Bugzilla – Attachment 141295 Details for
Bug 22990
Add CSRF protection to boraccount, pay, suggestions and virtualshelves on staff
Home
|
New
|
Browse
|
Search
|
[?]
|
Reports
|
Help
|
New Account
|
Log In
[x]
|
Forgot Password
Login:
[x]
[patch]
Bug 22990: Add CSRF protection to add_message
Bug-22990-Add-CSRF-protection-to-addmessage.patch (text/plain), 9.03 KB, created by
David Cook
on 2022-10-04 02:47:18 UTC
(
hide
)
Description:
Bug 22990: Add CSRF protection to add_message
Filename:
MIME Type:
Creator:
David Cook
Created:
2022-10-04 02:47:18 UTC
Size:
9.03 KB
patch
obsolete
>From 124095edca2c11762cf64fabe273ab601527bc46 Mon Sep 17 00:00:00 2001 >From: Martin Renvoize <martin.renvoize@ptfs-europe.com> >Date: Tue, 15 Jun 2021 16:15:14 +0100 >Subject: [PATCH] Bug 22990: Add CSRF protection to add_message > >Signed-off-by: David Cook <dcook@prosentient.com.au> > >Bug 22990: Fix for shelves table > >Signed-off-by: David Cook <dcook@prosentient.com.au> > >Bug 22990: Fix template toolkit syntax issues in shelves_results.tt > >Bug 22990: Fix for setstatus > >Signed-off-by: David Cook <dcook@prosentient.com.au> >--- > circ/add_message.pl | 1 + > .../intranet-tmpl/prog/en/includes/members-toolbar.inc | 1 + > .../prog/en/modules/virtualshelves/shelves.tt | 4 ++++ > .../en/modules/virtualshelves/tables/shelves_results.tt | 3 +++ > members/setstatus.pl | 2 +- > virtualshelves/shelves.pl | 8 +++++++- > 6 files changed, 17 insertions(+), 2 deletions(-) > >diff --git a/circ/add_message.pl b/circ/add_message.pl >index ee90af3522..2018c4fece 100755 >--- a/circ/add_message.pl >+++ b/circ/add_message.pl >@@ -34,6 +34,7 @@ my ( $template, $loggedinuser, $cookie ) = get_template_and_user( > flagsrequired => { borrowers => 'edit_borrowers' }, > } > ); >+output_and_exit_if_error($input, $cookie, $template, { check => 'csrf_token' }); > > my $borrowernumber = $input->param('borrowernumber'); > my $branchcode = $input->param('branchcode'); >diff --git a/koha-tmpl/intranet-tmpl/prog/en/includes/members-toolbar.inc b/koha-tmpl/intranet-tmpl/prog/en/includes/members-toolbar.inc >index 056d855bd9..f7d69d8fe0 100644 >--- a/koha-tmpl/intranet-tmpl/prog/en/includes/members-toolbar.inc >+++ b/koha-tmpl/intranet-tmpl/prog/en/includes/members-toolbar.inc >@@ -109,6 +109,7 @@ > <div class="modal-dialog"> > <div class="modal-content"> > <form method="post" action="/cgi-bin/koha/circ/add_message.pl" id="message_form" name="message_f"> >+ [% INCLUDE 'csrf-token.inc' %] > <div class="modal-header"> > <h3>Leave a message</h3> > </div> >diff --git a/koha-tmpl/intranet-tmpl/prog/en/modules/virtualshelves/shelves.tt b/koha-tmpl/intranet-tmpl/prog/en/modules/virtualshelves/shelves.tt >index cb62f8cf1c..0ee8367f02 100644 >--- a/koha-tmpl/intranet-tmpl/prog/en/modules/virtualshelves/shelves.tt >+++ b/koha-tmpl/intranet-tmpl/prog/en/modules/virtualshelves/shelves.tt >@@ -212,6 +212,7 @@ > <h1>Transfer ownership of public list [% shelf.shelfname | html %]</h1> > > <form action="/cgi-bin/koha/virtualshelves/shelves.pl" id="transferform" method="post"> >+ [% INCLUDE 'csrf-token.inc' %] > <fieldset> > <input type="hidden" name="op" value="transfer" /> > <input type="hidden" name="public" value="1" /> >@@ -244,6 +245,7 @@ > [% IF itemsloop %] > <div class="pages">[% pagination_bar | $raw %]</div> > <form action="/cgi-bin/koha/virtualshelves/shelves.pl" id="listform" method="post"> >+ [% INCLUDE 'csrf-token.inc' %] > <input type="hidden" name="op" value="remove_biblios" /> > <input type="hidden" name="referer" value="view" /> > <input type="hidden" name="shelfnumber" value="[% shelf.shelfnumber | html %]" /> >@@ -392,6 +394,7 @@ > [% IF op == 'add_form' OR op == 'edit_form' %] > > <form method="post" action="/cgi-bin/koha/virtualshelves/shelves.pl" class="validated"> >+ [% INCLUDE 'csrf-token.inc' %] > <fieldset class="rows"> > [% IF op == 'add_form' %] > <legend><h1>Create a new list</h1></legend> >@@ -551,6 +554,7 @@ > <div class="modal" id="addToList" tabindex="-1" role="dialog" aria-labelledby="addToListLabel"> > <div class="modal-dialog" role="document"> > <form action="/cgi-bin/koha/virtualshelves/shelves.pl" method="post"> >+ [% INCLUDE 'csrf-token.inc' %] > <div class="modal-content"> > <div class="modal-header"> > <button type="button" class="closebtn" data-dismiss="modal" aria-label="Close"><span aria-hidden="true">×</span></button> >diff --git a/koha-tmpl/intranet-tmpl/prog/en/modules/virtualshelves/tables/shelves_results.tt b/koha-tmpl/intranet-tmpl/prog/en/modules/virtualshelves/tables/shelves_results.tt >index 8e5a4c24d6..e37b39f966 100644 >--- a/koha-tmpl/intranet-tmpl/prog/en/modules/virtualshelves/tables/shelves_results.tt >+++ b/koha-tmpl/intranet-tmpl/prog/en/modules/virtualshelves/tables/shelves_results.tt >@@ -39,6 +39,7 @@ > [%~ public = public | html ~%] > [%~ IF can_manage_shelf ~%] > [%~ action_block = '<form action="shelves.pl" method="get">' ~%] >+ [%~ action_block = BLOCK ~%][%~ action_block | $raw ~%][%~ INCLUDE 'csrf-token.inc' | trim ~%][%~ END ~%] > [%~ action_block = action_block _ '<input type="hidden" name="shelfnumber" value="' _ shelfnumber _ '" />' ~%] > [%~ action_block = action_block _ '<input type="hidden" name="op" value="edit_form" />' ~%] > [%~ action_block = action_block _ '<input type="hidden" name="public" value="' _ public _ '" />' ~%] >@@ -48,6 +49,7 @@ > [%~ END ~%] > [%~ IF can_delete_shelf ~%] > [%~ action_block = action_block _ ' <form action="shelves.pl" method="post">' ~%] >+ [%~ action_block = BLOCK ~%][%~ action_block | $raw ~%][%~ INCLUDE 'csrf-token.inc' | trim ~%][%~ END ~%] > [%~ action_block = action_block _ '<input type="hidden" name="shelves" value="1" />' ~%] > [%~ action_block = action_block _ '<input type="hidden" name="op" value="delete" />' ~%] > [%~ action_block = action_block _ '<input type="hidden" name="shelfnumber" value="' _ shelfnumber _ '" />' ~%] >@@ -70,4 +72,5 @@ > [%~ SET action_block = 'None' ~%] > [%~ END ~%] > [%~ To.json(action_block) | $raw ~%] >+ > [%~ END ~%] >diff --git a/members/setstatus.pl b/members/setstatus.pl >index 2cf0f92377..1a28c25384 100755 >--- a/members/setstatus.pl >+++ b/members/setstatus.pl >@@ -34,7 +34,7 @@ use Koha::Patrons; > > my $input = CGI->new; > >-my ( $loggedinuserid ) = checkauth($input, 0, { borrowers => 'edit_borrowers' }, 'intranet'); >+my ( $loggedinuserid, $cookie ) = checkauth($input, 0, { borrowers => 'edit_borrowers' }, 'intranet'); > > my $destination = $input->param("destination") || ''; > my $borrowernumber=$input->param('borrowernumber'); >diff --git a/virtualshelves/shelves.pl b/virtualshelves/shelves.pl >index fa92cfcd6e..cdc9f133fc 100755 >--- a/virtualshelves/shelves.pl >+++ b/virtualshelves/shelves.pl >@@ -29,7 +29,7 @@ use C4::Koha qw( > GetNormalizedUPC > ); > use C4::Members; >-use