Attachment #95382 for bug #22990

View | Details | Raw Unified | Return to bug 22990
Collapse All | Expand All




sub output_and_exit_if_error {
    my ( $query, $cookie, $template, $params ) = @_;
    my $error;
    if ( $params and exists $params->{module} ) {
        if ( $params->{module} eq 'members' ) {
            my $logged_in_user = $params->{logged_in_user};
            my $current_patron = $params->{current_patron};
            if ( not $current_patron ) {
                $error = 'unknown_patron';
            }
            elsif ( not $logged_in_user->can_see_patron_infos($current_patron) )
            {
                $error = 'cannot_see_patron_infos';
        if ( $params and exists $params->{module} ) {
            if ( $params->{module} eq 'members' ) {
                my $logged_in_user = $params->{logged_in_user};
                my $current_patron = $params->{current_patron};
                if ( not $current_patron ) {
                    $error = 'unknown_patron';
                } 
                elsif( not $logged_in_user->can_see_patron_infos( $current_patron ) ) {
                    $error = 'cannot_see_patron_infos';
                }
            }
        }
        elsif ( $params->{module} eq 'cataloguing' ) {
            # We are testing the record to avoid additem to fetch the Koha::Biblio
            # But in the long term we will want to get a biblio in parameter
            $error = 'unknown_biblio' unless $params->{record};
        }
        elsif ( $params->{module} eq 'CSRF_TOKEN_CHECK' ) {
            $error = 'wrong_csrf_token'
              unless Koha::Token->new->check_csrf(
                {
                    session_id => scalar $query->cookie('CGISESSID'),
                    token      => scalar $query->param('csrf_token'),
                }
              );
            }
        }
    }
    output_and_exit( $query, $cookie, $template, $error ) if $error;
    return;

Lines 144-150 if ( $op eq 'add_form' ) { Link Here

(-)a/acqui/basketheader.pl (-2 / +2 lines)
144	} elsif ( $op eq 'add_validate' ) {	144	} elsif ( $op eq 'add_validate' ) {
145	#we are confirming the changes, save the basket	145	#we are confirming the changes, save the basket
146	#we are checking CSRF Token. Module CSRF_TOKEN_CHECK indicate for CSRF token checking,	146	#we are checking CSRF Token. Module CSRF_TOKEN_CHECK indicate for CSRF token checking,
147	output_and_exit_if_error( $input, $input->cookie('CGISESSID'), $template, { module => 'CSRF_TOKEN_CHECK', csrf_token => $input->param('csrf_token') } );	147	output_and_exit_if_error($input, $cookie, $template, { module => 'CSRF_TOKEN_CHECK' });
		148
148	if ( $is_an_edit ) {	149	if ( $is_an_edit ) {
149	ModBasketHeader(	150	ModBasketHeader(
150	$basketno,	151	$basketno,
151	-

Return to bug 22990

Lines 329-360 Others will be added here depending on the needs (for instance biblio does not e Link Here

(-)a/C4/Output.pm (-21 / +22 lines)
329	sub output_and_exit_if_error {	329	sub output_and_exit_if_error {
330	my ( $query, $cookie, $template, $params ) = @_;	330	my ( $query, $cookie, $template, $params ) = @_;
331	my $error;	331	my $error;
332	if ($params->{module} eq 'CSRF_TOKEN_CHECK') {	332	if ( $params and exists $params->{module} ) {
333	my $csrfcheck = Koha::Token->new->check_csrf( {	333	if ( $params->{module} eq 'members' ) {
334	session_id => scalar $cookie,	334	my $logged_in_user = $params->{logged_in_user};
335	token => scalar $params->{csrf_token},	335	my $current_patron = $params->{current_patron};
336	});	336	if ( not $current_patron ) {
337	unless ($csrfcheck) {	337	$error = 'unknown_patron';
338	$error = 'wrong_csrf_token';	338	}
339	}	339	elsif ( not $logged_in_user->can_see_patron_infos($current_patron) )
340		340	{
341	} else {	341	$error = 'cannot_see_patron_infos';
342	if ( $params and exists $params->{module} ) {
343	if ( $params->{module} eq 'members' ) {
344	my $logged_in_user = $params->{logged_in_user};
345	my $current_patron = $params->{current_patron};
346	if ( not $current_patron ) {
347	$error = 'unknown_patron';
348	}
349	elsif( not $logged_in_user->can_see_patron_infos( $current_patron ) ) {
350	$error = 'cannot_see_patron_infos';
351	}
352	}	342	}
353	} elsif ( $params->{module} eq 'cataloguing' ) {	343	}
		344	elsif ( $params->{module} eq 'cataloguing' ) {
354	# We are testing the record to avoid additem to fetch the Koha::Biblio	345	# We are testing the record to avoid additem to fetch the Koha::Biblio
355	# But in the long term we will want to get a biblio in parameter	346	# But in the long term we will want to get a biblio in parameter
356	$error = 'unknown_biblio' unless $params->{record};	347	$error = 'unknown_biblio' unless $params->{record};
357	}	348	}
		349	elsif ( $params->{module} eq 'CSRF_TOKEN_CHECK' ) {
		350	$error = 'wrong_csrf_token'
		351	unless Koha::Token->new->check_csrf(
		352	{
		353	session_id => scalar $query->cookie('CGISESSID'),
		354	token => scalar $query->param('csrf_token'),
		355	}
		356	);
		357	}
		358	}
358	}	359	}
359	output_and_exit( $query, $cookie, $template, $error ) if $error;	360	output_and_exit( $query, $cookie, $template, $error ) if $error;
360	return;	361	return;