Attachment 133250 Details for Bug 30524 – Bug 30524: Core CSRF checking code

[patch] Bug 30524: Core CSRF checking code

Bug-30524-Core-CSRF-checking-code.patch (text/plain), 4.11 KB, created by Martin Renvoize (ashimema) on 2022-04-13 13:07:36 UTC

(hide)

Description:

Filename:

MIME Type:

Creator: Martin Renvoize (ashimema)

Created: 2022-04-13 13:07:36 UTC

Size: 4.11 KB

patch

obsolete

>From 3a5444acde8ad01fe43ad33ce45d9a1fe6b01688 Mon Sep 17 00:00:00 2001
>From: Martin Renvoize <martin.renvoize@ptfs-europe.com>
>Date: Wed, 13 Apr 2022 13:55:04 +0100
>Subject: [PATCH] Bug 30524: Core CSRF checking code
>
>Split out from bug 22990 as requested.
>---
> C4/Auth.pm                                    |  2 ++
> C4/Output.pm                                  | 33 +++++++++++++++----
> .../prog/en/includes/csrf-token.inc           |  1 +
> 3 files changed, 30 insertions(+), 6 deletions(-)
> create mode 100644 koha-tmpl/intranet-tmpl/prog/en/includes/csrf-token.inc
>
>diff --git a/C4/Auth.pm b/C4/Auth.pm
>index ba28d58cd2..3b6d62d0b7 100644
>--- a/C4/Auth.pm
>+++ b/C4/Auth.pm
>@@ -49,6 +49,7 @@ use C4::Auth_with_shibboleth qw( shib_ok get_login_shib login_shib_url logout_sh
> use Net::CIDR;
> use C4::Log qw( logaction );
> use Koha::CookieManager;
>+use Koha::Token;
> 
> # use utf8;
> 
>@@ -299,6 +300,7 @@ sub get_template_and_user {
>         $template->param( loggedinusernumber => $borrowernumber ); # FIXME Should be replaced with logged_in_user.borrowernumber
>         $template->param( logged_in_user     => $patron );
>         $template->param( sessionID          => $sessionID );
>+        $template->param( csrf_token => Koha::Token->new->generate_csrf({ session_id => scalar $sessionID }));
> 
>         if ( $in->{'type'} eq 'opac' ) {
>             require Koha::Virtualshelves;
>diff --git a/C4/Output.pm b/C4/Output.pm
>index e36ec30bdc..bbbd4dfd2a 100644
>--- a/C4/Output.pm
>+++ b/C4/Output.pm
>@@ -33,6 +33,7 @@ use Scalar::Util qw( looks_like_number );
> use C4::Auth qw( get_template_and_user );
> use C4::Context;
> use C4::Templates;
>+use Koha::Token;
> 
> our (@ISA, @EXPORT_OK);
> 
>@@ -311,9 +312,17 @@ sub is_ajax {
> To executed at the beginning of scripts to stop the script at this point if
> some errors are found.
> 
>-Tests for module 'members':
>-* patron is not defined (we are looking for a patron that does no longer exist/never existed)
>-* The logged in user cannot see patron's infos (feature 'cannot_see_patron_infos')
>+A series of tests can be run for a given module, or a specific check.
>+Params "module" and "check" are mutually exclusive.
>+
>+Tests for modules:
>+* members:
>+    - Patron is not defined (we are looking for a patron that does no longer exist/never existed)
>+    - The logged in user cannot see patron's infos (feature 'cannot_see_patron_infos')
>+
>+Tests for specific check:
>+* csrf_token
>+    will test if the csrf_token CGI param is valid
> 
> Others will be added here depending on the needs (for instance biblio does not exist will be useful).
> 
>@@ -329,16 +338,28 @@ sub output_and_exit_if_error {
>             if ( not $current_patron ) {
>                 $error = 'unknown_patron';
>             }
>-            elsif( not $logged_in_user->can_see_patron_infos( $current_patron ) ) {
>+            elsif ( not $logged_in_user->can_see_patron_infos($current_patron) )
>+            {
>                 $error = 'cannot_see_patron_infos';
>             }
>-        } elsif ( $params->{module} eq 'cataloguing' ) {
>+        }
>+        elsif ( $params->{module} eq 'cataloguing' ) {
>             # We are testing the record to avoid additem to fetch the Koha::Biblio
>             # But in the long term we will want to get a biblio in parameter
>             $error = 'unknown_biblio' unless $params->{record};
>         }
>     }
>-
>+    elsif ( $params and exists $params->{check} ) {
>+        if ( $params->{check} eq 'csrf_token' ) {
>+            $error = 'wrong_csrf_token'
>+              unless Koha::Token->new->check_csrf(
>+                {
>+                    session_id => scalar $query->cookie('CGISESSID'),
>+                    token      => scalar $query->param('csrf_token'),
>+                }
>+              );
>+        }
>+    }
>     output_and_exit( $query, $cookie, $template, $error ) if $error;
>     return;
> }
>diff --git a/koha-tmpl/intranet-tmpl/prog/en/includes/csrf-token.inc b/koha-tmpl/intranet-tmpl/prog/en/includes/csrf-token.inc
>new file mode 100644
>index 0000000000..703d4eb036
>--- /dev/null
>+++ b/koha-tmpl/intranet-tmpl/prog/en/includes/csrf-token.inc
>@@ -0,0 +1 @@
>+<input type="hidden" name="csrf_token" value="[% csrf_token | html %]" />
>-- 
>2.20.1

Actions: View | Diff | Splinter Review

Attachments on bug 30524: 133249 | 133250 | 133420 | 138055 | 141297 | 152629 | 152630 | 152631 | 152632 | 152634 | 152635 | 152637 | 152638 | 153964 | 153965 | 153975 | 153976 | 154000 | 154038