Bugzilla – Attachment 133239 Details for
Bug 22990
Add CSRF protection to boraccount, pay, suggestions and virtualshelves on staff
Home
|
New
|
Browse
|
Search
|
[?]
|
Reports
|
Help
|
New Account
|
Log In
[x]
|
Forgot Password
Login:
[x]
[patch]
Bug 22990: Code cleaning
Bug-22990-Code-cleaning.patch (text/plain), 3.67 KB, created by
Martin Renvoize (ashimema)
on 2022-04-13 12:43:48 UTC
(
hide
)
Description:
Bug 22990: Code cleaning
Filename:
MIME Type:
Creator:
Martin Renvoize (ashimema)
Created:
2022-04-13 12:43:48 UTC
Size:
3.67 KB
patch
obsolete
>From 409a66fbcac02471d5b2cd4b87cbdd08420eb0f0 Mon Sep 17 00:00:00 2001 >From: Jonathan Druart <jonathan.druart@bugs.koha-community.org> >Date: Wed, 29 May 2019 16:43:59 -0500 >Subject: [PATCH] Bug 22990: Code cleaning > >- Remove indentation level >- Remove csrf_token params (can be picked from GGI->param directly) >- Fix the $cookie param's value > >Signed-off-by: Martin Renvoize <martin.renvoize@ptfs-europe.com> >--- > C4/Output.pm | 43 ++++++++++++++++++++++--------------------- > acqui/basketheader.pl | 3 ++- > 2 files changed, 24 insertions(+), 22 deletions(-) > >diff --git a/C4/Output.pm b/C4/Output.pm >index a6a64a2153..5bf853a579 100644 >--- a/C4/Output.pm >+++ b/C4/Output.pm >@@ -323,32 +323,33 @@ Others will be added here depending on the needs (for instance biblio does not e > sub output_and_exit_if_error { > my ( $query, $cookie, $template, $params ) = @_; > my $error; >- if ($params->{module} eq 'CSRF_TOKEN_CHECK') { >- my $csrfcheck = Koha::Token->new->check_csrf( { >- session_id => scalar $cookie, >- token => scalar $params->{csrf_token}, >- }); >- unless ($csrfcheck) { >- $error = 'wrong_csrf_token'; >- } >- >- } else { >- if ( $params and exists $params->{module} ) { >- if ( $params->{module} eq 'members' ) { >- my $logged_in_user = $params->{logged_in_user}; >- my $current_patron = $params->{current_patron}; >- if ( not $current_patron ) { >- $error = 'unknown_patron'; >- } >- elsif( not $logged_in_user->can_see_patron_infos( $current_patron ) ) { >- $error = 'cannot_see_patron_infos'; >- } >+ if ( $params and exists $params->{module} ) { >+ if ( $params->{module} eq 'members' ) { >+ my $logged_in_user = $params->{logged_in_user}; >+ my $current_patron = $params->{current_patron}; >+ if ( not $current_patron ) { >+ $error = 'unknown_patron'; >+ } >+ elsif ( not $logged_in_user->can_see_patron_infos($current_patron) ) >+ { >+ $error = 'cannot_see_patron_infos'; > } >- } elsif ( $params->{module} eq 'cataloguing' ) { >+ } >+ elsif ( $params->{module} eq 'cataloguing' ) { > # We are testing the record to avoid additem to fetch the Koha::Biblio > # But in the long term we will want to get a biblio in parameter > $error = 'unknown_biblio' unless $params->{record}; > } >+ elsif ( $params->{module} eq 'CSRF_TOKEN_CHECK' ) { >+ $error = 'wrong_csrf_token' >+ unless Koha::Token->new->check_csrf( >+ { >+ session_id => scalar $query->cookie('CGISESSID'), >+ token => scalar $query->param('csrf_token'), >+ } >+ ); >+ } >+ } > } > output_and_exit( $query, $cookie, $template, $error ) if $error; > return; >diff --git a/acqui/basketheader.pl b/acqui/basketheader.pl >index 5d3883702b..dbfba52292 100755 >--- a/acqui/basketheader.pl >+++ b/acqui/basketheader.pl >@@ -142,7 +142,8 @@ if ( $op eq 'add_form' ) { > } elsif ( $op eq 'add_validate' ) { > #we are confirming the changes, save the basket > #we are checking CSRF Token. Module CSRF_TOKEN_CHECK indicate for CSRF token checking, >- output_and_exit_if_error( $input, $input->cookie('CGISESSID'), $template, { module => 'CSRF_TOKEN_CHECK', csrf_token => $input->param('csrf_token') } ); >+ output_and_exit_if_error($input, $cookie, $template, { module => 'CSRF_TOKEN_CHECK' }); >+ > if ( $is_an_edit ) { > ModBasketHeader( > $basketno, >-- >2.20.1
You cannot view the attachment while viewing its details because your browser does not support IFRAMEs.
View the attachment on a separate page
.
View Attachment As Diff
View Attachment As Raw
Actions:
View
|
Diff
|
Splinter Review
Attachments on
bug 22990
:
90102
|
90192
|
90194
|
90202
|
90204
|
90209
|
90238
|
90239
|
90240
|
95381
|
95382
|
95383
|
95384
|
95385
|
95391
|
95392
|
95393
|
95394
|
95395
|
95396
|
97814
|
122010
|
122011
|
122012
|
122013
|
122014
|
122015
|
122016
|
122023
|
122024
|
122025
|
122026
|
122027
|
122028
|
122029
|
122030
|
122031
|
122046
|
124924
|
124925
|
124926
|
124927
|
124928
|
124929
|
124930
|
124931
|
124932
|
124933
|
124934
|
126091
|
126092
|
126093
|
126094
|
126095
|
126096
|
126097
|
126098
|
126099
|
126100
|
126101
|
133238
|
133239
|
133240
|
133241
|
133242
|
133243
|
133244
|
133245
|
133246
|
133247
|
133248
|
133254
|
133255
|
133256
|
133257
|
133258
|
133422
|
133423
|
133424
|
133425
|
133426
|
133427
|
134848
|
134849
|
134850
|
134851
|
134852
|
134853
|
134854
|
141294
|
141295
|
141296
|
144315
|
144316
|
144317
|
144318
|
144319
|
144320
|
144321
|
144322
|
152626
|
152627
|
152628
|
153394
|
153751
|
153753
|
154044