Attachment #90209 for bug #22990

View | Details | Raw Unified | Return to bug 22990
Collapse All | Expand All




            {
                $error = 'cannot_see_patron_infos';
            }
        }        
    } elsif ( $params->{check} eq 'csrf_token' ) {
            $error = 'wrong_csrf_token'
            unless Koha::Token->new->check_csrf(
                {
                    session_id => scalar $query->cookie('CGISESSID'),
                    token      => scalar $query->param('csrf_token'),
                }
            );
        }
    }
    output_and_exit( $query, $cookie, $template, $error ) if $error;
    return;

Lines 142-149 if ( $op eq 'add_form' ) { Link Here

(-)a/acqui/basketheader.pl (-3 / +2 lines)
142	#End Edit	142	#End Edit
143	} elsif ( $op eq 'add_validate' ) {	143	} elsif ( $op eq 'add_validate' ) {
144	#we are confirming the changes, save the basket	144	#we are confirming the changes, save the basket
145	#we are checking CSRF Token. Module CSRF_TOKEN_CHECK indicate for CSRF token checking,	145	#we are checking CSRF Token.
146	output_and_exit_if_error($input, $cookie, $template, { module => 'CSRF_TOKEN_CHECK' });	146	output_and_exit_if_error($input, $cookie, $template, { check => 'csrf_token' });
147		147
148	if ( $is_an_edit ) {	148	if ( $is_an_edit ) {
149	ModBasketHeader(	149	ModBasketHeader(
150	-

Return to bug 22990

Lines 340-355 sub output_and_exit_if_error { Link Here

(-)a/C4/Output.pm (-5 / +4 lines)
340	{	340	{
341	$error = 'cannot_see_patron_infos';	341	$error = 'cannot_see_patron_infos';
342	}	342	}
343	}	343	}
344	elsif ( $params->{module} eq 'CSRF_TOKEN_CHECK' ) {	344	} elsif ( $params->{check} eq 'csrf_token' ) {
345	$error = 'wrong_csrf_token'	345	$error = 'wrong_csrf_token'
346	unless Koha::Token->new->check_csrf(	346	unless Koha::Token->new->check_csrf(
347	{	347	{
348	session_id => scalar $query->cookie('CGISESSID'),	348	session_id => scalar $query->cookie('CGISESSID'),
349	token => scalar $query->param('csrf_token'),	349	token => scalar $query->param('csrf_token'),
350	}	350	}
351	);	351	);
352	}
353	}	352	}
354	output_and_exit( $query, $cookie, $template, $error ) if $error;	353	output_and_exit( $query, $cookie, $template, $error ) if $error;
355	return;	354	return;