Bugzilla – Attachment 154254 Details for
Bug 34478
Full CSRF protection
Home
|
New
|
Browse
|
Search
|
[?]
|
Reports
|
Help
|
New Account
|
Log In
[x]
|
Forgot Password
Login:
[x]
[patch]
Bug 34478: Remove check_csrf from pl files
Bug-34478-Remove-checkcsrf-from-pl-files.patch (text/plain), 16.02 KB, created by
Jonathan Druart
on 2023-08-04 09:49:20 UTC
(
hide
)
Description:
Bug 34478: Remove check_csrf from pl files
Filename:
MIME Type:
Creator:
Jonathan Druart
Created:
2023-08-04 09:49:20 UTC
Size:
16.02 KB
patch
obsolete
>From 2fa38e4e18c580e20dca85f59bcc17652ed3896f Mon Sep 17 00:00:00 2001 >From: Jonathan Druart <jonathan.druart@bugs.koha-community.org> >Date: Fri, 4 Aug 2023 11:37:52 +0200 >Subject: [PATCH] Bug 34478: Remove check_csrf from pl files > >We should no longer need to check CSRF token from pl files > >TODO - there is a change for some files where we returned 403 >--- > C4/Output.pm | 1 - > authorities/authorities-home.pl | 7 ------- > basket/sendbasket.pl | 8 -------- > ill/ill-requests.pl | 5 ----- > members/apikeys.pl | 13 ------------- > members/cancel-charge.pl | 11 ----------- > members/mancredit.pl | 9 --------- > members/maninvoice.pl | 9 --------- > members/member-flags.pl | 8 -------- > members/member-password.pl | 7 ------- > members/memberentry.pl | 7 ------- > members/paycollect.pl | 7 ------- > members/two_factor_auth.pl | 3 --- > opac/opac-memberentry.pl | 6 ------ > opac/opac-messaging.pl | 5 ----- > opac/opac-sendbasket.pl | 8 -------- > opac/opac-user.pl | 7 ------- > opac/sco/sco-patron-image.pl | 16 ---------------- > 18 files changed, 137 deletions(-) > >diff --git a/C4/Output.pm b/C4/Output.pm >index 94bc8e0f958..d8ea0bfb521 100644 >--- a/C4/Output.pm >+++ b/C4/Output.pm >@@ -34,7 +34,6 @@ use URI::Escape; > use C4::Auth qw( get_template_and_user ); > use C4::Context; > use C4::Templates; >-use Koha::Token; > > our (@ISA, @EXPORT_OK); > >diff --git a/authorities/authorities-home.pl b/authorities/authorities-home.pl >index c867069acff..46ddc249abd 100755 >--- a/authorities/authorities-home.pl >+++ b/authorities/authorities-home.pl >@@ -33,7 +33,6 @@ use C4::Languages; > use Koha::Authority::Types; > use Koha::SearchEngine::Search; > use Koha::SearchEngine::QueryBuilder; >-use Koha::Token; > use Koha::XSLT::Base; > use Koha::Z3950Servers; > >@@ -58,12 +57,6 @@ if ( $op eq "delete" ) { > } > ); > >- output_and_exit( $query, $cookie, $template, 'wrong_csrf_token' ) >- unless Koha::Token->new->check_csrf({ >- session_id => scalar $query->cookie('CGISESSID'), >- token => scalar $query->param('csrf_token'), >- }); >- > DelAuthority({ authid => $authid }); > # FIXME No error handling here, DelAuthority needs adjustments > $pending_deletion_authid = $authid; >diff --git a/basket/sendbasket.pl b/basket/sendbasket.pl >index 6a54479691b..dbf5b813f33 100755 >--- a/basket/sendbasket.pl >+++ b/basket/sendbasket.pl >@@ -30,7 +30,6 @@ use C4::Output qw( output_and_exit output_html_with_http_headers ); > use C4::Templates; > use Koha::Biblios; > use Koha::Email; >-use Koha::Token; > > my $query = CGI->new; > >@@ -49,13 +48,6 @@ my $email_add = $query->param('email_add'); > my $dbh = C4::Context->dbh; > > if ($email_add) { >- output_and_exit( $query, $cookie, $template, 'wrong_csrf_token' ) >- unless Koha::Token->new->check_csrf( >- { >- session_id => scalar $query->cookie('CGISESSID'), >- token => scalar $query->param('csrf_token'), >- } >- ); > > my $patron = Koha::Patrons->find($borrowernumber); > my $user_email = $patron->notice_email_address; >diff --git a/ill/ill-requests.pl b/ill/ill-requests.pl >index fbdcb386168..3cf05592ad4 100755 >--- a/ill/ill-requests.pl >+++ b/ill/ill-requests.pl >@@ -29,7 +29,6 @@ use Koha::Illcomment; > use Koha::Illrequests; > use Koha::Illrequest::Availability; > use Koha::Libraries; >-use Koha::Token; > > use Try::Tiny qw( catch try ); > use URI::Escape qw( uri_escape_utf8 ); >@@ -382,10 +381,6 @@ if ( $backends_available ) { > prefilters => join("&", @tpl_arr) > ); > } elsif ( $op eq "save_comment" ) { >- die "Wrong CSRF token" unless Koha::Token->new->check_csrf({ >- session_id => scalar $cgi->cookie('CGISESSID'), >- token => scalar $cgi->param('csrf_token'), >- }); > my $comment = Koha::Illcomment->new({ > illrequest_id => scalar $params->{illrequest_id}, > borrowernumber => $patronnumber, >diff --git a/members/apikeys.pl b/members/apikeys.pl >index 883c1948862..3aa4fa925c3 100755 >--- a/members/apikeys.pl >+++ b/members/apikeys.pl >@@ -26,7 +26,6 @@ use C4::Output qw( output_and_exit output_html_with_http_headers ); > > use Koha::ApiKeys; > use Koha::Patrons; >-use Koha::Token; > > my $cgi = CGI->new; > >@@ -60,18 +59,6 @@ if( $patron_id != $loggedinuser && !C4::Context->IsSuperLibrarian() ) { > > my $op = $cgi->param('op') // ''; > >-if ( $op eq 'generate' or >- $op eq 'delete' or >- $op eq 'revoke' or >- $op eq 'activate' ) { >- >- output_and_exit( $cgi, $cookie, $template, 'wrong_csrf_token' ) >- unless Koha::Token->new->check_csrf({ >- session_id => scalar $cgi->cookie('CGISESSID'), >- token => scalar $cgi->param('csrf_token'), >- }); >-} >- > if ($op) { > if ( $op eq 'generate' ) { > my $description = $cgi->param('description') // ''; >diff --git a/members/cancel-charge.pl b/members/cancel-charge.pl >index 54833428631..5748fa54c46 100755 >--- a/members/cancel-charge.pl >+++ b/members/cancel-charge.pl >@@ -20,7 +20,6 @@ use Modern::Perl; > use CGI; > > use C4::Auth qw( checkauth ); >-use Koha::Token; > > my $cgi = CGI->new; > >@@ -33,16 +32,6 @@ my $flags = { > my $type = 'intranet'; > my ($user, $cookie) = C4::Auth::checkauth($cgi, $authnotrequired, $flags, $type); > >-my $csrf_token_is_valid = Koha::Token->new->check_csrf( { >- session_id => scalar $cgi->cookie('CGISESSID'), >- token => scalar $cgi->param('csrf_token'), >-}); >-unless ($csrf_token_is_valid) { >- print $cgi->header('text/plain', '403 Forbidden'); >- print 'Wrong CSRF token'; >- exit; >-} >- > my $borrowernumber = $cgi->param('borrowernumber'); > my $accountlines_id = $cgi->param('accountlines_id'); > >diff --git a/members/mancredit.pl b/members/mancredit.pl >index bd422863fbc..12b11a9575b 100755 >--- a/members/mancredit.pl >+++ b/members/mancredit.pl >@@ -36,8 +36,6 @@ use Koha::Patron::Categories; > use Koha::Account::CreditTypes; > use Koha::AdditionalFields; > >-use Koha::Token; >- > my $input = CGI->new; > my ( $template, $loggedinuser, $cookie ) = get_template_and_user( > { >@@ -70,13 +68,6 @@ my $library_id = > > my $add = $input->param('add'); > if ($add) { >- output_and_exit( $input, $cookie, $template, 'wrong_csrf_token' ) >- unless Koha::Token->new->check_csrf( >- { >- session_id => scalar $input->cookie('CGISESSID'), >- token => scalar $input->param('csrf_token'), >- } >- ); > > # Note: If the logged in user is not allowed to see this patron an invoice can be forced > # Here we are trusting librarians not to hack the system >diff --git a/members/maninvoice.pl b/members/maninvoice.pl >index e622c553fa8..959035751b6 100755 >--- a/members/maninvoice.pl >+++ b/members/maninvoice.pl >@@ -31,7 +31,6 @@ use C4::Output qw( output_and_exit_if_error output_and_exit output_html_with_htt > use CGI qw ( -utf8 ); > use C4::Members; > use C4::Accounts; >-use Koha::Token; > > use Koha::Patrons; > use Koha::Items; >@@ -91,14 +90,6 @@ $template->param( > > my $add = $input->param('add'); > if ($add) { >- output_and_exit( $input, $cookie, $template, 'wrong_csrf_token' ) >- unless Koha::Token->new->check_csrf( >- { >- session_id => scalar $input->cookie('CGISESSID'), >- token => scalar $input->param('csrf_token'), >- } >- ); >- > # Note: If the logged in user is not allowed to see this patron an invoice can be forced > # Here we are trusting librarians not to hack the system > my $desc = $input->param('desc'); >diff --git a/members/member-flags.pl b/members/member-flags.pl >index 3aa500b1c0d..c1f737db32f 100755 >--- a/members/member-flags.pl >+++ b/members/member-flags.pl >@@ -15,7 +15,6 @@ use Koha::Patron::Categories; > use Koha::Patrons; > > use C4::Output qw( output_and_exit_if_error output_and_exit output_html_with_http_headers ); >-use Koha::Token; > > my $input = CGI->new; > >@@ -47,13 +46,6 @@ $member2{'borrowernumber'}=$member; > > if ($input->param('newflags')) { > >- output_and_exit( $input, $cookie, $template, 'wrong_csrf_token' ) >- unless Koha::Token->new->check_csrf({ >- session_id => scalar $input->cookie('CGISESSID'), >- token => scalar $input->param('csrf_token'), >- }); >- >- > my $dbh=C4::Context->dbh(); > > my @perms = $input->multi_param('flag'); >diff --git a/members/member-password.pl b/members/member-password.pl >index 9b6ebd23b6a..5cc5f4c448e 100755 >--- a/members/member-password.pl >+++ b/members/member-password.pl >@@ -10,7 +10,6 @@ use C4::Auth qw( get_template_and_user ); > use C4::Output qw( output_and_exit_if_error output_and_exit output_html_with_http_headers ); > use C4::Context; > use CGI qw ( -utf8 ); >-use Koha::Token; > > use Koha::Patrons; > use Koha::Patron::Categories; >@@ -57,12 +56,6 @@ push( @errors, 'NOMATCH' ) if ( ( $newpassword && $newpassword2 ) && ( $newpassw > > if ( $newpassword and not @errors) { > >- output_and_exit( $input, $cookie, $template, 'wrong_csrf_token' ) >- unless Koha::Token->new->check_csrf({ >- session_id => scalar $input->cookie('CGISESSID'), >- token => scalar $input->param('csrf_token'), >- }); >- > try { > $patron->set_password({ password => $newpassword }); > $patron->userid($new_user_id)->store >diff --git a/members/memberentry.pl b/members/memberentry.pl >index 01d55e1003e..99532fb547e 100755 >--- a/members/memberentry.pl >+++ b/members/memberentry.pl >@@ -47,7 +47,6 @@ use Koha::Patron::Categories; > use Koha::Patron::HouseboundRole; > use Koha::Patron::HouseboundRoles; > use Koha::Plugins; >-use Koha::Token; > use Koha::SMS::Providers; > > my $input = CGI->new; >@@ -279,12 +278,6 @@ $newdata{'lang'} = $input->param('lang') if defined($input->param('lang')) > my $extended_patron_attributes; > if ($op eq 'save' || $op eq 'insert'){ > >- output_and_exit( $input, $cookie, $template, 'wrong_csrf_token' ) >- unless Koha::Token->new->check_csrf({ >- session_id => scalar $input->cookie('CGISESSID'), >- token => scalar $input->param('csrf_token'), >- }); >- > # If the cardnumber is blank, treat it as null. > $newdata{'cardnumber'} = undef if $newdata{'cardnumber'} =~ /^\s*$/; > >diff --git a/members/paycollect.pl b/members/paycollect.pl >index e90358ddd6c..03b45af68db 100755 >--- a/members/paycollect.pl >+++ b/members/paycollect.pl >@@ -34,7 +34,6 @@ use Koha::AuthorisedValues; > use Koha::Account; > use Koha::Account::Lines; > use Koha::AdditionalFields; >-use Koha::Token; > use Koha::DateUtils qw( output_pref ); > > my $input = CGI->new(); >@@ -149,12 +148,6 @@ if ( $total_paid and $total_paid ne '0.00' ) { > total_paid => $total_paid > ); > } else { >- output_and_exit( $input, $cookie, $template, 'wrong_csrf_token' ) >- unless Koha::Token->new->check_csrf( { >- session_id => $input->cookie('CGISESSID'), >- token => scalar $input->param('csrf_token'), >- }); >- > my $url; > my $pay_result; > if ($pay_individual) { >diff --git a/members/two_factor_auth.pl b/members/two_factor_auth.pl >index 5a1e28860d1..7ebd23ab475 100755 >--- a/members/two_factor_auth.pl >+++ b/members/two_factor_auth.pl >@@ -24,7 +24,6 @@ use C4::Output qw( output_and_exit output_html_with_http_headers ); > > use Koha::Patrons; > use Koha::Auth::TwoFactorAuth; >-use Koha::Token; > > my $cgi = CGI->new; > >@@ -57,8 +56,6 @@ else { > }; > > if ( $op eq 'disable-2FA' ) { >- output_and_exit( $cgi, $cookie, $template, 'wrong_csrf_token' ) >- unless Koha::Token->new->check_csrf($csrf_pars); > my $auth = > Koha::Auth::TwoFactorAuth->new( { patron => $logged_in_user } ); > $logged_in_user->secret(undef); >diff --git a/opac/opac-memberentry.pl b/opac/opac-memberentry.pl >index c5fd48e112c..7b0df5ef780 100755 >--- a/opac/opac-memberentry.pl >+++ b/opac/opac-memberentry.pl >@@ -43,7 +43,6 @@ use Koha::Patron::Attribute::Types; > use Koha::Patron::Attributes; > use Koha::Patron::Images; > use Koha::Patron::Categories; >-use Koha::Token; > use Koha::AuthorisedValues; > my $cgi = CGI->new; > my $dbh = C4::Context->dbh; >@@ -302,11 +301,6 @@ if ( $action eq 'create' ) { > elsif ( $action eq 'update' ) { > > my $borrower = Koha::Patrons->find( $borrowernumber )->unblessed; >- die "Wrong CSRF token" >- unless Koha::Token->new->check_csrf({ >- session_id => scalar $cgi->cookie('CGISESSID'), >- token => scalar $cgi->param('csrf_token'), >- }); > > my %borrower = ParseCgiForBorrower($cgi); > $borrower{borrowernumber} = $borrowernumber; >diff --git a/opac/opac-messaging.pl b/opac/opac-messaging.pl >index fd239a76144..7553bd73d0b 100755 >--- a/opac/opac-messaging.pl >+++ b/opac/opac-messaging.pl >@@ -28,7 +28,6 @@ use C4::Members::Messaging; > use C4::Form::MessagingPreferences; > use Koha::Patrons; > use Koha::SMS::Providers; >-use Koha::Token; > > my $query = CGI->new(); > my $opac_messaging = C4::Context->preference('EnhancedMessagingPreferencesOPAC'); >@@ -53,10 +52,6 @@ my $messaging_options; > $messaging_options = C4::Members::Messaging::GetMessagingOptions() if $opac_messaging; > > if ( defined $query->param('modify') && $query->param('modify') eq 'yes' ) { >- die "Wrong CSRF token" unless Koha::Token->new->check_csrf({ >- session_id => scalar $query->cookie('CGISESSID'), >- token => scalar $query->param('csrf_token'), >- }); > > if( $opac_messaging ) { > my $sms = $query->param('SMSnumber'); >diff --git a/opac/opac-sendbasket.pl b/opac/opac-sendbasket.pl >index caf39811736..36616adbb24 100755 >--- a/opac/opac-sendbasket.pl >+++ b/opac/opac-sendbasket.pl >@@ -33,7 +33,6 @@ use C4::Templates; > use Koha::Biblios; > use Koha::Email; > use Koha::Patrons; >-use Koha::Token; > > my $query = CGI->new; > >@@ -49,13 +48,6 @@ my $bib_list = $query->param('bib_list') || ''; > my $email_add = $query->param('email_add'); > > if ( $email_add ) { >- die "Wrong CSRF token" >- unless Koha::Token->new->check_csrf( >- { >- session_id => scalar $query->cookie('CGISESSID'), >- token => scalar $query->param('csrf_token'), >- } >- ); > > my $patron = Koha::Patrons->find($borrowernumber); > my $user_email = $patron->notice_email_address; >diff --git a/opac/opac-user.pl b/opac/opac-user.pl >index ec48ded4f5c..5719cbf4147 100755 >--- a/opac/opac-user.pl >+++ b/opac/opac-user.pl >@@ -48,7 +48,6 @@ use Koha::Patron::Discharge; > use Koha::Patrons; > use Koha::Ratings; > use Koha::Recalls; >-use Koha::Token; > > use constant ATTRIBUTE_SHOW_BARCODE => 'SHOW_BCODE'; > >@@ -90,12 +89,6 @@ $template->param( shibbolethAuthentication => C4::Context->config('useshibboleth > my $patron = Koha::Patrons->find( $borrowernumber ); > > if( $op eq 'update_arc' && C4::Context->preference("AllowPatronToControlAutorenewal") ){ >- die "Wrong CSRF token" >- unless Koha::Token->new->check_csrf({ >- session_id => scalar $query->cookie('CGISESSID'), >- token => scalar $query->param('csrf_token'), >- }); >- > my $autorenew_checkouts = $query->param('borrower_autorenew_checkouts'); > $patron->autorenew_checkouts( $autorenew_checkouts )->store() if defined $autorenew_checkouts; > } >diff --git a/opac/sco/sco-patron-image.pl b/opac/sco/sco-patron-image.pl >index 36e86b7d137..e311e01fe6b 100755 >--- a/opac/sco/sco-patron-image.pl >+++ b/opac/sco/sco-patron-image.pl >@@ -23,7 +23,6 @@ use C4::Service; > use C4::Members; > use Koha::Patron::Images; > use Koha::Patrons; >-use Koha::Token; > > my ( $query, $response ) = C4::Service->init( self_check => 'self_checkout_module' ); > >@@ -49,21 +48,6 @@ my $patron_image = $patron->image; > > if ($patron_image) { > >- unless ( >- Koha::Token->new->check_csrf( >- { >- session_id => scalar $query->cookie('CGISESSID') >- . $patron->cardnumber, >- id => $patron->userid, >- token => $csrf_token, >- } >- ) >- ) >- { >- >- print $query->header(-type => 'text/plain', -status => '403 Forbidden'); >- exit; >- } > print $query->header( > -type => $patron_image->mimetype, > -Content_Length => length( $patron_image->imagefile ) >-- >2.25.1
You cannot view the attachment while viewing its details because your browser does not support IFRAMEs.
View the attachment on a separate page
.
View Attachment As Diff
View Attachment As Raw
Actions:
View
|
Diff
|
Splinter Review
Attachments on
bug 34478
:
154241
|
154242
|
154243
|
154244
|
154245
|
154246
|
154247
|
154248
|
154249
|
154250
|
154251
|
154252
|
154253
|
154254
|
155971
|
155972
|
155973
|
155974
|
155975
|
155976
|
155977
|
155978
|
155979
|
155980
|
155981
|
155982
|
155983
|
155984
|
155985
|
155986
|
155987
|
155988
|
155989
|
155990
|
156070
|
156071
|
156072
|
156073
|
156074
|
162114
|
162165
|
162630