Attachment #90238 for bug #22990

View | Details | Raw Unified | Return to bug 22990
Collapse All | Expand All




                $error = 'cannot_see_patron_infos';
            }
        }
    }
    elsif ( $params->{check} eq 'csrf_token' ) {
        $error = 'wrong_csrf_token'
          unless Koha::Token->new->check_csrf(
            {
                session_id => scalar $query->cookie('CGISESSID'),
                token      => scalar $query->param('csrf_token'),
            }
          );
    }
    output_and_exit( $query, $cookie, $template, $error ) if $error;
    return;

Lines 142-149 if ( $op eq 'add_form' ) { Link Here

(-)a/acqui/basketheader.pl (-3 / +2 lines)
142	#End Edit	142	#End Edit
143	} elsif ( $op eq 'add_validate' ) {	143	} elsif ( $op eq 'add_validate' ) {
144	#we are confirming the changes, save the basket	144	#we are confirming the changes, save the basket
145	#we are checking CSRF Token. Module CSRF_TOKEN_CHECK indicate for CSRF token checking,	145	#we are checking CSRF Token.
146	output_and_exit_if_error($input, $cookie, $template, { module => 'CSRF_TOKEN_CHECK' });	146	output_and_exit_if_error($input, $cookie, $template, { check => 'csrf_token' });
147		147
148	if ( $is_an_edit ) {	148	if ( $is_an_edit ) {
149	ModBasketHeader(	149	ModBasketHeader(
150	-

Return to bug 22990

Lines 341-355 sub output_and_exit_if_error { Link Here

(-)a/C4/Output.pm (-9 / +9 lines)
341	$error = 'cannot_see_patron_infos';	341	$error = 'cannot_see_patron_infos';
342	}	342	}
343	}	343	}
344	elsif ( $params->{module} eq 'CSRF_TOKEN_CHECK' ) {	344	}
345	$error = 'wrong_csrf_token'	345	elsif ( $params->{check} eq 'csrf_token' ) {
346	unless Koha::Token->new->check_csrf(	346	$error = 'wrong_csrf_token'
347	{	347	unless Koha::Token->new->check_csrf(
348	session_id => scalar $query->cookie('CGISESSID'),	348	{
349	token => scalar $query->param('csrf_token'),	349	session_id => scalar $query->cookie('CGISESSID'),
350	}	350	token => scalar $query->param('csrf_token'),
351	);	351	}
352	}	352	);
353	}	353	}
354	output_and_exit( $query, $cookie, $template, $error ) if $error;	354	output_and_exit( $query, $cookie, $template, $error ) if $error;
355	return;	355	return;