Attachment 134848 Details for Bug 22990 – Bug 22990: Add CSRF protection to basketheader.pl

[patch] Bug 22990: Add CSRF protection to basketheader.pl

Bug-22990-Add-CSRF-protection-to-basketheaderpl.patch (text/plain), 2.93 KB, created by David Cook on 2022-05-11 07:12:07 UTC

(hide)

Description:

Filename:

MIME Type:

Creator: David Cook

Created: 2022-05-11 07:12:07 UTC

Size: 2.93 KB

patch

obsolete

>From 7115906f2c13a7f0e8d1f24294dfb9421fd0a139 Mon Sep 17 00:00:00 2001
>From: Amit Gupta <amit.gupta@informaticsglobal.com>
>Date: Wed, 29 May 2019 22:46:18 +0530
>Subject: [PATCH] Bug 22990: Add CSRF protection to basketheader.pl
>
>Test plan
>1. Create vendor
>2. Create basket using the form
>
><html>
><body>
><form method="POST" action="http://ip:8080/cgi-bin/koha/acqui/basketheader.pl?booksellerid=1&op=add_form">
><input type="hidden" name="booksellerid" value="1"/>
><input type="hidden" name="basketname" value="CSRFAttack-Test"/>
><input type="hidden" name="billingplace" value="MPL"/>
><input type="hidden" name="deliveryplace" value="MPL"/>
><input type="hidden" name="basketbooksellerid" value="1"/>
><input type="hidden" name="basketnote" value=""/>
><input type="hidden" name="basketbooksellernote" value=""/>
><input type="hidden" name="create_items" value="receiving"/>
><input type="hidden" name="op" value="add_validate"/>
><input type="submit" value="Submit">
></form>
></body>
><html>
>3. You can able to create the basket.
>4. Apply the patch.
>5. Create basket using the form
>6. Now you can get error "The form submission failed (Wrong CSRF token).
>Try to come back, refresh the page, then try again."
>
>Signed-off-by: Martin Renvoize <martin.renvoize@ptfs-europe.com>
>
>Signed-off-by: David Cook <dcook@prosentient.com.au>
>---
> acqui/basketheader.pl                                         | 3 +++
> koha-tmpl/intranet-tmpl/prog/en/modules/acqui/basketheader.tt | 3 ++-
> 2 files changed, 5 insertions(+), 1 deletion(-)
>
>diff --git a/acqui/basketheader.pl b/acqui/basketheader.pl
>index e79daa70a7..284963847e 100755
>--- a/acqui/basketheader.pl
>+++ b/acqui/basketheader.pl
>@@ -141,6 +141,9 @@ if ( $op eq 'add_form' ) {
> #End Edit
> } elsif ( $op eq 'add_validate' ) {
> #we are confirming the changes, save the basket
>+#we are checking CSRF Token.
>+    output_and_exit_if_error($input, $cookie, $template, { check => 'csrf_token' });
>+
>     if ( $is_an_edit ) {
>         ModBasketHeader(
>             $basketno,
>diff --git a/koha-tmpl/intranet-tmpl/prog/en/modules/acqui/basketheader.tt b/koha-tmpl/intranet-tmpl/prog/en/modules/acqui/basketheader.tt
>index 4db81b1650..81b2ea70f0 100644
>--- a/koha-tmpl/intranet-tmpl/prog/en/modules/acqui/basketheader.tt
>+++ b/koha-tmpl/intranet-tmpl/prog/en/modules/acqui/basketheader.tt
>@@ -50,13 +50,14 @@
> <div class="main container-fluid">
>     <div class="row">
>         <div class="col-md-10 col-md-offset-1 col-lg-8 col-lg-offset-2">
>-
>+    [% INCLUDE 'blocking_errors.inc' %]
>     [% IF ( add_form ) %]
>         [% IF ( basketno ) %]
>             <h1>Edit basket [% basketname | html %]</h1>
>         [% ELSE %]<h1>Add a basket to [% booksellername | html %]</h1>
>         [% END %]
>     <form name="Aform" action="[% script_name | html %]" method="post" class="validated">
>+        [% INCLUDE 'csrf-token.inc' %]
>         <input type="hidden" name="booksellerid" value="[% booksellerid | html %]" />
>         <fieldset class="rows">
>             <ol>
>-- 
>2.30.2

Actions: View | Diff | Splinter Review

Attachments on bug 22990: 90102 | 90192 | 90194 | 90202 | 90204 | 90209 | 90238 | 90239 | 90240 | 95381 | 95382 | 95383 | 95384 | 95385 | 95391 | 95392 | 95393 | 95394 | 95395 | 95396 | 97814 | 122010 | 122011 | 122012 | 122013 | 122014 | 122015 | 122016 | 122023 | 122024 | 122025 | 122026 | 122027 | 122028 | 122029 | 122030 | 122031 | 122046 | 124924 | 124925 | 124926 | 124927 | 124928 | 124929 | 124930 | 124931 | 124932 | 124933 | 124934 | 126091 | 126092 | 126093 | 126094 | 126095 | 126096 | 126097 | 126098 | 126099 | 126100 | 126101 | 133238 | 133239 | 133240 | 133241 | 133242 | 133243 | 133244 | 133245 | 133246 | 133247 | 133248 | 133254 | 133255 | 133256 | 133257 | 133258 | 133422 | 133423 | 133424 | 133425 | 133426 | 133427 | 134848 | 134849 | 134850 | 134851 | 134852 | 134853 | 134854 | 141294 | 141295 | 141296 | 144315 | 144316 | 144317 | 144318 | 144319 | 144320 | 144321 | 144322 | 152626 | 152627 | 152628 | 153394 | 153751 | 153753 | 154044