C4::Output qw( pagination_bar output_html_with_http_headers ); >+use C4::Output qw( pagination_bar output_html_with_http_headers output_and_exit_if_error ); > use C4::XSLT qw( XSLTParse4Display ); > > use Koha::Biblios; >@@ -63,6 +63,7 @@ if ( $op eq 'add_form' ) { > # Only pass default > $shelf = { allow_change_from_owner => 1 }; > } elsif ( $op eq 'edit_form' ) { >+ output_and_exit_if_error($query, $cookie, $template, { check => 'csrf_token' }); > $shelfnumber = $query->param('shelfnumber'); > $shelf = Koha::Virtualshelves->find($shelfnumber); > >@@ -78,6 +79,7 @@ if ( $op eq 'add_form' ) { > push @messages, { type => 'alert', code => 'does_not_exist' }; > } > } elsif ( $op eq 'add' ) { >+ output_and_exit_if_error($query, $cookie, $template, { check => 'csrf_token' }); > my $allow_changes_from = $query->param('allow_changes_from'); > eval { > $shelf = Koha::Virtualshelf->new( >@@ -103,6 +105,7 @@ if ( $op eq 'add_form' ) { > $op = 'view'; > } > } elsif ( $op eq 'edit' ) { >+ output_and_exit_if_error($query, $cookie, $template, { check => 'csrf_token' }); > $shelfnumber = $query->param('shelfnumber'); > $shelf = Koha::Virtualshelves->find($shelfnumber); > >@@ -133,6 +136,7 @@ if ( $op eq 'add_form' ) { > push @messages, { type => 'alert', code => 'does_not_exist' }; > } > } elsif ( $op eq 'delete' ) { >+ output_and_exit_if_error($query, $cookie, $template, { check => 'csrf_token' }); > $shelfnumber = $query->param('shelfnumber'); > $shelf = Koha::Virtualshelves->find($shelfnumber); > if ($shelf) { >@@ -151,6 +155,7 @@ if ( $op eq 'add_form' ) { > } > $op = 'list'; > } elsif ( $op eq 'add_biblio' ) { >+ output_and_exit_if_error($query, $cookie, $template, { check => 'csrf_token' }); > $shelfnumber = $query->param('shelfnumber'); > $shelf = Koha::Virtualshelves->find($shelfnumber); > if ($shelf) { >@@ -207,6 +212,7 @@ if ( $op eq 'add_form' ) { > } > $op = $referer; > } elsif ( $op eq 'remove_biblios' ) { >+ output_and_exit_if_error($query, $cookie, $template, { check => 'csrf_token' }); > $shelfnumber = $query->param('shelfnumber'); > $shelf = Koha::Virtualshelves->find($shelfnumber); > my @biblionumbers = $query->multi_param('biblionumber'); >-- >2.30.2
You cannot view the attachment while viewing its details because your browser does not support IFRAMEs.
View the attachment on a separate page
.
View Attachment As Diff
View Attachment As Raw
Actions:
View
|
Diff
|
Splinter Review
Attachments on
bug 22990
:
90102
|
90192
|
90194
|
90202
|
90204
|
90209
|
90238
|
90239
|
90240
|
95381
|
95382
|
95383
|
95384
|
95385
|
95391
|
95392
|
95393
|
95394
|
95395
|
95396
|
97814
|
122010
|
122011
|
122012
|
122013
|
122014
|
122015
|
122016
|
122023
|
122024
|
122025
|
122026
|
122027
|
122028
|
122029
|
122030
|
122031
|
122046
|
124924
|
124925
|
124926
|
124927
|
124928
|
124929
|
124930
|
124931
|
124932
|
124933
|
124934
|
126091
|
126092
|
126093
|
126094
|
126095
|
126096
|
126097
|
126098
|
126099
|
126100
|
126101
|
133238
|
133239
|
133240
|
133241
|
133242
|
133243
|
133244
|
133245
|
133246
|
133247
|
133248
|
133254
|
133255
|
133256
|
133257
|
133258
|
133422
|
133423
|
133424
|
133425
|
133426
|
133427
|
134848
|
134849
|
134850
|
134851
|
134852
|
134853
|
134854
|
141294
|
141295
|
141296
|
144315
|
144316
|
144317
|
144318
|
144319
|
144320
|
144321
|
144322
|
152626
|
152627
|
152628
|
153394
|
153751
|
153753
|
154044