Attachment 154246 Details for Bug 34478 – Bug 34478: Add a script to add missing csrf to post forms - csrf_add_missing_csrf

[patch] Bug 34478: Add a script to add missing csrf to post forms - csrf_add_missing_csrf

Bug-34478-Add-a-script-to-add-missing-csrf-to-post.patch (text/plain), 2.56 KB, created by Jonathan Druart on 2023-08-04 09:48:49 UTC

(hide)

Description:

Filename:

MIME Type:

Creator: Jonathan Druart

Created: 2023-08-04 09:48:49 UTC

Size: 2.56 KB

patch

obsolete

>From 21ef447d3226997b70b29b1e8c82008b8e86bef2 Mon Sep 17 00:00:00 2001
>From: Jonathan Druart <jonathan.druart@bugs.koha-community.org>
>Date: Fri, 4 Aug 2023 10:45:07 +0200
>Subject: [PATCH] Bug 34478: Add a script to add missing csrf to post forms -
> csrf_add_missing_csrf
>
>---
> csrf_add_missing_csrf.pl | 71 ++++++++++++++++++++++++++++++++++++++++
> 1 file changed, 71 insertions(+)
> create mode 100644 csrf_add_missing_csrf.pl
>
>diff --git a/csrf_add_missing_csrf.pl b/csrf_add_missing_csrf.pl
>new file mode 100644
>index 00000000000..28d142f848b
>--- /dev/null
>+++ b/csrf_add_missing_csrf.pl
>@@ -0,0 +1,71 @@
>+#!/usr/bin/perl
>+
>+use Modern::Perl;
>+use File::Find;
>+use File::Slurp;
>+use Data::Dumper;
>+
>+my @themes;
>+
>+# OPAC themes
>+my $opac_dir  = 'koha-tmpl/opac-tmpl';
>+opendir ( my $dh, $opac_dir ) or die "can't opendir $opac_dir: $!";
>+for my $theme ( grep { not /^\.|lib|js|xslt/ } readdir($dh) ) {
>+    push @themes, "$opac_dir/$theme/en";
>+}
>+close $dh;
>+
>+# STAFF themes
>+my $staff_dir = 'koha-tmpl/intranet-tmpl';
>+opendir ( $dh, $staff_dir ) or die "can't opendir $staff_dir: $!";
>+for my $theme ( grep { not /^\.|lib|js/ } readdir($dh) ) {
>+    push @themes, "$staff_dir/$theme/en";
>+}
>+close $dh;
>+
>+my @files;
>+sub wanted {
>+    my $name = $File::Find::name;
>+    push @files, $name
>+        if $name =~ m[\.(tt|inc)$] and -f $name;
>+}
>+
>+find({ wanted => \&wanted, no_chdir => 1 }, @themes );
>+
>+my @errors;
>+for my $file ( @files ) {
>+    add_csrf_token($file);
>+}
>+
>+sub add_csrf_token {
>+    my ( $file ) = @_;
>+
>+    my $csrf_include = "[% INCLUDE 'csrf-token.inc' %]\n";
>+    my @lines = read_file($file);
>+    my @new_lines = @lines;
>+    return unless grep { $_ =~ m|<form| } @lines;
>+    my ( $in_form, $closed_form, $line_open_form, $has_csrf_token );
>+    my ( $line_number, $number_replaced_forms ) = (0, 0);
>+    my $spacing = q{};
>+    for my $line (@lines) {
>+        $line_number++;
>+        if ( $line =~ m{^(\s*)<form.*method=('|")post('|")}i ) {
>+            $spacing = $1 . "    ";
>+            $in_form = 1;
>+            $line_open_form = $line_number;
>+        }
>+        if ( $in_form && $line =~ m{name="csrf_token"}) {
>+            $has_csrf_token = 1;
>+        }
>+        if ( $in_form && $line =~ m{</form} ) {
>+            $closed_form = 0;
>+            unless ( $has_csrf_token ) {
>+                splice @new_lines, $line_open_form + $number_replaced_forms, 0, $spacing . $csrf_include;
>+                $number_replaced_forms++;
>+            }
>+            $in_form = 0;
>+            $has_csrf_token = 0;
>+        }
>+    }
>+    write_file($file, @new_lines);
>+}
>-- 
>2.25.1

Actions: View | Diff | Splinter Review

Attachments on bug 34478: 154241 | 154242 | 154243 | 154244 | 154245 | 154246 | 154247 | 154248 | 154249 | 154250 | 154251 | 154252 | 154253 | 154254 | 155971 | 155972 | 155973 | 155974 | 155975 | 155976 | 155977 | 155978 | 155979 | 155980 | 155981 | 155982 | 155983 | 155984 | 155985 | 155986 | 155987 | 155988 | 155989 | 155990 | 156070 | 156071 | 156072 | 156073 | 156074 | 162114 | 162165 | 162630