Bugzilla – Attachment 154243 Details for
Bug 34478
Full CSRF protection
Home
|
New
|
Browse
|
Search
|
[?]
|
Reports
|
Help
|
New Account
|
Log In
[x]
|
Forgot Password
Login:
[x]
[patch]
Bug 34478: Replace csrf_token input with include file
Bug-34478-Replace-csrftoken-input-with-include-fil.patch (text/plain), 19.30 KB, created by
Jonathan Druart
on 2023-08-04 09:48:38 UTC
(
hide
)
Description:
Bug 34478: Replace csrf_token input with include file
Filename:
MIME Type:
Creator:
Jonathan Druart
Created:
2023-08-04 09:48:38 UTC
Size:
19.30 KB
patch
obsolete
>From 121153555c7e56df630e0d88bd1339173374c796 Mon Sep 17 00:00:00 2001 >From: Jonathan Druart <jonathan.druart@bugs.koha-community.org> >Date: Fri, 4 Aug 2023 10:56:50 +0200 >Subject: [PATCH] Bug 34478: Replace csrf_token input with include file > >perl -p -i -n -e 's#<input type="hidden" name="csrf_token" value="\[% csrf_token \| html %]" />#[% INCLUDE 'csrf-token.inc' %]#g' **/*.tt **/*.inc > >This should have actually been done at the same time as > "Bug 30524: (QA follow-up) Only generate CSRF token if it will be used" >--- > koha-tmpl/intranet-tmpl/prog/en/includes/circ-menu.inc | 2 +- > .../intranet-tmpl/prog/en/modules/basket/sendbasketform.tt | 2 +- > koha-tmpl/intranet-tmpl/prog/en/modules/members/apikeys.tt | 6 +++--- > .../intranet-tmpl/prog/en/modules/members/deletemem.tt | 2 +- > .../intranet-tmpl/prog/en/modules/members/mancredit.tt | 2 +- > .../intranet-tmpl/prog/en/modules/members/maninvoice.tt | 2 +- > .../intranet-tmpl/prog/en/modules/members/member-flags.tt | 2 +- > .../prog/en/modules/members/member-password.tt | 2 +- > .../intranet-tmpl/prog/en/modules/members/memberentrygen.tt | 2 +- > .../intranet-tmpl/prog/en/modules/members/paycollect.tt | 6 +++--- > .../prog/en/modules/members/two_factor_auth.tt | 2 +- > .../intranet-tmpl/prog/en/modules/tools/import_borrowers.tt | 2 +- > .../intranet-tmpl/prog/en/modules/tools/picture-upload.tt | 2 +- > .../opac-tmpl/bootstrap/en/modules/opac-memberentry.tt | 2 +- > koha-tmpl/opac-tmpl/bootstrap/en/modules/opac-messaging.tt | 2 +- > .../opac-tmpl/bootstrap/en/modules/opac-sendbasketform.tt | 2 +- > koha-tmpl/opac-tmpl/bootstrap/en/modules/opac-user.tt | 2 +- > 17 files changed, 21 insertions(+), 21 deletions(-) > >diff --git a/koha-tmpl/intranet-tmpl/prog/en/includes/circ-menu.inc b/koha-tmpl/intranet-tmpl/prog/en/includes/circ-menu.inc >index 3ed1cc52826..da93c0ff19b 100644 >--- a/koha-tmpl/intranet-tmpl/prog/en/includes/circ-menu.inc >+++ b/koha-tmpl/intranet-tmpl/prog/en/includes/circ-menu.inc >@@ -255,7 +255,7 @@ > </div> > <input type="hidden" name="uploadfilename" value="patron-photo.jpg" /> > <textarea id="uploadfiletext" name="uploadfiletext" style="display:none;"></textarea> >- <input type="hidden" name="csrf_token" value="[% csrf_token | html %]" /> >+ [% INCLUDE csrf-token.inc %] > <input type="hidden" name="filetype" value="image" /> > <input type="hidden" name="cardnumber" value="[% patron.cardnumber | html %]" /> > <input type="hidden" name="borrowernumber" value="[% patron.borrowernumber | html %]" /> >diff --git a/koha-tmpl/intranet-tmpl/prog/en/modules/basket/sendbasketform.tt b/koha-tmpl/intranet-tmpl/prog/en/modules/basket/sendbasketform.tt >index 108aa1ea927..0e3e9f74ecf 100644 >--- a/koha-tmpl/intranet-tmpl/prog/en/modules/basket/sendbasketform.tt >+++ b/koha-tmpl/intranet-tmpl/prog/en/modules/basket/sendbasketform.tt >@@ -33,7 +33,7 @@ > </fieldset> > <fieldset class="action"> <input type="submit" class="btn btn-primary" value="Send" /> <a class="cancel