Attachment 155971 Details for Bug 34478 – Bug 34478: Script to catch GET forms

[patch] Bug 34478: Script to catch GET forms

Bug-34478-Script-to-catch-GET-forms.patch (text/plain), 9.92 KB, created by Jonathan Druart on 2023-09-21 10:04:33 UTC

(hide)

Description:

Filename:

MIME Type:

Creator: Jonathan Druart

Created: 2023-09-21 10:04:33 UTC

Size: 9.92 KB

patch

obsolete

>From bd68a7b637218db71de9b83c96a6d76e0ca7bcac Mon Sep 17 00:00:00 2001
>From: Jonathan Druart <jonathan.druart@bugs.koha-community.org>
>Date: Fri, 4 Aug 2023 10:44:55 +0200
>Subject: [PATCH] Bug 34478: Script to catch GET forms
>
>and its output that have been modified to show the state of the progres
>(search for "TO BE CONTINUED")
>
>"stateless" => "get" can still be used for this form
>"modified" => "get" replaced with "post" and there is an "op" parameter
>"???" or "TODO" => needs more attention
>---
> csrf_get.pl  |  56 +++++++++++++++++++
> csrf_get.txt | 150 +++++++++++++++++++++++++++++++++++++++++++++++++++
> 2 files changed, 206 insertions(+)
> create mode 100644 csrf_get.pl
> create mode 100644 csrf_get.txt
>
>diff --git a/csrf_get.pl b/csrf_get.pl
>new file mode 100644
>index 00000000000..da46786991b
>--- /dev/null
>+++ b/csrf_get.pl
>@@ -0,0 +1,56 @@
>+#!/usr/bin/perl
>+
>+use Modern::Perl;
>+use File::Find;
>+use File::Slurp;
>+use Data::Dumper;
>+
>+my @themes;
>+
>+# OPAC themes
>+my $opac_dir  = 'koha-tmpl/opac-tmpl';
>+opendir ( my $dh, $opac_dir ) or die "can't opendir $opac_dir: $!";
>+for my $theme ( grep { not /^\.|lib|js|xslt/ } readdir($dh) ) {
>+    push @themes, "$opac_dir/$theme/en";
>+}
>+close $dh;
>+
>+# STAFF themes
>+my $staff_dir = 'koha-tmpl/intranet-tmpl';
>+opendir ( $dh, $staff_dir ) or die "can't opendir $staff_dir: $!";
>+for my $theme ( grep { not /^\.|lib|js/ } readdir($dh) ) {
>+    push @themes, "$staff_dir/$theme/en";
>+}
>+close $dh;
>+
>+my @files;
>+sub wanted {
>+    my $name = $File::Find::name;
>+    push @files, $name
>+        if $name =~ m[\.(tt|inc)$] and -f $name;
>+}
>+
>+find({ wanted => \&wanted, no_chdir => 1 }, @themes );
>+
>+my @errors;
>+for my $file ( @files ) {
>+    my @e = get_forms($file);
>+    push @errors, { file => $file, errors => \@e } if @e;
>+}
>+
>+say sprintf("%s:%s",  $_->{file}, join(',', @{$_->{errors}})) for @errors;
>+
>+sub get_forms {
>+    my ( $file ) = @_;
>+
>+    my @lines = read_file($file);
>+    my @errors;
>+    return @errors unless grep { $_ =~ m|<form| } @lines;
>+    my $line = 0 ;
>+    for my $l (@lines) {
>+        $line++;
>+        next if ! ( $l =~ m{<form} && $l =~ m{method=('|")get('|")} );
>+        push @errors, $line;
>+    }
>+    return @errors;
>+}
>diff --git a/csrf_get.txt b/csrf_get.txt
>new file mode 100644
>index 00000000000..5354f5c3ebd
>--- /dev/null
>+++ b/csrf_get.txt
