Bugzilla – Attachment 133255 Details for
Bug 22990
Add CSRF protection to boraccount, pay, suggestions and virtualshelves on staff
Home
|
New
|
Browse
|
Search
|
[?]
|
Reports
|
Help
|
New Account
|
Log In
[x]
|
Forgot Password
Login:
[x]
[patch]
Bug 22990: Add CSRF protection to Koha pages
Bug-22990-Add-CSRF-protection-to-Koha-pages.patch (text/plain), 16.56 KB, created by
Martin Renvoize (ashimema)
on 2022-04-13 13:11:21 UTC
(
hide
)
Description:
Bug 22990: Add CSRF protection to Koha pages
Filename:
MIME Type:
Creator:
Martin Renvoize (ashimema)
Created:
2022-04-13 13:11:21 UTC
Size:
16.56 KB
patch
obsolete
>From 481833335c78c1d53e61f6374c763e330a7a0ef6 Mon Sep 17 00:00:00 2001 >From: Amit Gupta <amit.gupta@informaticsglobal.com> >Date: Wed, 22 Jan 2020 21:37:22 +0530 >Subject: [PATCH] Bug 22990: Add CSRF protection to Koha pages > >--- > .../prog/en/modules/members/boraccount.tt | 11 +++++++---- > .../intranet-tmpl/prog/en/modules/members/pay.tt | 1 + > .../prog/en/modules/suggestion/suggestion.tt | 8 ++++++-- > members/boraccount.pl | 15 ++++++++++----- > members/pay.pl | 7 +++++++ > members/setstatus.pl | 1 + > suggestion/suggestion.pl | 7 +++++-- > 7 files changed, 37 insertions(+), 13 deletions(-) > >diff --git a/koha-tmpl/intranet-tmpl/prog/en/modules/members/boraccount.tt b/koha-tmpl/intranet-tmpl/prog/en/modules/members/boraccount.tt >index 2542ce0c08..fa3d14254c 100644 >--- a/koha-tmpl/intranet-tmpl/prog/en/modules/members/boraccount.tt >+++ b/koha-tmpl/intranet-tmpl/prog/en/modules/members/boraccount.tt >@@ -44,7 +44,7 @@ > <main> > > [% INCLUDE 'members-toolbar.inc' %] >-<form action="/cgi-bin/koha/members/boraccount.pl" method="get"><input type="hidden" name="borrowernumber" id="borrowernumber" value="[% patron.borrowernumber | html %]" /></form> >+<form action="/cgi-bin/koha/members/boraccount.pl" method="get">[% INCLUDE 'csrf-token.inc' %]<input type="hidden" name="borrowernumber" id="borrowernumber" value="[% patron.borrowernumber | html %]" /></form> > > <!-- The manual invoice and credit buttons --> > <div class="statictabs"> >@@ -111,14 +111,14 @@ > [% END %] > <a href="accountline-details.pl?accountlines_id=[% account.accountlines_id | uri %]" class="btn btn-default btn-xs details-action"><i class="fa fa-list"></i> Details</a> > [% IF account.is_debit && account.amountoutstanding > 0 %] >- <a class="btn btn-default btn-xs pay-action" href="/cgi-bin/koha/members/paycollect.pl?borrowernumber=[% account.borrowernumber | html %]&pay_individual=1&debit_type_code=[% account.debit_type_code | html %]&amount=[% account.amount | html %]&amountoutstanding=[% account.amountoutstanding | html %]&description=[% account.description | html %]&itemnumber=[% account.itemnumber | html %]&accountlines_id=[% account.accountlines_id | html %]"><i class="fa fa-money"></i> Pay</a> >+ <a class="btn btn-default btn-xs pay-action" href="/cgi-bin/koha/members/paycollect.pl?borrowernumber=[% account.borrowernumber | html %]&pay_individual=1&debit_type_code=[% account.debit_type_code | html %]&amount=[% account.amount | html %]&amountoutstanding=[% account.amountoutstanding | html %]&description=[% account.description | html %]&itemnumber=[% account.itemnumber | html %]&accountlines_id=[% account.accountlines_id | html %]&csrf_token=[% csrf_token | html %]"><i class="fa fa-money"></i> Pay</a> > [% END %] > [% IF account.is_credit && account.status != 'VOID' %] >- <a