close" href="#">Cancel</a> </fieldset> > <input type="hidden" name="bib_list" value="[% bib_list | html %]" /> >- <input type="hidden" name="csrf_token" value="[% csrf_token | html %]" /> >+ [% INCLUDE csrf-token.inc %] > </form> > > [% END %]</div> >diff --git a/koha-tmpl/intranet-tmpl/prog/en/modules/members/apikeys.tt b/koha-tmpl/intranet-tmpl/prog/en/modules/members/apikeys.tt >index 6f86af08f77..1249ed31973 100644 >--- a/koha-tmpl/intranet-tmpl/prog/en/modules/members/apikeys.tt >+++ b/koha-tmpl/intranet-tmpl/prog/en/modules/members/apikeys.tt >@@ -57,7 +57,7 @@ > > <form id="add-api-key" action="/cgi-bin/koha/members/apikeys.pl" method="post" style="display:none"> > <input type="hidden" name="patron_id" value="[% patron.id | html %]" /> >- <input type="hidden" name="csrf_token" value="[% csrf_token | html %]" /> >+ [% INCLUDE csrf-token.inc %] > <input type="hidden" name="op" value="generate" /> > <fieldset class="brief"> > <legend>Generate new client id/secret pair</legend> >@@ -96,14 +96,14 @@ > <form action="/cgi-bin/koha/members/apikeys.pl" method="post"> > <input type="hidden" name="patron_id" value="[% patron.id | html %]" /> > <input type="hidden" name="key" value="[% key.id | html %]" /> >- <input type="hidden" name="csrf_token" value="[% csrf_token | html %]" /> >+ [% INCLUDE csrf-token.inc %] > <input type="hidden" name="op" value="delete" /> > <button class="btn btn-default btn-xs delete" type="submit"><i class="fa fa-trash-can"></i> Delete</button> > </form> > <form action="/cgi-bin/koha/members/apikeys.pl" method="post"> > <input type="hidden" name="patron_id" value="[% patron.id | html %]" /> > <input type="hidden" name="key" value="[% key.id | html %]" /> >- <input type="hidden" name="csrf_token" value="[% csrf_token | html %]" /> >+ [% INCLUDE csrf-token.inc %] > [% IF key.active %] > <input type="hidden" name="op" value="revoke" /> > <button class="btn btn-default btn-xs" type="submit"><i class="fa fa-times"></i> Revoke</button> >diff --git a/koha-tmpl/intranet-tmpl/prog/en/modules/members/deletemem.tt b/koha-tmpl/intranet-tmpl/prog/en/modules/members/deletemem.tt >index 4ac2f80c4e3..81f82cfdc63 100644 >--- a/koha-tmpl/intranet-tmpl/prog/en/modules/members/deletemem.tt >+++ b/koha-tmpl/intranet-tmpl/prog/en/modules/members/deletemem.tt >@@ -66,7 +66,7 @@ > <h1>Are you sure you want to delete the patron [% patron.firstname | html %] [% patron.surname | html %]?</h1> > <p>This cannot be undone.</p> > <form action="/cgi-bin/koha/members/deletemem.pl"> >- <input type="hidden" name="csrf_token" value="[% csrf_token | html %]" /> >+ [% INCLUDE csrf-token.inc %] > <input type="hidden" name="member" value="[% patron.borrowernumber | html %]"/> > <input type="hidden" name="op" value="delete_confirmed" /> > <button type="submit" class="approve"><i class="fa fa-fw fa-check"></i> Yes, delete</button> >diff --git a/koha-tmpl/intranet-tmpl/prog/en/modules/members/mancredit.tt b/koha-tmpl/intranet-tmpl/prog/en/modules/members/mancredit.tt >index 74395fff927..101d98d7ba1 100644 >--- a/koha-tmpl/intranet-tmpl/prog/en/modules/members/mancredit.tt >+++ b/koha-tmpl/intranet-tmpl/prog/en/modules/members/mancredit.tt >@@ -63,7 +63,7 @@ > <div role="tabpanel" class="tab-pane active"> > <form action="/cgi-bin/koha/members/mancredit.pl" method="post" id="mancredit"> > <input type="hidden" name="borrowernumber" id="borrowernumber" value="[% patron.borrowernumber | html %]" /> >- <input type="hidden" name="csrf_token" value="[% csrf_token | html %]" /> >+ [% INCLUDE csrf-token.inc %] > > <fieldset class="rows"> > <legend>Manual