>@@ -0,0 +1,150 @@
>+koha-tmpl/opac-tmpl/bootstrap/en/modules/opac-main.tt:76
>+=> stateless
>+koha-tmpl/opac-tmpl/bootstrap/en/modules/opac-suggestions.tt:338
>+=> stateless
>+koha-tmpl/opac-tmpl/bootstrap/en/modules/opac-recall.tt:68
>+=> modified, there is 'op'
>+koha-tmpl/opac-tmpl/bootstrap/en/modules/opac-readingrecord.tt:63
>+=> stateless
>+koha-tmpl/opac-tmpl/bootstrap/en/modules/opac-advsearch.tt:12
>+=> stateless
>+koha-tmpl/opac-tmpl/bootstrap/en/modules/opac-holdshistory.tt:79
>+=> stateless
>+koha-tmpl/opac-tmpl/bootstrap/en/modules/opac-basket.tt:85
>+=> stateless
>+281
>+=> stateless
>+349
>+=> ??? Are we emptying the cart here ???
>+koha-tmpl/opac-tmpl/bootstrap/en/modules/opac-tags.tt:87
>+=> stateless
>+koha-tmpl/opac-tmpl/bootstrap/en/modules/opac-results.tt:158
>+=> stateless
>+543
>+=> ??? Not clear ???
>+koha-tmpl/opac-tmpl/bootstrap/en/modules/opac-authorities-home.tt:38
>+=> modified, there is 'op'
>+koha-tmpl/opac-tmpl/bootstrap/en/modules/opac-shelves.tt:251
>+=> modified, there is 'op'
>+549
>+=> modified, there is 'op'
>+766
>+=> modified, there is 'op'
>+781
>+=> modified, there is 'op'
>+koha-tmpl/opac-tmpl/bootstrap/en/includes/opac-detail-sidebar.inc:121
>+=> modified, there is 'op'
>+koha-tmpl/opac-tmpl/bootstrap/en/includes/masthead.inc:172
>+=> stateless
>+koha-tmpl/opac-tmpl/bootstrap/en/includes/opac-topissues.inc:6
>+=> stateless
>+koha-tmpl/intranet-tmpl/prog/en/modules/pos/pay.tt:40
>+=> modified, there is 'op'
>+169
>+=> TODO there no 'op' here
>+koha-tmpl/intranet-tmpl/prog/en/modules/pos/register.tt:
>+41
>+=> modified, there is 'op'
>+172
>+=> stateless
>+koha-tmpl/intranet-tmpl/prog/en/modules/pos/registers.tt:38
>+=> modified, there is 'op'
>+koha-tmpl/intranet-tmpl/prog/en/modules/patroncards/edit-profile.tt:49
>+=> modified, there is 'op'
>+koha-tmpl/intranet-tmpl/prog/en/modules/patroncards/edit-layout.tt:46
>+=> modified, there is 'op'
>+koha-tmpl/intranet-tmpl/prog/en/modules/patroncards/edit-template.tt:49
>+=> modified, there is 'op'
>+koha-tmpl/intranet-tmpl/prog/en/modules/virtualshelves/shelves.tt:539
>+=> TODO! Confusing code here!
>+koha-tmpl/intranet-tmpl/prog/en/modules/virtualshelves/tables/shelves_results.tt:41
>+=> stateless
>+koha-tmpl/intranet-tmpl/prog/en/modules/admin/biblio_framework.tt:133
>+=> stateless
>+143
>+=> stateless
>+186
>+=> stateless
>+256
>+=> stateless
>+koha-tmpl/intranet-tmpl/prog/en/modules/admin/cities.tt:159
>+=> stateless
>+
>+.TO BE CONTINUED.
>+
>+koha-tmpl/intranet-tmpl/prog/en/modules/admin/matching-rules.tt:426
>+koha-tmpl/intranet-tmpl/prog/en/modules/admin/marc_subfields_structure.tt:423
>+koha-tmpl/intranet-tmpl/prog/en/modules/admin/edi_ean_accounts.tt:146
>+koha-tmpl/intranet-tmpl/prog/en/modules/admin/aqbudgets.tt:422,435
