |
elsif ( $params->{module} eq 'CSRF_TOKEN_CHECK' ) { |
341 |
} else { |
345 |
$error = 'wrong_csrf_token' |
342 |
if ( $params and exists $params->{module} ) { |
346 |
unless Koha::Token->new->check_csrf( |
343 |
if ( $params->{module} eq 'members' ) { |
347 |
{ |
344 |
my $logged_in_user = $params->{logged_in_user}; |
348 |
session_id => scalar $query->cookie('CGISESSID'), |
345 |
my $current_patron = $params->{current_patron}; |
349 |
token => scalar $query->param('csrf_token'), |
346 |
if ( not $current_patron ) { |
|
|
347 |
$error = 'unknown_patron'; |
348 |
} |
349 |
elsif( not $logged_in_user->can_see_patron_infos( $current_patron ) ) { |
350 |
$error = 'cannot_see_patron_infos'; |
351 |
} |
350 |
} |
352 |
} |
351 |
); |
353 |
} |
352 |
} |
354 |
} |
353 |
} |
355 |
output_and_exit( $query, $cookie, $template, $error ) if $error; |
354 |
output_and_exit( $query, $cookie, $template, $error ) if $error; |