credit</legend> >diff --git a/koha-tmpl/intranet-tmpl/prog/en/modules/members/maninvoice.tt b/koha-tmpl/intranet-tmpl/prog/en/modules/members/maninvoice.tt >index 3eeb822c536..496cc902d0f 100644 >--- a/koha-tmpl/intranet-tmpl/prog/en/modules/members/maninvoice.tt >+++ b/koha-tmpl/intranet-tmpl/prog/en/modules/members/maninvoice.tt >@@ -72,7 +72,7 @@ > [% END %] > <form action="/cgi-bin/koha/members/maninvoice.pl" method="post" id="maninvoice"> > <input type="hidden" name="borrowernumber" id="borrowernumber" value="[% patron.borrowernumber | html %]" /> >- <input type="hidden" name="csrf_token" value="[% csrf_token | html %]" /> >+ [% INCLUDE csrf-token.inc %] > <fieldset class="rows"> > <legend>Manual invoice</legend> > <ol> >diff --git a/koha-tmpl/intranet-tmpl/prog/en/modules/members/member-flags.tt b/koha-tmpl/intranet-tmpl/prog/en/modules/members/member-flags.tt >index 7e475132bb9..33e312d3e18 100644 >--- a/koha-tmpl/intranet-tmpl/prog/en/modules/members/member-flags.tt >+++ b/koha-tmpl/intranet-tmpl/prog/en/modules/members/member-flags.tt >@@ -37,7 +37,7 @@ > [% INCLUDE 'members-toolbar.inc' %] > > <form id="flag_form" method="post" action="/cgi-bin/koha/members/member-flags.pl"> >- <input type="hidden" name="csrf_token" value="[% csrf_token | html %]" /> >+ [% INCLUDE csrf-token.inc %] > <input type="hidden" name="member" id="borrowernumber" value="[% patron.borrowernumber | html %]" /> > <input type="hidden" name="newflags" value="1" /> > <h1>Set permissions for [% INCLUDE 'patron-title.inc' no_html = 1 %]</h1> >diff --git a/koha-tmpl/intranet-tmpl/prog/en/modules/members/member-password.tt b/koha-tmpl/intranet-tmpl/prog/en/modules/members/member-password.tt >index d1d68b85c7b..17c55a75f27 100644 >--- a/koha-tmpl/intranet-tmpl/prog/en/modules/members/member-password.tt >+++ b/koha-tmpl/intranet-tmpl/prog/en/modules/members/member-password.tt >@@ -98,7 +98,7 @@ > <div class="hint">Koha cannot display existing passwords. Leave the field blank to leave password unchanged.</div> > </fieldset> > <fieldset class="action"> >- <input type="hidden" name="csrf_token" value="[% csrf_token | html %]" /> >+ [% INCLUDE csrf-token.inc %] > <input type="submit" class="btn btn-primary" value="Save" /> > <a class="cancel" href="/cgi-bin/koha/members/moremember.pl?borrowernumber=[% patron.borrowernumber | html %]">Cancel</a> > </fieldset> >diff --git a/koha-tmpl/intranet-tmpl/prog/en/modules/members/memberentrygen.tt b/koha-tmpl/intranet-tmpl/prog/en/modules/members/memberentrygen.tt >index 5d174b52889..8a620d153f7 100644 >--- a/koha-tmpl/intranet-tmpl/prog/en/modules/members/memberentrygen.tt >+++ b/koha-tmpl/intranet-tmpl/prog/en/modules/members/memberentrygen.tt >@@ -237,7 +237,7 @@ legend:hover { > <input type="hidden" name="check_member" value="[% check_member | html %]" /> > <input type="hidden" name="borrowernumber" value="[% borrowernumber | html UNLESS opduplicate %]" /> > <input type="hidden" name="nodouble" value="[% nodouble | html UNLESS opduplicate %]" /> >- <input type="hidden" name="csrf_token" value="[% csrf_token | html %]" /> >+ [% INCLUDE csrf-token.inc %] > [% IF ( step ) %] > <input type="hidden" name="step" value="[% step | html %]" /> > [% END %] >diff --git a/koha-tmpl/intranet-tmpl/prog/en/modules/members/paycollect.tt b/koha-tmpl/intranet-tmpl/prog/en/modules/members/paycollect.tt >index e97ee039590..42a982247a5 100644 >--- a/koha-tmpl/intranet-tmpl/prog/en/modules/members/paycollect.tt >+++ b/koha-tmpl/intranet-tmpl/prog/en/modules/members/paycollect.tt >@@ -132,7 +132,7 @@ > </ul> > > <form