>+koha-tmpl/intranet-tmpl/prog/en/modules/admin/authtypes.tt:151,207
>+koha-tmpl/intranet-tmpl/prog/en/modules/admin/edi_accounts.tt:286
>+koha-tmpl/intranet-tmpl/prog/en/modules/admin/auth_tag_structure.tt:195
>+koha-tmpl/intranet-tmpl/prog/en/modules/admin/item_circulation_alerts.tt:71
>+koha-tmpl/intranet-tmpl/prog/en/modules/admin/aqcontract.tt:154
>+koha-tmpl/intranet-tmpl/prog/en/modules/admin/auth_subfields_structure.tt:293,361
>+koha-tmpl/intranet-tmpl/prog/en/modules/admin/branch_transfer_limits.tt:33
>+koha-tmpl/intranet-tmpl/prog/en/modules/admin/branches.tt:296
>+koha-tmpl/intranet-tmpl/prog/en/modules/admin/patron-attr-types.tt:252
>+koha-tmpl/intranet-tmpl/prog/en/modules/admin/authorised_values.tt:230,294
>+koha-tmpl/intranet-tmpl/prog/en/modules/admin/smart-rules.tt:80
>+koha-tmpl/intranet-tmpl/prog/en/modules/admin/desks.tt:156
>+koha-tmpl/intranet-tmpl/prog/en/modules/admin/marctagstructure.tt:193
>+koha-tmpl/intranet-tmpl/prog/en/modules/admin/marc-overlay-rules.tt:67
>+=> stateless
>+koha-tmpl/intranet-tmpl/prog/en/modules/authorities/authorities.tt:393,397
>+koha-tmpl/intranet-tmpl/prog/en/modules/cataloguing/addbiblio.tt:840,845,850
>+koha-tmpl/intranet-tmpl/prog/en/modules/cataloguing/z3950_search.tt:258
>+koha-tmpl/intranet-tmpl/prog/en/modules/cataloguing/moveitem.tt:47,91
>+koha-tmpl/intranet-tmpl/prog/en/modules/cataloguing/z3950_auth_search.tt:152,182
>+koha-tmpl/intranet-tmpl/prog/en/modules/cataloguing/value_builder/unimarc_field_686a.tt:14
>+koha-tmpl/intranet-tmpl/prog/en/modules/cataloguing/value_builder/cn_browser.tt:20
>+koha-tmpl/intranet-tmpl/prog/en/modules/suggestion/suggestion.tt:1001
>+koha-tmpl/intranet-tmpl/prog/en/modules/members/paycollect.tt:16
>+koha-tmpl/intranet-tmpl/prog/en/modules/members/routing-lists.tt:41
>+koha-tmpl/intranet-tmpl/prog/en/modules/members/boraccount.tt:58,212,267,325
>+koha-tmpl/intranet-tmpl/prog/en/modules/members/readingrec.tt:50
>+koha-tmpl/intranet-tmpl/prog/en/modules/acqui/vendor_issues.tt:140
>+koha-tmpl/intranet-tmpl/prog/en/modules/acqui/transferorder.tt:24
>+koha-tmpl/intranet-tmpl/prog/en/modules/acqui/basket.tt:128,146,154,835,860
>+koha-tmpl/intranet-tmpl/prog/en/modules/acqui/basketgroup.tt:363,365,403,404,405,406,409
>+koha-tmpl/intranet-tmpl/prog/en/modules/acqui/parcel.tt:150,323
>+koha-tmpl/intranet-tmpl/prog/en/modules/acqui/edi_ean.tt:31
>+koha-tmpl/intranet-tmpl/prog/en/modules/acqui/parcels.tt:60,140,199
>+koha-tmpl/intranet-tmpl/prog/en/modules/acqui/lateorders.tt:234
>+koha-tmpl/intranet-tmpl/prog/en/modules/acqui/invoices.tt:304
>+koha-tmpl/intranet-tmpl/prog/en/modules/catalogue/advsearch.tt:45
>+koha-tmpl/intranet-tmpl/prog/en/modules/catalogue/detail.tt:1083
>+koha-tmpl/intranet-tmpl/prog/en/modules/catalogue/itemsearch.tt:173
>+koha-tmpl/intranet-tmpl/prog/en/modules/catalogue/results.tt:377,414,438,759,765
