Bugzilla – Attachment 155974 Details for
Bug 34478
Full CSRF protection
Home
|
New
|
Browse
|
Search
|
[?]
|
Reports
|
Help
|
New Account
|
Log In
[x]
|
Forgot Password
Login:
[x]
[patch]
Bug 34478: Replace csrf_token input with include file - manual
Bug-34478-Replace-csrftoken-input-with-include-fil.patch (text/plain), 2.69 KB, created by
Jonathan Druart
on 2023-09-21 10:04:45 UTC
(
hide
)
Description:
Bug 34478: Replace csrf_token input with include file - manual
Filename:
MIME Type:
Creator:
Jonathan Druart
Created:
2023-09-21 10:04:45 UTC
Size:
2.69 KB
patch
obsolete
>From 2e428d93143f26bd1a5db34437d0405a7fbad2ee Mon Sep 17 00:00:00 2001 >From: Jonathan Druart <jonathan.druart@bugs.koha-community.org> >Date: Fri, 4 Aug 2023 10:57:42 +0200 >Subject: [PATCH] Bug 34478: Replace csrf_token input with include file - > manual > >A couple of left not caught by the previous regex > >Still TODO: >% git grep csrf_token **/*.inc **/*.tt >still shows example that needs to be replaced, later (because we use GET) >--- > koha-tmpl/intranet-tmpl/prog/en/includes/circ-menu.inc | 2 +- > koha-tmpl/intranet-tmpl/prog/en/modules/ill/ill-requests.tt | 2 +- > 2 files changed, 2 insertions(+), 2 deletions(-) > >diff --git a/koha-tmpl/intranet-tmpl/prog/en/includes/circ-menu.inc b/koha-tmpl/intranet-tmpl/prog/en/includes/circ-menu.inc >index 3ee86d767f3..61a132f8b67 100644 >--- a/koha-tmpl/intranet-tmpl/prog/en/includes/circ-menu.inc >+++ b/koha-tmpl/intranet-tmpl/prog/en/includes/circ-menu.inc >@@ -215,7 +215,7 @@ > <label for="uploadfile">Select the file to upload: </label> > <input type="file" id="uploadfile" name="uploadfile" required="required" /> > <div class="action"> >- <input type="hidden" id="csrf_token" name="csrf_token" value="[% csrf_token | html %]" /> >+ [% INCLUDE 'csrf-token.inc' %] > <input type="hidden" id="image" name="filetype" value="image" /> > <input type="hidden" id="cardnumber" name="cardnumber" value="[% patron.cardnumber | html %]" /> > <input type="hidden" id="borrowernumber" name="borrowernumber" value="[% patron.borrowernumber | html %]" /> >diff --git a/koha-tmpl/intranet-tmpl/prog/en/modules/ill/ill-requests.tt b/koha-tmpl/intranet-tmpl/prog/en/modules/ill/ill-requests.tt >index ce60d1fb23b..32b62601e2e 100644 >--- a/koha-tmpl/intranet-tmpl/prog/en/modules/ill/ill-requests.tt >+++ b/koha-tmpl/intranet-tmpl/prog/en/modules/ill/ill-requests.tt >@@ -758,7 +758,7 @@ > <div id="addcomment" class="content_hidden"> > <form class="validated" method="post" action="/cgi-bin/koha/ill/ill-requests.pl"> > <input type="hidden" value="save_comment" name="method"> >- <input type="hidden" value="[% csrf_token | html %]" name="csrf_token"> >+ [% INCLUDE 'csrf-token.inc' %] > <input type="hidden" value="[% request.illrequest_id | html %]" name="illrequest_id"> > <fieldset class="rows"> > <ol> >-- >2.25.1
You cannot view the attachment while viewing its details because your browser does not support IFRAMEs.
View the attachment on a separate page
.
View Attachment As Diff
View Attachment As Raw
Actions:
View
|
Diff
|
Splinter Review
Attachments on
bug 34478
:
154241
|
154242
|
154243
|
154244
|
154245
|
154246
|
154247
|
154248
|
154249
|
154250
|
154251
|
154252
|
154253
|
154254
|
155971
|
155972
|
155973
|
155974
|
155975
|
155976
|
155977
|
155978
|
155979
|
155980
|
155981
|
155982
|
155983
|
155984
|
155985
|
155986
|
155987
|
155988
|
155989
|
155990
|
156070
|
156071
|
156072
|
156073
|
156074
|
162114
|
162165
|
162630