Bugzilla – Attachment 152635 Details for
Bug 30524
Add base framework for dealing with CSRF in Koha
Home
|
New
|
Browse
|
Search
|
[?]
|
Reports
|
Help
|
New Account
|
Log In
[x]
|
Forgot Password
Login:
[x]
[patch]
Bug 30524: Core CSRF checking code
Bug-30524-Core-CSRF-checking-code.patch (text/plain), 4.24 KB, created by
Marcel de Rooy
on 2023-06-23 13:54:53 UTC
(
hide
)
Description:
Bug 30524: Core CSRF checking code
Filename:
MIME Type:
Creator:
Marcel de Rooy
Created:
2023-06-23 13:54:53 UTC
Size:
4.24 KB
patch
obsolete
>From 4df423be790b41623a2ebb10e50f0cebe543d5e5 Mon Sep 17 00:00:00 2001 >From: Martin Renvoize <martin.renvoize@ptfs-europe.com> >Date: Wed, 13 Apr 2022 13:55:04 +0100 >Subject: [PATCH] Bug 30524: Core CSRF checking code >Content-Type: text/plain; charset=utf-8 > >Split out from bug 22990 as requested. > >Signed-off-by: David Cook <dcook@prosentient.com.au> > >Signed-off-by: Kyle M Hall <kyle@bywatersolutions.com> > >Signed-off-by: Marcel de Rooy <m.de.rooy@rijksmuseum.nl> >--- > C4/Auth.pm | 2 ++ > C4/Output.pm | 33 +++++++++++++++---- > .../prog/en/includes/csrf-token.inc | 1 + > 3 files changed, 30 insertions(+), 6 deletions(-) > create mode 100644 koha-tmpl/intranet-tmpl/prog/en/includes/csrf-token.inc > >diff --git a/C4/Auth.pm b/C4/Auth.pm >index 07afd24018..59d29fc7e8 100644 >--- a/C4/Auth.pm >+++ b/C4/Auth.pm >@@ -51,6 +51,7 @@ use Net::CIDR; > use C4::Log qw( logaction ); > use Koha::CookieManager; > use Koha::Auth::Permissions; >+use Koha::Token; > > # use utf8; > >@@ -307,6 +308,7 @@ sub get_template_and_user { > $template->param( loggedinusernumber => $borrowernumber ); # FIXME Should be replaced with logged_in_user.borrowernumber > $template->param( logged_in_user => $patron ); > $template->param( sessionID => $sessionID ); >+ $template->param( csrf_token => Koha::Token->new->generate_csrf({ session_id => scalar $sessionID })); > > if ( $in->{'type'} eq 'opac' ) { > require Koha::Virtualshelves; >diff --git a/C4/Output.pm b/C4/Output.pm >index 42c4011ca0..94bc8e0f95 100644 >--- a/C4/Output.pm >+++ b/C4/Output.pm >@@ -34,6 +34,7 @@ use URI::Escape; > use C4::Auth qw( get_template_and_user ); > use C4::Context; > use C4::Templates; >+use Koha::Token; > > our (@ISA, @EXPORT_OK); > >@@ -314,9 +315,17 @@ sub is_ajax { > To executed at the beginning of scripts to stop the script at this point if > some errors are found. > >-Tests for module 'members': >-* patron is not defined (we are looking for a patron that does no longer exist/never existed) >-* The logged in user cannot see patron's infos (feature 'cannot_see_patron_infos') >+A series of tests can be run for a given module, or a specific check. >+Params "module" and "check" are mutually exclusive. >+ >+Tests for modules: >+* members: >+ - Patron is not defined (we are looking for a patron that does no longer exist/never existed) >+ - The logged in user cannot see patron's infos (feature 'cannot_see_patron_infos') >+ >+Tests for specific check: >+* csrf_token >+ will test if the csrf_token CGI param is valid > > Others will be added here depending on the needs (for instance biblio does not exist will be useful). > >@@ -332,16 +341,28 @@ sub output_and_exit_if_error { > if ( not $current_patron ) { > $error = 'unknown_patron'; > } >- elsif( not $logged_in_user->can_see_patron_infos( $current_patron ) ) { >+ elsif ( not $logged_in_user->can_see_patron_infos($current_patron) ) >+ { > $error = 'cannot_see_patron_infos'; > } >- } elsif ( $params->{module} eq 'cataloguing' ) { >+ } >+ elsif ( $params->{module} eq 'cataloguing' ) { > # We are testing the record to avoid additem to fetch the Koha::Biblio > # But in the long term we will want to get a biblio in parameter > $error = 'unknown_biblio' unless $params->{record}; > } > } >- >+ elsif ( $params and exists $params->{check} ) { >+ if ( $params->{check} eq 'csrf_token' ) { >+ $error = 'wrong_csrf_token' >+ unless Koha::Token->new->check_csrf( >+ { >+ session_id => scalar $query->cookie('CGISESSID'), >+ token => scalar $query->param('csrf_token'), >+ } >+ ); >+ } >+ } > output_and_exit( $query, $cookie, $template, $error ) if $error; > return; > } >diff --git a/koha-tmpl/intranet-tmpl/prog/en/includes/csrf-token.inc b/koha-tmpl/intranet-tmpl/prog/en/includes/csrf-token.inc >new file mode 100644 >index 0000000000..703d4eb036 >--- /dev/null >+++ b/koha-tmpl/intranet-tmpl/prog/en/includes/csrf-token.inc >@@ -0,0 +1 @@ >+<input type="hidden" name="csrf_token" value="[% csrf_token | html %]" /> >-- >2.30.2
You cannot view the attachment while viewing its details because your browser does not support IFRAMEs.
View the attachment on a separate page
.
View Attachment As Diff
View Attachment As Raw
Actions:
View
|
Diff
|
Splinter Review
Attachments on
bug 30524
:
133249
|
133250
|
133420
|
138055
|
141297
|
152629
|
152630
|
152631
|
152632
|
152634
| 152635 |
152637
|
152638
|
153964
|
153965
|
153975
|
153976
|
154000
|
154038