>+koha-tmpl/intranet-tmpl/prog/en/modules/serials/subscription-frequencies.tt:122,128
>+koha-tmpl/intranet-tmpl/prog/en/modules/serials/subscription-numberpatterns.tt:263,269
>+koha-tmpl/intranet-tmpl/prog/en/modules/serials/checkexpiration.tt:33
>+koha-tmpl/intranet-tmpl/prog/en/modules/serials/subscription-detail.tt:70
>+koha-tmpl/intranet-tmpl/prog/en/modules/serials/subscription-bib-search.tt:13
>+koha-tmpl/intranet-tmpl/prog/en/modules/circ/circulation.tt:360,370,375
>+koha-tmpl/intranet-tmpl/prog/en/modules/circ/renew.tt:172
>+koha-tmpl/intranet-tmpl/prog/en/modules/reports/reports-home.tt:28
>+koha-tmpl/intranet-tmpl/prog/en/modules/reports/guided_reports_start.tt:410,415,420,968,1001,1405
>+koha-tmpl/intranet-tmpl/prog/en/modules/tools/modborrowers.tt:138
>+koha-tmpl/intranet-tmpl/prog/en/modules/tools/csv-profiles.tt:272
>+koha-tmpl/intranet-tmpl/prog/en/modules/tools/letter.tt:132,502
>+koha-tmpl/intranet-tmpl/prog/en/modules/tools/quotes.tt:93
>+koha-tmpl/intranet-tmpl/prog/en/modules/tools/cleanborrowers.tt:65
>+koha-tmpl/intranet-tmpl/prog/en/modules/tools/additional-contents.tt:137
>+koha-tmpl/intranet-tmpl/prog/en/modules/labels/label-edit-layout.tt:63
>+koha-tmpl/intranet-tmpl/prog/en/modules/labels/label-edit-template.tt:46
>+koha-tmpl/intranet-tmpl/prog/en/modules/labels/label-edit-profile.tt:47
>+koha-tmpl/intranet-tmpl/prog/en/modules/ill/ill-requests.tt:51
>+koha-tmpl/intranet-tmpl/prog/en/modules/basket/basket.tt:71,261,339
>+koha-tmpl/intranet-tmpl/prog/en/includes/cat-toolbar.inc:223
>+koha-tmpl/intranet-tmpl/prog/en/includes/erm-search.inc:6,18,30,42
>+koha-tmpl/intranet-tmpl/prog/en/includes/auth-finder-search.inc:8
>+koha-tmpl/intranet-tmpl/prog/en/includes/serials-advsearch.inc:3
>+koha-tmpl/intranet-tmpl/prog/en/includes/acquisitions-add-to-basket.inc:6
>+koha-tmpl/intranet-tmpl/prog/en/includes/authorities-search.inc:76,103,130,155
>+koha-tmpl/intranet-tmpl/prog/en/includes/suggestions-add-search.inc:7
>+koha-tmpl/intranet-tmpl/prog/en/includes/serials-search.inc:6
>+koha-tmpl/intranet-tmpl/prog/en/includes/catalogue-search-box.inc:10
>+koha-tmpl/intranet-tmpl/prog/en/includes/subscriptions-search.inc:3
>+koha-tmpl/intranet-tmpl/prog/en/includes/serials-toolbar.inc:106,152
>+koha-tmpl/intranet-tmpl/prog/en/includes/mana/mana-subscription-search-result.inc:78
>-- 
>2.25.1

Actions: View | Diff | Splinter Review

Attachments on bug 34478: 154241 | 154242 | 154243 | 154244 | 154245 | 154246 | 154247 | 154248 | 154249 | 154250 | 154251 | 154252 | 154253 | 154254 | 155971 | 155972 | 155973 | 155974 | 155975 | 155976 | 155977 | 155978 | 155979 | 155980 | 155981 | 155982 | 155983 | 155984 | 155985 | 155986 | 155987 | 155988 | 155989 | 155990 | 156070 | 156071 | 156072 | 156073 | 156074 | 162114 | 162165 | 162630