Bugzilla – Attachment 153964 Details for
Bug 30524
Add base framework for dealing with CSRF in Koha
Home
|
New
|
Browse
|
Search
|
[?]
|
Reports
|
Help
|
New Account
|
Log In
[x]
|
Forgot Password
Login:
[x]
[patch]
Bug 30524: (QA follow-up) Only generate CSRF token if it will be used
Bug-30524-QA-follow-up-Only-generate-CSRF-token-if.patch (text/plain), 3.05 KB, created by
Kyle M Hall (khall)
on 2023-07-27 11:46:40 UTC
(
hide
)
Description:
Bug 30524: (QA follow-up) Only generate CSRF token if it will be used
Filename:
MIME Type:
Creator:
Kyle M Hall (khall)
Created:
2023-07-27 11:46:40 UTC
Size:
3.05 KB
patch
obsolete
>From 5ee2bef42f7f2e5e8661191c1d3a49215678f025 Mon Sep 17 00:00:00 2001 >From: Kyle M Hall <kyle@bywatersolutions.com> >Date: Thu, 27 Jul 2023 07:45:57 -0400 >Subject: [PATCH] Bug 30524: (QA follow-up) Only generate CSRF token if it will > be used > >--- > C4/Auth.pm | 1 - > Koha/Template/Plugin/Koha.pm | 26 +++++++++++++++++++ > .../prog/en/includes/csrf-token.inc | 4 ++- > .../prog/en/modules/intranet-main.tt | 1 + > 4 files changed, 30 insertions(+), 2 deletions(-) > >diff --git a/C4/Auth.pm b/C4/Auth.pm >index 3e4cf15195..cf21e3bdc4 100644 >--- a/C4/Auth.pm >+++ b/C4/Auth.pm >@@ -308,7 +308,6 @@ sub get_template_and_user { > $template->param( loggedinusernumber => $borrowernumber ); # FIXME Should be replaced with logged_in_user.borrowernumber > $template->param( logged_in_user => $patron ); > $template->param( sessionID => $sessionID ); >- $template->param( csrf_token => Koha::Token->new->generate_csrf({ session_id => scalar $sessionID })); > > if ( $in->{'type'} eq 'opac' ) { > require Koha::Virtualshelves; >diff --git a/Koha/Template/Plugin/Koha.pm b/Koha/Template/Plugin/Koha.pm >index 5e7a303f70..176818377e 100644 >--- a/Koha/Template/Plugin/Koha.pm >+++ b/Koha/Template/Plugin/Koha.pm >@@ -48,8 +48,22 @@ is necessary. > > =head2 Class Methods > >+=head3 new >+ >+This new method allows us to store the context which gives us >+access to the template vars already set. In particular this gives >+us access to the template vars set by C4::Auth::get_template_and_user >+ > =cut > >+sub new { >+ my ( $class, $context ) = @_; >+ bless { >+ _CONTEXT => $context, >+ }, $class; >+} >+ >+ > sub Preference { > my ( $self, $pref ) = @_; > return C4::Context->preference( $pref ); >@@ -84,4 +98,16 @@ sub Version { > }; > } > >+=head3 GenerateCSRF >+ >+Generate a new CSRF token. >+ >+=cut >+ >+sub GenerateCSRF { >+ my ( $self ) = @_; >+ my $session_id = $self->{_CONTEXT}->stash->{sessionID}; >+ return Koha::Token->new->generate_csrf({ session_id => scalar $session_id }); >+} >+ > 1; >diff --git a/koha-tmpl/intranet-tmpl/prog/en/includes/csrf-token.inc b/koha-tmpl/intranet-tmpl/prog/en/includes/csrf-token.inc >index 703d4eb036..bfc221faf4 100644 >--- a/koha-tmpl/intranet-tmpl/prog/en/includes/csrf-token.inc >+++ b/koha-tmpl/intranet-tmpl/prog/en/includes/csrf-token.inc >@@ -1 +1,3 @@ >-<input type="hidden" name="csrf_token" value="[% csrf_token | html %]" /> >+[%- USE Koha %] >+[%- USE raw %] >+<input type="hidden" name="csrf_token" value="[% Koha.GenerateCSRF | $raw %]" /> >diff --git a/koha-tmpl/intranet-tmpl/prog/en/modules/intranet-main.tt b/koha-tmpl/intranet-tmpl/prog/en/modules/intranet-main.tt >index 1b4dfe93dd..520673a016 100644 >--- a/koha-tmpl/intranet-tmpl/prog/en/modules/intranet-main.tt >+++ b/koha-tmpl/intranet-tmpl/prog/en/modules/intranet-main.tt >@@ -10,6 +10,7 @@ > [% INCLUDE 'doc-head-close.inc' %] > </head> > >+[% Koha.GenerateCSRF %] > <body id="main_intranet-main" class="intranet-main"> > [% WRAPPER 'header.inc' %] > [% INCLUDE 'home-search.inc' %] >-- >2.30.2
You cannot view the attachment while viewing its details because your browser does not support IFRAMEs.
View the attachment on a separate page
.
View Attachment As Diff
View Attachment As Raw
Actions:
View
|
Diff
|
Splinter Review
Attachments on
bug 30524
:
133249
|
133250
|
133420
|
138055
|
141297
|
152629
|
152630
|
152631
|
152632
|
152634
|
152635
|
152637
|
152638
|
153964
|
153965
|
153975
|
153976
|
154000
|
154038