Attachment 154926 Details for Bug 34650 – Bug 34650: Add CSRF token to edit/delete toolbar links

[patch] Bug 34650: Add CSRF token to edit/delete toolbar links

Bug-34650-Add-CSRF-token-to-editdelete-toolbar-lin.patch (text/plain), 3.05 KB, created by Lucas Gass (lukeg) on 2023-08-29 22:19:37 UTC

(hide)

Description:

Filename:

MIME Type:

Creator: Lucas Gass (lukeg)

Created: 2023-08-29 22:19:37 UTC

Size: 3.05 KB

patch

obsolete

>From a203812b29c0d133293ad9607d8ea8c6270a112c Mon Sep 17 00:00:00 2001
>From: Lucas Gass <lucas@bywatersolutions.com>
>Date: Tue, 29 Aug 2023 22:16:13 +0000
>Subject: [PATCH] Bug 34650: Add CSRF token to edit/delete toolbar links
>
>To test:
>1. Add a list
>2. Go to that list ( virtualshelves/shelves.pl?op=view&shelfnumber=X )
>3. From the toolbar click the 'Edit' dropdown.
>4. From the dropdown try either 'Edit list' or 'Delete list'.
>5. CSRF error
>6. APPLY PATCH
>7. Try 2 - 4 again, no more error.
>---
> .../prog/en/includes/virtualshelves-toolbar.inc           | 4 ++--
> virtualshelves/shelves.pl                                 | 8 ++++++++
> 2 files changed, 10 insertions(+), 2 deletions(-)
>
>diff --git a/koha-tmpl/intranet-tmpl/prog/en/includes/virtualshelves-toolbar.inc b/koha-tmpl/intranet-tmpl/prog/en/includes/virtualshelves-toolbar.inc
>index 1bafe9d1c6..525cfc56aa 100644
>--- a/koha-tmpl/intranet-tmpl/prog/en/includes/virtualshelves-toolbar.inc
>+++ b/koha-tmpl/intranet-tmpl/prog/en/includes/virtualshelves-toolbar.inc
>@@ -16,8 +16,8 @@
>         <div class="btn-group">
>             <button class="btn btn-default dropdown-toggle" data-toggle="dropdown"><i class="fa-solid fa-pencil" aria-hidden="true"></i> Edit <span class="caret"></span></button>
>             <ul class="dropdown-menu">
>-                <li><a href="/cgi-bin/koha/virtualshelves/shelves.pl?op=edit_form&amp;shelfnumber=[% shelf.shelfnumber | uri %]&amp;referer=[% op | uri %]">Edit list</a></li>
>-                <li><a id="deleteshelf" href="/cgi-bin/koha/virtualshelves/shelves.pl?op=delete&amp;shelfnumber=[% shelf.shelfnumber | html %]">Delete list</a></li>
>+                <li><a href="/cgi-bin/koha/virtualshelves/shelves.pl?op=edit_form&amp;shelfnumber=[% shelf.shelfnumber | uri %]&amp;csrf_token=[% csrf_token | uri %]&amp;referer=[% op | uri %]">Edit list</a></li>
>+                <li><a id="deleteshelf" href="/cgi-bin/koha/virtualshelves/shelves.pl?op=delete&amp;shelfnumber=[% shelf.shelfnumber | html %]&amp;csrf_token=[% csrf_token | html %]">Delete list</a></li>
>             </ul>
>         </div>
>         [% END %]
>diff --git a/virtualshelves/shelves.pl b/virtualshelves/shelves.pl
>index 33564f8333..67b382a548 100755
>--- a/virtualshelves/shelves.pl
>+++ b/virtualshelves/shelves.pl
>@@ -39,6 +39,7 @@ use Koha::ItemTypes;
> use Koha::CsvProfiles;
> use Koha::Patrons;
> use Koha::Virtualshelves;
>+use Koha::Token;
> 
> use constant ANYONE    => 2;
> use constant STAFF     => 3;
>@@ -385,6 +386,12 @@ if ( $op eq 'view' ) {
>         # this check only serves for button display
> }
> 
>+my $csrf_token = Koha::Token->new->generate_csrf(
>+    {
>+        session_id => scalar $query->cookie('CGISESSID'),
>+    }
>+);
>+
> $template->param(
>     op       => $op,
>     referer  => $referer,
>@@ -394,6 +401,7 @@ $template->param(
>     print    => scalar $query->param('print') || 0,
>     csv_profiles => [ Koha::CsvProfiles->search({ type => 'marc', used_for => 'export_records' })->as_list ],
>     allow_transfer => $allow_transfer,
>+    csrf_token   => $csrf_token,
> );
> 
> output_html_with_http_headers $query, $cookie, $template->output;
>-- 
>2.30.2

Actions: View | Diff | Splinter Review

Attachments on bug 34650: 154926 | 154933 | 154934 | 154955 | 154956 | 155089 | 155090