Bugzilla – Attachment 154163 Details for
Bug 34369
Add CSRF protection to system preferences
Home
|
New
|
Browse
|
Search
|
[?]
|
Reports
|
Help
|
New Account
|
Log In
[x]
|
Forgot Password
Login:
[x]
[patch]
Bug 34369: Require CSRF token for updating system preferences
Bug-34369-Require-CSRF-token-for-updating-system-p.patch (text/plain), 7.85 KB, created by
Jonathan Druart
on 2023-08-03 08:04:00 UTC
(
hide
)
Description:
Bug 34369: Require CSRF token for updating system preferences
Filename:
MIME Type:
Creator:
Jonathan Druart
Created:
2023-08-03 08:04:00 UTC
Size:
7.85 KB
patch
obsolete
>From af9926dd7b7fcfc7f222a2faa22d9280af6bf548 Mon Sep 17 00:00:00 2001 >From: David Cook <dcook@prosentient.com.au> >Date: Tue, 1 Aug 2023 06:56:23 +0000 >Subject: [PATCH] Bug 34369: Require CSRF token for updating system preferences > >This patch adds the requirements that updating a system preference >requires a CSRF token. (Also, adding and deleting local system preferences.) > >0. Apply patch >1. koha-plack --reload kohadev >2. Add local system preference >3. Update local system preference >4. Delete local system preference >5. Update normal system preference >6. Note no errors > >Signed-off-by: Jonathan Druart <jonathan.druart@bugs.koha-community.org> >--- > admin/preferences.pl | 3 ++- > admin/systempreferences.pl | 5 ++++- > .../prog/en/modules/admin/preferences.tt | 1 + > .../prog/en/modules/admin/systempreferences.tt | 5 +++++ > .../intranet-tmpl/prog/js/pages/preferences.js | 7 +++++++ > svc/config/systempreferences | 14 ++++++++++++++ > 6 files changed, 33 insertions(+), 2 deletions(-) > >diff --git a/admin/preferences.pl b/admin/preferences.pl >index 45a5891c623..7c102803345 100755 >--- a/admin/preferences.pl >+++ b/admin/preferences.pl >@@ -25,7 +25,7 @@ use C4::Context; > use C4::Koha qw( getallthemes ); > use C4::Languages qw( getTranslatedLanguages ); > use C4::ClassSource qw( GetClassSources GetClassSource ); >-use C4::Output qw( output_html_with_http_headers ); >+use C4::Output qw( output_html_with_http_headers output_and_exit_if_error ); > use C4::Templates; > use Koha::Acquisition::Currencies; > use Koha::Database::Columns; >@@ -348,6 +348,7 @@ $tab ||= 'accounting'; # Ideally this should be "local-use" but preferences.pl > my $highlighted; > > if ( $op eq 'save' ) { >+ output_and_exit_if_error($input, $cookie, $template, { check => 'csrf_token' }); > foreach my $param ( $input->param() ) { > my ( $pref ) = ( $param =~ /pref_(.*)/ ); > >diff --git a/admin/systempreferences.pl b/admin/systempreferences.pl >index 1eb54552b12..d2d1369223f 100755 >--- a/admin/systempreferences.pl >+++ b/admin/systempreferences.pl >@@ -49,7 +49,7 @@ use C4::Context; > use C4::Koha qw( getallthemes ); > use C4::Languages qw( getTranslatedLanguages ); > use C4::ClassSource qw( GetClassSources GetClassSource ); >-use C4::Output qw( output_html_with_http_headers ); >+use C4::Output qw( output_html_with_http_headers output_and_exit_if_error ); > use YAML::XS; > > my %tabsysprefs; #we do no longer need to keep track of a tab per pref (yaml) >@@ -235,6 +235,7 @@ if ($op) { > } > > if ( $op eq 'update_and_reedit' ) { >+ output_and_exit_if_error($input, $cookie, $template, { check => 'csrf_token' }); > foreach ( $input->param ) { > } > my $value = ''; >@@ -302,6 +303,7 @@ if ( $op eq 'add_form' ) { > ################## ADD_VALIDATE ################################## > # called by add_form, used to insert/modify data in DB > } elsif ( $op eq 'add_validate' ) { >+ output_and_exit_if_error($input, $cookie, $template, { check => 'csrf_token' }); > # to handle multiple values > my $value; > >@@ -348,6 +350,7 @@ if ( $op eq 'add_form' ) { > ################## DELETE_CONFIRMED ################################## > # called by delete_confirm, used to effectively confirm deletion of data in DB > } elsif ( $op eq 'delete_confirmed' ) { >+ output_and_exit_if_error($input, $cookie, $template, { check => 'csrf_token' }); > C4::Context->delete_preference($searchfield); > # END $OP eq DELETE_CONFIRMED > ################## DEFAULT ################################## >diff --git a/koha-tmpl/intranet-tmpl/prog/en/modules/admin/preferences.tt b/koha-tmpl/intranet-tmpl/prog/en/modules/admin/preferences.tt >index 1bc14581413..cde2c20c489 100644 >--- a/koha-tmpl/intranet-tmpl/prog/en/modules/admin/preferences.tt >+++ b/koha-tmpl/intranet-tmpl/prog/en/modules/admin/preferences.tt >@@ -53,6 +53,7 @@ > <div class="prefs-tab"> > <h2>[% TAB.tab_title | html %] preferences</h2> > <form action="/cgi-bin/koha/admin/preferences.pl" method="post"> >+ [% INCLUDE 'csrf-token.inc' %] > [% UNLESS ( searchfield ) %]<div id="toolbar"><button class="save-all btn btn-primary" type="submit">Save all [% TAB.tab_title | html %] preferences</button></div>[% END %] > <input type="hidden" name="op" value="save" /> > <input type="hidden" name="tab" value="[% TAB.tab_id | html %]" /> >diff --git a/koha-tmpl/intranet-tmpl/prog/en/modules/admin/systempreferences.tt b/koha-tmpl/intranet-tmpl/prog/en/modules/admin/systempreferences.tt >index 1941f22b5d9..9681ac808fe 100644 >--- a/koha-tmpl/intranet-tmpl/prog/en/modules/admin/systempreferences.tt >+++ b/koha-tmpl/intranet-tmpl/prog/en/modules/admin/systempreferences.tt >@@ -81,6 +81,8 @@ > [% END #/ WRAPPER breadcrumbs %] > [% END #/ WRAPPER sub-header.inc %] > >+[% INCLUDE 'blocking_errors.inc' %] >+ > <div class="main container-fluid"> > <div class="row"> > <div class="col-sm-10 col-sm-push-2"> >@@ -92,6 +94,7 @@ > [% ELSE %] > <form action="[% script_name | html %]" name="Aform" method="post"> > [% END %] >+ [% INCLUDE 'csrf-token.inc' %] > <fieldset class="rows"><legend> > <h1> > [% IF ( modify ) %]Modify >@@ -287,6 +290,7 @@ > [% Tvalue | html %] > </td></tr></table> > <form class="inline" action="[% script_name | html %]" method="post"> >+ [% INCLUDE 'csrf-token.inc' %] > <input type="hidden" name="op" value="delete_confirmed" /> > <input type="hidden" name="searchfield" value="[% searchfield | html %]" /> > <input type="hidden" name="Tvalue" value="[% Tvalue | html %]" /> >@@ -335,6 +339,7 @@ > [% ELSE %] > <form action="/cgi-bin/koha/admin/systempreferences.pl" method="post"> > [% END %] >+ [% INCLUDE 'csrf-token.inc' %] > [% IF ( loo.type_free ) %] > <input type="text" name="value" size="[% loo.fieldlength | html %]" value="[% loo.value | html %]" /> > [% END %] >diff --git a/koha-tmpl/intranet-tmpl/prog/js/pages/preferences.js b/koha-tmpl/intranet-tmpl/prog/js/pages/preferences.js >index f5da1d92c4b..d3ca774e3e3 100644 >--- a/koha-tmpl/intranet-tmpl/prog/js/pages/preferences.js >+++ b/koha-tmpl/intranet-tmpl/prog/js/pages/preferences.js >@@ -25,6 +25,13 @@ KOHA.Preferences = { > humanMsg.displayAlert( __("Nothing to save") ); > return; > } >+ let csrf_token_el = $( form ).find('input[name="csrf_token"]'); >+ if (csrf_token_el.length > 0){ >+ let csrf_token = csrf_token_el.val(); >+ if (csrf_token){ >+ data += '&' + 'csrf_token=' + csrf_token; >+ } >+ } > KOHA.AJAX.MarkRunning($(form).find('.save-all'), __("Saving...") ); > KOHA.AJAX.Submit( { > data: data, >diff --git a/svc/config/systempreferences b/svc/config/systempreferences >index 367f220b44f..fd09218b6bd 100755 >--- a/svc/config/systempreferences >+++ b/svc/config/systempreferences >@@ -23,6 +23,7 @@ use Modern::Perl; > use C4::Context; > use C4::Service; > use C4::Log; >+use Koha::Token; > > =head1 NAME > >@@ -63,6 +64,12 @@ Used to set a single system preference. > > sub set_preference { > my ( $preference ) = @_; >+ die "wrong_csrf_token\n" unless Koha::Token->new->check_csrf( >+ { >+ session_id => scalar $query->cookie('CGISESSID'), >+ token => scalar $query->param('csrf_token'), >+ } >+ ); > > my $value = join( ',', $query->param( 'value' ) ); > C4::Context->set_preference( $preference, $value ); >@@ -122,6 +129,13 @@ pref_virtualshelves=0 > =cut > > sub set_preferences { >+ die "wrong_csrf_token\n" unless Koha::Token->new->check_csrf( >+ { >+ session_id => scalar $query->cookie('CGISESSID'), >+ token => scalar $query->param('csrf_token'), >+ } >+ ); >+ > foreach my $param ( $query->param() ) { > my ( $pref ) = ( $param =~ /pref_(.*)/ ); > >-- >2.25.1
You cannot view the attachment while viewing its details because your browser does not support IFRAMEs.
View the attachment on a separate page
.
View Attachment As Diff
View Attachment As Raw
Actions:
View
|
Diff
|
Splinter Review
Attachments on
bug 34369
:
154121
|
154122
|
154163
|
154164
|
154165
|
154237
|
154238
|
154239