Attachment 155089 Details for Bug 34650 – Bug 34650: Remove unnecessary CSRF check on edit_form

[patch] Bug 34650: Remove unnecessary CSRF check on edit_form

Bug-34650-Remove-unnecessary-CSRF-check-on-editfor.patch (text/plain), 2.17 KB, created by Marcel de Rooy on 2023-09-01 09:47:35 UTC

(hide)

Description:

Filename:

MIME Type:

Creator: Marcel de Rooy

Created: 2023-09-01 09:47:35 UTC

Size: 2.17 KB

patch

obsolete

>From 207a55ee400488b5045a90df56ff21458957f433 Mon Sep 17 00:00:00 2001
>From: David Cook <dcook@prosentient.com.au>
>Date: Wed, 30 Aug 2023 00:07:23 +0000
>Subject: [PATCH] Bug 34650: Remove unnecessary CSRF check on edit_form
>Content-Type: text/plain; charset=utf-8
>
>The op "edit_form" doesn't change state. It just renders the edit
>form. Therefore, it doesn't need a CSRF token/check.
>
>Signed-off-by: Lucas Gass <lucas@bywatersolutions.com>
>
>Signed-off-by: Marcel de Rooy <m.de.rooy@rijksmuseum.nl>
>---
> .../prog/en/modules/virtualshelves/tables/shelves_results.tt     | 1 -
> virtualshelves/shelves.pl                                        | 1 -
> 2 files changed, 2 deletions(-)
>
>diff --git a/koha-tmpl/intranet-tmpl/prog/en/modules/virtualshelves/tables/shelves_results.tt b/koha-tmpl/intranet-tmpl/prog/en/modules/virtualshelves/tables/shelves_results.tt
>index 3e792012f0..688cf9b6e5 100644
>--- a/koha-tmpl/intranet-tmpl/prog/en/modules/virtualshelves/tables/shelves_results.tt
>+++ b/koha-tmpl/intranet-tmpl/prog/en/modules/virtualshelves/tables/shelves_results.tt
>@@ -39,7 +39,6 @@
>     [%~ public      = public | html ~%]
>     [%~ IF can_manage_shelf ~%]
>         [%~ action_block =                '<form action="shelves.pl" method="get">' ~%]
>-        [%~ action_block = BLOCK ~%][%~ action_block | $raw ~%][%~ INCLUDE 'csrf-token.inc' | trim ~%][%~ END ~%]
>         [%~ action_block = action_block _ '<input type="hidden" name="shelfnumber" value="' _ shelfnumber  _ '" />' ~%]
>         [%~ action_block = action_block _ '<input type="hidden" name="op" value="edit_form" />' ~%]
>         [%~ action_block = action_block _ '<input type="hidden" name="public" value="' _ public _ '" />' ~%]
>diff --git a/virtualshelves/shelves.pl b/virtualshelves/shelves.pl
>index 33564f8333..a4a6e41ec7 100755
>--- a/virtualshelves/shelves.pl
>+++ b/virtualshelves/shelves.pl
>@@ -64,7 +64,6 @@ if ( $op eq 'add_form' ) {
>     # Only pass default
>     $shelf = { allow_change_from_owner => 1 };
> } elsif ( $op eq 'edit_form' ) {
>-    output_and_exit_if_error($query, $cookie, $template, { check => 'csrf_token' });
>     $shelfnumber = $query->param('shelfnumber');
>     $shelf       = Koha::Virtualshelves->find($shelfnumber);
> 
>-- 
>2.30.2

Actions: View | Diff | Splinter Review

Attachments on bug 34650: 154926 | 154933 | 154934 | 154955 | 154956 | 155089 | 155090