name="payindivfine" id="payindivfine" method="post" action="/cgi-bin/koha/members/paycollect.pl"> >- <input type="hidden" name="csrf_token" value="[% csrf_token | html %]" /> >+ [% INCLUDE csrf-token.inc %] > <input type="hidden" name="borrowernumber" id="borrowernumber" value="[% patron.borrowernumber | html %]" /> > <input type="hidden" name="pay_individual" id="pay_individual" value="[% pay_individual | html %]" /> > <input type="hidden" name="itemnumber" id="itemnumber" value="[% itemnumber | html %]" /> >@@ -228,7 +228,7 @@ > </ul> > > <form name="woindivfine" id="woindivfine" action="/cgi-bin/koha/members/pay.pl" method="post" > >- <input type="hidden" name="csrf_token" value="[% csrf_token | html %]" /> >+ [% INCLUDE csrf-token.inc %] > <fieldset class="rows"> > <legend>Write off an individual charge</legend> > <input type="hidden" name="borrowernumber" id="borrowernumber" value="[% patron.borrowernumber | html %]" /> >@@ -295,7 +295,7 @@ > [% END %] > > <form name="payfine" id="payfine" method="post" action="/cgi-bin/koha/members/paycollect.pl"> >- <input type="hidden" name="csrf_token" value="[% csrf_token | html %]" /> >+ [% INCLUDE csrf-token.inc %] > <input type="hidden" name="borrowernumber" id="borrowernumber" value="[% patron.borrowernumber | html %]" /> > <input type="hidden" name="selected_accts" id="selected_accts" value="[% selected_accts | html %]" /> > <input type="hidden" name="total" id="total" value="[% total | html %]" /> >diff --git a/koha-tmpl/intranet-tmpl/prog/en/modules/members/two_factor_auth.tt b/koha-tmpl/intranet-tmpl/prog/en/modules/members/two_factor_auth.tt >index 2cb3c897aa4..d3522d6566f 100644 >--- a/koha-tmpl/intranet-tmpl/prog/en/modules/members/two_factor_auth.tt >+++ b/koha-tmpl/intranet-tmpl/prog/en/modules/members/two_factor_auth.tt >@@ -53,7 +53,7 @@ > <div class="two-factor-status">Status: Enabled</div> > > <form id="two-factor-auth" action="/cgi-bin/koha/members/two_factor_auth.pl" method="post"> >- <input type="hidden" name="csrf_token" value="[% csrf_token | html %]" /> >+ [% INCLUDE csrf-token.inc %] > <input type="hidden" name="op" value="disable-2FA" /> > <input type="submit" value="Disable two-factor authentication" /> > </form> >diff --git a/koha-tmpl/intranet-tmpl/prog/en/modules/tools/import_borrowers.tt b/koha-tmpl/intranet-tmpl/prog/en/modules/tools/import_borrowers.tt >index 4366ae46556..5fc806d5329 100644 >--- a/koha-tmpl/intranet-tmpl/prog/en/modules/tools/import_borrowers.tt >+++ b/koha-tmpl/intranet-tmpl/prog/en/modules/tools/import_borrowers.tt >@@ -356,7 +356,7 @@ > </fieldset> > > <fieldset class="action"> >- <input type="hidden" name="csrf_token" value="[% csrf_token | html %]" /> >+ [% INCLUDE csrf-token.inc %] > <input type="submit" class="btn btn-primary" value="Import" /> > </fieldset> > </form> >diff --git a/koha-tmpl/intranet-tmpl/prog/en/modules/tools/picture-upload.tt b/koha-tmpl/intranet-tmpl/prog/en/modules/tools/picture-upload.tt >index 91d7264f02d..397e0acd07d 100644 >--- a/koha-tmpl/intranet-tmpl/prog/en/modules/tools/picture-upload.tt >+++ b/koha-tmpl/intranet-tmpl/prog/en/modules/tools/picture-upload.tt >@@ -148,7 +148,7 @@ > </ol> > </fieldset> > <fieldset class="action"> >- <input type="hidden" name="csrf_token" value="[% csrf_token | html %]" /> >+ [% INCLUDE csrf-token.inc %] > <input type="hidden" name="op" value="Upload" /> > <input type="submit" class="btn btn-primary" value="Upload" /> > <a href="/cgi-bin/koha/tools/tools-home.pl" class="cancel">Cancel</a> >diff --git a/koha-tmpl/opac-tmpl/bootstrap/en/modules/opac-memberentry.tt