href="boraccount.pl?action=void&accountlines_id=[% account.accountlines_id | uri %]&borrowernumber=[% account.borrowernumber | uri %]" class="btn btn-default btn-xs void-action"><i class="fa fa-ban"></i> Void payment</a> >+ <a href="boraccount.pl?action=void&accountlines_id=[% account.accountlines_id | uri %]&borrowernumber=[% account.borrowernumber | uri %]&csrf_token=[% csrf_token | uri %]" class="btn btn-default btn-xs void-action"><i class="fa fa-ban"></i> Void payment</a> > [% END %] > [% IF account.is_debit && account.amount == account.amountoutstanding && account.status != 'CANCELLED' && !(account.debit_type_code == 'PAYOUT') %] > <form method="post" action="/cgi-bin/koha/members/cancel-charge.pl"> >- <input type="hidden" name="csrf_token" value="[% csrf_token | html %]"> >+ [% INCLUDE 'csrf-token.inc' %] > <input type="hidden" name="borrowernumber" value="[% patron.borrowernumber | html %]"> > <input type="hidden" name="accountlines_id" value="[% account.accountlines_id | html %]"> > <button type="submit" class="btn btn-default btn-xs cancel-action"> >@@ -173,6 +173,7 @@ > <!-- Issue payout modal --> > <div class="modal" id="issuePayoutModal" tabindex="-1" role="dialog" aria-labelledby="issuePayoutLabel"> > <form id="payout_form" action="/cgi-bin/koha/members/boraccount.pl" method="get" enctype="multipart/form-data" class="validated"> >+ [% INCLUDE 'csrf-token.inc' %] > <input type="hidden" name="accountlines_id" value="" id="payoutline"> > <input type="hidden" name="action" value="payout"> > <input type="hidden" name="borrowernumber" value="[% account.borrowernumber | html %]"> >@@ -227,6 +228,7 @@ > <!-- Issue refund modal --> > <div class="modal" id="issueRefundModal" tabindex="-1" role="dialog" aria-labelledby="issueRefundLabel"> > <form id="refund_form" action="/cgi-bin/koha/members/boraccount.pl" method="get" enctype="multipart/form-data" class="validated"> >+ [% INCLUDE 'csrf-token.inc' %] > <input type="hidden" name="accountlines_id" value="" id="refundline"> > <input type="hidden" name="action" value="refund"> > <input type="hidden" name="borrowernumber" value="[% account.borrowernumber | html %]"> >@@ -284,6 +286,7 @@ > <!-- Apply discount modal --> > <div class="modal" id="applyDiscountModal" tabindex="-1" role="dialog" aria-labelledby="applyDiscountLabel"> > <form id="discount_form" action="/cgi-bin/koha/members/boraccount.pl" method="get" enctype="multipart/form-data" class="validated"> >+ [% INCLUDE 'csrf-token.inc' %] > <input type="hidden" name="accountlines_id" value="" id="discountline"> > <input type="hidden" name="action" value="discount"> > <input type="hidden" name="borrowernumber" value="[% account.borrowernumber | html %]"> >diff --git a/koha-tmpl/intranet-tmpl/prog/en/modules/members/pay.tt b/koha-tmpl/intranet-tmpl/prog/en/modules/members/pay.tt >index c88c4b6eea..087daf6c65 100644 >--- a/koha-tmpl/intranet-tmpl/prog/en/modules/members/pay.tt >+++ b/koha-tmpl/intranet-tmpl/prog/en/modules/members/pay.tt >@@ -54,6 +54,7 @@ > [% IF ( accounts ) %] > <form action="/cgi-bin/koha/members/pay.pl" method="post" id="pay-fines-form"> > <input type="hidden" name="borrowernumber" id="borrowernumber" value="[% patron.borrowernumber | html %]" /> >+ [% INCLUDE 'csrf-token.inc' %] > <p><span class="checkall"><a id="CheckAll" href="#"><i class="fa fa-check"></i> Select all</a></span> | <span class="clearall"><a id="CheckNone" href="#"><i class="fa fa-remove"></i> Clear all</a></span></p> > <table id="finest"> > <thead> >diff --git a/koha-tmpl/intranet-tmpl/prog/en/modules/suggestion/suggestion.tt b/koha-tmpl/intranet-tmpl/prog/en/modules/suggestion/suggestion.tt >index 1f691dcf93..a4281b9b00 100644 >--- a/koha-tmpl/intranet-tmpl/prog/en/modules/suggestion/suggestion.tt >+++ b/koha-tmpl/intranet-tmpl/prog/en/modules/suggestion/suggestion.tt >@@ -103,6 +103,7 @@ > [% END %] > </ol> > </nav> <!