Attachment 134850 Details for Bug 22990 – Bug 22990: Add CSRF protection to add_message

[patch] Bug 22990: Add CSRF protection to add_message

Bug-22990-Add-CSRF-protection-to-addmessage.patch (text/plain), 1.59 KB, created by David Cook on 2022-05-11 07:12:20 UTC

(hide)

Description:

Filename:

MIME Type:

Creator: David Cook

Created: 2022-05-11 07:12:20 UTC

Size: 1.59 KB

patch

obsolete

>From 61c9032c65c59636849863c377bc4af22f639497 Mon Sep 17 00:00:00 2001
>From: Martin Renvoize <martin.renvoize@ptfs-europe.com>
>Date: Tue, 15 Jun 2021 16:15:14 +0100
>Subject: [PATCH] Bug 22990: Add CSRF protection to add_message
>
>Signed-off-by: David Cook <dcook@prosentient.com.au>
>---
> circ/add_message.pl                                          | 1 +
> koha-tmpl/intranet-tmpl/prog/en/includes/members-toolbar.inc | 1 +
> 2 files changed, 2 insertions(+)
>
>diff --git a/circ/add_message.pl b/circ/add_message.pl
>index ee90af3522..2018c4fece 100755
>--- a/circ/add_message.pl
>+++ b/circ/add_message.pl
>@@ -34,6 +34,7 @@ my ( $template, $loggedinuser, $cookie ) = get_template_and_user(
>         flagsrequired   => { borrowers => 'edit_borrowers' },
>     }
> );
>+output_and_exit_if_error($input, $cookie, $template, { check => 'csrf_token' });
> 
> my $borrowernumber   = $input->param('borrowernumber');
> my $branchcode       = $input->param('branchcode');
>diff --git a/koha-tmpl/intranet-tmpl/prog/en/includes/members-toolbar.inc b/koha-tmpl/intranet-tmpl/prog/en/includes/members-toolbar.inc
>index 0bf4625335..e9704a4b66 100644
>--- a/koha-tmpl/intranet-tmpl/prog/en/includes/members-toolbar.inc
>+++ b/koha-tmpl/intranet-tmpl/prog/en/includes/members-toolbar.inc
>@@ -105,6 +105,7 @@
>     <div class="modal-dialog">
>         <div class="modal-content">
>             <form method="post" action="/cgi-bin/koha/circ/add_message.pl" id="message_form" name="message_f">
>+                [% INCLUDE 'csrf-token.inc' %]
>                 <div class="modal-header">
>                     <h3>Leave a message</h3>
>                 </div>
>-- 
>2.30.2

Actions: View | Diff | Splinter Review

Attachments on bug 22990: 90102 | 90192 | 90194 | 90202 | 90204 | 90209 | 90238 | 90239 | 90240 | 95381 | 95382 | 95383 | 95384 | 95385 | 95391 | 95392 | 95393 | 95394 | 95395 | 95396 | 97814 | 122010 | 122011 | 122012 | 122013 | 122014 | 122015 | 122016 | 122023 | 122024 | 122025 | 122026 | 122027 | 122028 | 122029 | 122030 | 122031 | 122046 | 124924 | 124925 | 124926 | 124927 | 124928 | 124929 | 124930 | 124931 | 124932 | 124933 | 124934 | 126091 | 126092 | 126093 | 126094 | 126095 | 126096 | 126097 | 126098 | 126099 | 126100 | 126101 | 133238 | 133239 | 133240 | 133241 | 133242 | 133243 | 133244 | 133245 | 133246 | 133247 | 133248 | 133254 | 133255 | 133256 | 133257 | 133258 | 133422 | 133423 | 133424 | 133425 | 133426 | 133427 | 134848 | 134849 | 134850 | 134851 | 134852 | 134853 | 134854 | 141294 | 141295 | 141296 | 144315 | 144316 | 144317 | 144318 | 144319 | 144320 | 144321 | 144322 | 152626 | 152627 | 152628 | 153394 | 153751 | 153753 | 154044