b/koha-tmpl/opac-tmpl/bootstrap/en/modules/opac-memberentry.tt >index 89a9e841e0b..20a0305b5d1 100644 >--- a/koha-tmpl/opac-tmpl/bootstrap/en/modules/opac-memberentry.tt >+++ b/koha-tmpl/opac-tmpl/bootstrap/en/modules/opac-memberentry.tt >@@ -1053,7 +1053,7 @@ > [% IF OPACPatronDetails %] > <fieldset class="action"> > <input type="hidden" name="action" value="update" /> >- <input type="hidden" name="csrf_token" value="[% csrf_token | html %]" /> >+ [% INCLUDE csrf-token.inc %] > <input type="submit" class="btn btn-primary" value="Submit update request" /> > </fieldset> > [% END %] >diff --git a/koha-tmpl/opac-tmpl/bootstrap/en/modules/opac-messaging.tt b/koha-tmpl/opac-tmpl/bootstrap/en/modules/opac-messaging.tt >index cf3dd4c555b..e2b4b74a7f6 100644 >--- a/koha-tmpl/opac-tmpl/bootstrap/en/modules/opac-messaging.tt >+++ b/koha-tmpl/opac-tmpl/bootstrap/en/modules/opac-messaging.tt >@@ -41,7 +41,7 @@ > <div class="alert alert-success"><p><strong>Settings updated</strong></p></div> > [% END %] > <form action="/cgi-bin/koha/opac-messaging.pl" method="post" name="opacmessaging"> >- <input type="hidden" name="csrf_token" value="[% csrf_token | html %]" /> >+ [% INCLUDE csrf-token.inc %] > <input type="hidden" name="modify" value="yes" /> > > [% IF Koha.Preference( 'EnhancedMessagingPreferencesOPAC' ) %] >diff --git a/koha-tmpl/opac-tmpl/bootstrap/en/modules/opac-sendbasketform.tt b/koha-tmpl/opac-tmpl/bootstrap/en/modules/opac-sendbasketform.tt >index 577f1495036..dec384c06e5 100644 >--- a/koha-tmpl/opac-tmpl/bootstrap/en/modules/opac-sendbasketform.tt >+++ b/koha-tmpl/opac-tmpl/bootstrap/en/modules/opac-sendbasketform.tt >@@ -35,7 +35,7 @@ > <label for="comment">Comment:</label> > <textarea id="comment" name="comment" rows="4" cols="40" class="form-control"></textarea> > <input type="hidden" name="bib_list" value="[% bib_list | html %]" /> >- <input type="hidden" name="csrf_token" value="[% csrf_token | html %]" /> >+ [% INCLUDE csrf-token.inc %] > </fieldset> > [% IF Koha.Preference('OPACHoldRequests') || Koha.Preference('OpacRenewalAllowed') %]<p id="donotrequestbymail">Please do not use this mail to request or renew books.</p>[% END %] > <fieldset class="action"> >diff --git a/koha-tmpl/opac-tmpl/bootstrap/en/modules/opac-user.tt b/koha-tmpl/opac-tmpl/bootstrap/en/modules/opac-user.tt >index 2a82506693a..0f0e0c3b5bf 100644 >--- a/koha-tmpl/opac-tmpl/bootstrap/en/modules/opac-user.tt >+++ b/koha-tmpl/opac-tmpl/bootstrap/en/modules/opac-user.tt >@@ -245,7 +245,7 @@ > <input type="radio" id="no-autorenew_checkouts" name="borrower_autorenew_checkouts" value="0" checked="checked" /> > </label> > [% END %] >- <input type="hidden" name="csrf_token" value="[% csrf_token | html %]" /> >+ [% INCLUDE csrf-token.inc %] > <input type="hidden" name="update_arc" value="1" /> > <input type="submit" value="Update auto-renewal preference" /> > </form> >-- >2.25.1
<b>You cannot view the attachment while viewing its details because your browser does not support IFRAMEs. <a href="attachment.cgi?id=154243">View the attachment on a separate page</a>.</b>
View Attachment As Diff
View Attachment As Raw
Actions:
View
|
Diff
|
Splinter Review
Attachments on
bug 34478
:
154241
|
154242
|
154243
|
154244
|
154245
|
154246
|
154247
|
154248
|
154249
|
154250
|
154251
|
154252
|
154253
|
154254
|
155971
|
155972
|
155973
|
155974
|
155975
|
155976
|
155977
|
155978
|
155979
|
155980
|
155981
|
155982
|
155983
|
155984
|
155985
|
155986
|
155987
|
155988
|
155989
|
155990
|
156070
|
156071
|
156072
|
156073
|
156074
|
162114
|
162165
|
162630