-- /.breadcrumbs --> >+ [% INCLUDE 'blocking_errors.inc' %] > > [% IF ( op == 'show' ) %] > <div class="main container-fluid"> >@@ -345,6 +346,7 @@ > [% END %] > > <form id="add_edit" action="suggestion.pl" method="post" class="validated"> >+ [% INCLUDE 'csrf-token.inc' %] > <input type="hidden" name="redirect" id="redirect" value="[% redirect | html %]" /> > <input type="hidden" name="borrowernumber" id="borrowernumber" value="[% borrowernumber | html %]" /> > [% IF ( suggestionid ) %] >@@ -716,6 +718,7 @@ > [% FOREACH suggestion IN suggestions %] > <div id="[% suggestion.suggestiontype | html %]"> > <form class="update_suggestions" name="f" method="post" action="/cgi-bin/koha/suggestion/suggestion.pl#[% suggestion.suggestiontype| uri %]"> >+ [% INCLUDE 'csrf-token.inc' %] > > [% IF ( suggestion.suggestions_loop ) %] > <p> >@@ -835,9 +838,9 @@ > </td> > <td class="actions"> > <div class="btn-group dropup"> >- <a class="btn btn-default btn-xs" role="button" href="suggestion.pl?suggestionid=[% suggestions_loo.suggestionid | html %]&op=edit"><i class="fa fa-pencil"></i> Edit</a><a class="btn btn-default btn-xs dropdown-toggle" id="more_actions_[% suggestions_loo.suggestionid | html %]" role="button" data-toggle="dropdown" href="#"><b class="caret"></b></a> >+ <a class="btn btn-default btn-xs" role="button" href="suggestion.pl?suggestionid=[% suggestions_loo.suggestionid | html %]&csrf_token=[% csrf_token | html %]&op=edit"><i class="fa fa-pencil"></i> Edit</a><a class="btn btn-default btn-xs dropdown-toggle" id="more_actions_[% suggestions_loo.suggestionid | html %]" role="button" data-toggle="dropdown" href="#"><b class="caret"></b></a> > <ul class="dropdown-menu pull-right" role="menu" aria-labelledby="more_actions_[% suggestions_loo.suggestionid | html %]"> >- <li><a class="deletesuggestion" href="suggestion.pl?op=delete&suggestionid=[% suggestions_loo.suggestionid | html %]"><i class="fa fa-trash"></i> Delete</a></li> >+ <li><a class="deletesuggestion" href="suggestion.pl?op=delete&suggestionid=[% suggestions_loo.suggestionid | html %]&csrf_token=[% csrf_token | html %]"><i class="fa fa-trash"></i> Delete</a></li> > [% UNLESS suggestions_loo.archived %] > <li><a class="archivesuggestion" href="suggestion.pl?op=archive&suggestionid=[% suggestions_loo.suggestionid | html %]"><i class="fa fa-archive"></i> Archive</a></li> > [% ELSE %] >@@ -976,6 +979,7 @@ > <div class="col-sm-2 col-sm-pull-10"> > <aside> > <form name="suggestionfilter" action="suggestion.pl" method="get"> >+ [% INCLUDE 'csrf-token.inc' %] > <input type="hidden" name="branchcode" value="[% branchfilter | html %]" /> > <fieldset class="brief"> > <ol style="display:block;"> >diff --git a/members/boraccount.pl b/members/boraccount.pl >index 83fa43bf65..d04b520559 100755 >--- a/members/boraccount.pl >+++ b/members/boraccount.pl >@@ -69,6 +69,7 @@ output_and_exit_if_error( $input, $cookie, $template, { module => 'members', log > my $registerid = $input->param('registerid'); > > if ( $action eq 'void' ) { >+ output_and_exit_if_error($input, $cookie, $template, { check => 'csrf_token' }); > my $payment_id = scalar $input->param('accountlines_id'); > my $payment = Koha::Account::Lines->find( $payment_id ); > $payment->void( >@@ -81,8 +82,10 @@ if ( $action eq 'void' ) { > } > > if ( $action eq 'payout' ) { >- my $payment_id = scalar $input->param('accountlines_id'); >- my $amount = scalar $input->param('amount'); >+ output_and_exit_if_error($input, $cookie, $template, { check => 'csrf_token' }); >+ my $payment_id = scalar $input->param('accountlines_id'); >+ my $payment = Koha::Account::Lines->find($payment_id); >+ my $amount = scalar $input->param('amount'); > my $payout_type = scalar $input->param('payout_type'); > if ( $payment_id eq "" ) { > $schema->txn_do( >@@ -119,9 +122,10 @@ if ( $action eq 'payout' ) { > } > > if ( $action eq 'refund' ) { >- my $charge_id = scalar $input->param('accountlines_id'); >- my $charge = Koha::Account::Lines->find($charge_id); >- my $amount = scalar $input->param('amount'); >+ output_and_exit_if_error($input, $cookie, $template, { check => 'csrf_token' }); >+ my $charge_id = scalar $input->param('accountlines_id'); >+ my $charge = Koha::Account::Lines->find($charge_id); >+ my $amount = scalar $input->param('amount'); > my $refund_type = scalar $input->param('refund_type'); > $schema->txn_do( > sub { >@@ -152,6 +156,7 @@ if ( $action eq 'refund' ) { > } > > if ( $action eq 'discount' ) { >+ output_and_exit_if_error($input, $cookie, $template, { check => 'csrf_token' }); > my $charge_id = scalar $input->param('accountlines_id'); > my $charge = Koha::Account::Lines->find($charge_id); > my $amount = scalar $input->param('amount'); >diff --git a/members/pay.pl b/members/pay.pl >index 27181164ad..35b84df6c5 100755 >--- a/members/pay.pl >+++ b/members/pay.pl >@@ -77,19 +77,24 @@ $user ||= q{}; > our $branch = C4::Context->userenv->{'branch'}; > > if ( $input->param('paycollect') ) { >+ output_and_exit_if_error($input, $cookie, $template, { check => 'csrf_token' }); > print $input->redirect( > "/cgi-bin/koha/members/paycollect.pl?borrowernumber=$borrowernumber&change_given=$change_given"); > } > elsif ( $input->param('payselected') ) { >+ output_and_exit_if_error($input, $cookie, $template, { check => 'csrf_token' }); > payselected({ params => \@names }); > } > elsif ( $input->param('writeoff_selected') ) { >+ output_and_exit_if_error($input, $cookie, $template, { check => 'csrf_token' }); > payselected({ params => \@names, type => 'WRITEOFF' }); > } > elsif ( $input->param('woall') ) { >+ output_and_exit_if_error($input, $cookie, $template, { check => 'csrf_token' }); > writeoff_all(@names); > } > elsif ( $input->param('apply_credits') ) { >+ output_and_exit_if_error($input, $cookie, $template, { check => 'csrf_token' }); > apply_credits({ patron => $patron, cgi => $input }); > } > elsif ( $input->param('confirm_writeoff') ) { >@@ -129,9 +134,11 @@ elsif ( $input->param('confirm_writeoff') ) { > > for (@names) { > if (/^pay_indiv_(\d+)$/) { >+ output_and_exit_if_error($input, $cookie, $template, { check => 'csrf_token' }); > my $line_no = $1; > redirect_to_paycollect( 'pay_individual', $line_no ); > } elsif (/^wo_indiv_(\d+)$/) { >+ output_and_exit_if_error($input, $cookie, $template, { check => 'csrf_token' }); > my $line_no = $1; > redirect_to_paycollect( 'writeoff_individual', $line_no ); > } >diff --git a/members/setstatus.pl b/members/setstatus.pl >index 83ef1590be..2cf0f92377 100755 >--- a/members/setstatus.pl >+++ b/members/setstatus.pl >@@ -53,6 +53,7 @@ my $patron = Koha::Patrons->find( $borrowernumber ); > if ( $logged_in_user->can_see_patron_infos($patron) ) { > if ( $reregistration eq 'y' ) { > # re-reregistration function to automatic calcul of date expiry >+ output_and_exit_if_error($input, $cookie, $template, { check => 'csrf_token' }); > $dateexpiry = $patron->renew_account; > } else { > my $sth = $dbh->prepare("UPDATE borrowers SET debarred = ?, debarredcomment = '' WHERE borrowernumber = ?"); >diff --git a/suggestion/suggestion.pl b/suggestion/suggestion.pl >index 5372e00d5b..b9ab8773f4 100755 >--- a/suggestion/suggestion.pl >+++ b/suggestion/suggestion.pl >@@ -127,6 +127,7 @@ my $branchfilter = $input->param('branchcode') || C4::Context->userenv->{'branch > ## > > if ( $op =~ /save/i ) { >+ output_and_exit_if_error($input, $cookie, $template, { check => 'csrf_token' }); > my @messages; > my $biblio = MarcRecordFromNewSuggestion({ > title => $suggestion_only->{title}, >@@ -243,7 +244,8 @@ elsif ($op=~/add/) { > $op ='save'; > } > elsif ($op=~/edit/) { >- #Edit suggestion >+ #Edit suggestion >+ output_and_exit_if_error($input, $cookie, $template, { check => 'csrf_token' }); > $suggestion_ref=&GetSuggestion($$suggestion_ref{'suggestionid'}); > $suggestion_ref->{reasonsloop} = $reasonsloop; > my $other_reason = 1; >@@ -258,7 +260,7 @@ elsif ($op=~/edit/) { > $op ='save'; > } > elsif ($op eq "update_status" ) { >- >+ output_and_exit_if_error($input, $cookie, $template, { check => 'csrf_token' }); > my $suggestion; > # set accepted/rejected/managed informations if applicable > # ie= if the librarian has chosen some action on the suggestions >@@ -295,6 +297,7 @@ elsif ($op eq "update_status" ) { > } > redirect_with_params($input); > }elsif ($op eq "delete" ) { >+ output_and_exit_if_error($input, $cookie, $template, { check => 'csrf_token' }); > foreach my $delete_field (@editsuggestions) { > &DelSuggestion( $borrowernumber, $delete_field,'intranet' ); > } >-- >2.20.1
<b>You cannot view the attachment while viewing its details because your browser does not support IFRAMEs. <a href="attachment.cgi?id=133255">View the attachment on a separate page</a>.</b>
View Attachment As Diff
View Attachment As Raw
Actions:
View
|
Diff
|
Splinter Review
Attachments on
bug 22990
:
90102
|
90192
|
90194
|
90202
|
90204
|
90209
|
90238
|
90239
|
90240
|
95381
|
95382
|
95383
|
95384
|
95385
|
95391
|
95392
|
95393
|
95394
|
95395
|
95396
|
97814
|
122010
|
122011
|
122012
|
122013
|
122014
|
122015
|
122016
|
122023
|
122024
|
122025
|
122026
|
122027
|
122028
|
122029
|
122030
|
122031
|
122046
|
124924
|
124925
|
124926
|
124927
|
124928
|
124929
|
124930
|
124931
|
124932
|
124933
|
124934
|
126091
|
126092
|
126093
|
126094
|
126095
|
126096
|
126097
|
126098
|
126099
|
126100
|
126101
|
133238
|
133239
|
133240
|
133241
|
133242
|
133243
|
133244
|
133245
|
133246
|
133247
|
133248
|
133254
|
133255
|
133256
|
133257
|
133258
|
133422
|
133423
|
133424
|
133425
|
133426
|
133427
|
134848
|
134849
|
134850
|
134851
|
134852
|
134853
|
134854
|
141294
|
141295
|
141296
|
144315
|
144316
|
144317
|
144318
|
144319
|
144320
|
144321
|
144322
|
152626
|
152627
|
152628
|
153394
|
153751
|
153753
|
154044