Bugzilla – Attachment 155975 Details for
Bug 34478
Full CSRF protection
Home
|
New
|
Browse
|
Search
|
[?]
|
Reports
|
Help
|
New Account
|
Log In
[x]
|
Forgot Password
Login:
[x]
[patch]
Bug 34478: Remove generate_csrf from pl
Bug-34478-Remove-generatecsrf-from-pl.patch (text/plain), 15.37 KB, created by
Jonathan Druart
on 2023-09-21 10:04:49 UTC
(
hide
)
Description:
Bug 34478: Remove generate_csrf from pl
Filename:
MIME Type:
Creator:
Jonathan Druart
Created:
2023-09-21 10:04:49 UTC
Size:
15.37 KB
patch
obsolete
>From afc76b9ebd6a6d19ca9ea07e0a96e611730c1483 Mon Sep 17 00:00:00 2001 >From: Jonathan Druart <jonathan.druart@bugs.koha-community.org> >Date: Fri, 4 Aug 2023 11:15:54 +0200 >Subject: [PATCH] Bug 34478: Remove generate_csrf from pl > >We do not longer need to generate_csrf from pl files > >TODO - members/boraccount.tt and sco/sco-main.tt needs to be adjusted >--- > Koha/REST/V1/OAuth/Client.pm | 4 ---- > authorities/authorities-home.pl | 5 ----- > authorities/detail.pl | 1 - > basket/sendbasket.pl | 3 --- > circ/circulation.pl | 5 ----- > ill/ill-requests.pl | 3 --- > members/apikeys.pl | 1 - > members/boraccount.pl | 5 ----- > members/deletemem.pl | 1 - > members/mancredit.pl | 3 --- > members/maninvoice.pl | 3 --- > members/member-flags.pl | 2 -- > members/member-password.pl | 1 - > members/memberentry.pl | 5 ----- > members/moremember.pl | 5 ----- > members/paycollect.pl | 2 -- > members/two_factor_auth.pl | 3 --- > opac/opac-memberentry.pl | 9 --------- > opac/opac-messaging.pl | 5 ----- > opac/opac-sendbasket.pl | 2 -- > opac/opac-user.pl | 3 --- > opac/sco/sco-main.pl | 1 - > tools/import_borrowers.pl | 7 ------- > tools/picture-upload.pl | 5 ----- > 24 files changed, 84 deletions(-) > >diff --git a/Koha/REST/V1/OAuth/Client.pm b/Koha/REST/V1/OAuth/Client.pm >index b6f66b022c0..fdae9e69978 100644 >--- a/Koha/REST/V1/OAuth/Client.pm >+++ b/Koha/REST/V1/OAuth/Client.pm >@@ -97,10 +97,6 @@ sub login { > return $c->redirect_to( $uri . "?auth_error=$error" ); > } > } >- else { >- # initial request, generate CSRF token >- $state = Koha::Token->new->generate_csrf( { session_id => $c->req->cookie('CGISESSID')->value } ); >- } > > return $c->oauth2->get_token_p( $provider => { ( !$is_callback ? ( state => $state ) : () ), redirect_uri => $redirect_url . $provider . "/" . $interface } )->then( > sub { >diff --git a/authorities/authorities-home.pl b/authorities/authorities-home.pl >index 467da48e778..de0be050006 100755 >--- a/authorities/authorities-home.pl >+++ b/authorities/authorities-home.pl >@@ -113,11 +113,6 @@ if ( $op eq "do_search" ) { > } > > $template->param( search_query => $search_query ) if C4::Context->preference('DumpSearchQueryTemplate'); >- $template->param( >- csrf_token => Koha::Token->new->generate_csrf({ >- session_id => scalar $query->cookie('CGISESSID'), >- }), >- ); > > # search history > if (C4::Context->preference('EnableSearchHistory')) { >diff --git a/authorities/detail.pl b/authorities/detail.pl >index a95460958b3..8915781dbd5 100755 >--- a/authorities/detail.pl >+++ b/authorities/detail.pl >@@ -230,7 +230,6 @@ $template->param( > authtypetext => $type ? $type->authtypetext: "", > authtypecode => $authtypecode, > authority_types => $authority_types, >- csrf_token => Koha::Token->new->generate_csrf({ session_id => scalar $query->cookie('CGISESSID') }), > servers => $servers, > ); > >diff --git a/basket/sendbasket.pl b/basket/sendbasket.pl >index e863497d32b..e15f8a2e1f5 100755 >--- a/basket/sendbasket.pl >+++ b/basket/sendbasket.pl >@@ -124,9 +124,6 @@ else { > url => "/cgi-bin/koha/basket/sendbasket.pl", > suggestion => C4::Context->preference("suggestion"), > virtualshelves => C4::Context->preference("virtualshelves"), >- csrf_token => Koha::Token->new->generate_csrf( >- { session_id => scalar $query->cookie('CGISESSID'), } >- ), > ); > output_html_with_http_headers $query, $cookie, $template->output; > } >diff --git a/circ/circulation.pl b/circ/circulation.pl >index 9b925e29ad2..c9f1033bb36 100755 >--- a/circ/circulation.pl >+++ b/circ/circulation.pl >@@ -634,9 +634,4 @@ $template->param( > logged_in_user => $logged_in_user, > ); > >-# Generate CSRF token for upload and delete image buttons >-$template->param( >- csrf_token => Koha::Token->new->generate_csrf({ session_id => $query->cookie('CGISESSID'),}), >-); >- > output_html_with_http_headers $query, $cookie, $template->output; >diff --git a/ill/ill-requests.pl b/ill/ill-requests.pl >index f8a385f30a7..f546a70e747 100755 >--- a/ill/ill-requests.pl >+++ b/ill/ill-requests.pl >@@ -89,9 +89,6 @@ if ( $backends_available ) { > $template->param( > notices => $notices, > request => $request, >- csrf_token => Koha::Token->new->generate_csrf({ >- session_id => scalar $cgi->cookie('CGISESSID'), >- }), > ( $params->{tran_error} ? > ( tran_error => $params->{tran_error} ) : () ), > ( $params->{tran_success} ? >diff --git a/members/apikeys.pl b/members/apikeys.pl >index 5f1cd271caf..883c1948862 100755 >--- a/members/apikeys.pl >+++ b/members/apikeys.pl >@@ -123,7 +123,6 @@ if ($op) { > > $template->param( > api_keys => Koha::ApiKeys->search({ patron_id => $patron_id }), >- csrf_token => Koha::Token->new->generate_csrf({ session_id => scalar $cgi->cookie('CGISESSID') }), > patron => $patron > ); > >diff --git a/members/boraccount.pl b/members/boraccount.pl >index 5398f28ea68..086198d4d1f 100755 >--- a/members/boraccount.pl >+++ b/members/boraccount.pl >@@ -244,10 +244,6 @@ foreach my $renew_result(@renew_results) { > }; > } > >-my $csrf_token = Koha::Token->new->generate_csrf({ >- session_id => scalar $input->cookie('CGISESSID'), >-}); >- > $template->param( > patron => $patron, > finesview => 1, >@@ -258,7 +254,6 @@ $template->param( > change_given => $change_given, > renew_results => $renew_results_display, > receipt_sent => $receipt_sent, >- csrf_token => $csrf_token, > ); > > output_html_with_http_headers $input, $cookie, $template->output; >diff --git a/members/deletemem.pl b/members/deletemem.pl >index 31d930cc007..aedc5a6a4a0 100755 >--- a/members/deletemem.pl >+++ b/members/deletemem.pl >@@ -114,7 +114,6 @@ $template->param( > if ( $op eq 'delete_confirm' or $countissues > 0 or $debits or $is_guarantor ) { > $template->param( > op => 'delete_confirm', >- csrf_token => Koha::Token->new->generate_csrf({ session_id => scalar $input->cookie('CGISESSID') }), > ); > > } elsif ( $op eq 'delete_confirmed' ) { >diff --git a/members/mancredit.pl b/members/mancredit.pl >index e77c82defc9..bd422863fbc 100755 >--- a/members/mancredit.pl >+++ b/members/mancredit.pl >@@ -141,9 +141,6 @@ else { > patron => $patron, > credit_types => \@credit_types, > finesview => 1, >- csrf_token => Koha::Token->new->generate_csrf( >- { session_id => scalar $input->cookie('CGISESSID') } >- ), > available_additional_fields => [ Koha::AdditionalFields->search({ tablename => 'accountlines:credit' })->as_list ], > ); > output_html_with_http_headers $input, $cookie, $template->output; >diff --git a/members/maninvoice.pl b/members/maninvoice.pl >index 01464cf3a44..e622c553fa8 100755 >--- a/members/maninvoice.pl >+++ b/members/maninvoice.pl >@@ -227,9 +227,6 @@ my $debit_types = Koha::Account::DebitTypes->search_with_library_limits( > > $template->param( > debit_types => $debit_types, >- csrf_token => Koha::Token->new->generate_csrf( >- { session_id => scalar $input->cookie('CGISESSID') } >- ), > patron => $patron, > finesview => 1, > available_additional_fields => [ Koha::AdditionalFields->search({ tablename => 'accountlines:debit' })->as_list ], >diff --git a/members/member-flags.pl b/members/member-flags.pl >index 900a176ad51..3aa500b1c0d 100755 >--- a/members/member-flags.pl >+++ b/members/member-flags.pl >@@ -181,8 +181,6 @@ if ($input->param('newflags')) { > $template->param( > patron => $patron, > loop => \@loop, >- csrf_token => >- Koha::Token->new->generate_csrf( { session_id => scalar $input->cookie('CGISESSID'), } ), > disable_superlibrarian_privs => C4::Context->preference('ProtectSuperlibrarianPrivileges') ? !C4::Context->IsSuperLibrarian : 0, > ); > >diff --git a/members/member-password.pl b/members/member-password.pl >index d44f29d0f77..9b6ebd23b6a 100755 >--- a/members/member-password.pl >+++ b/members/member-password.pl >@@ -97,7 +97,6 @@ if ( $newpassword and not @errors) { > $template->param( > patron => $patron, > destination => $destination, >- csrf_token => Koha::Token->new->generate_csrf({ session_id => scalar $input->cookie('CGISESSID'), }), > ); > > if ( scalar(@errors) ) { >diff --git a/members/memberentry.pl b/members/memberentry.pl >index 89e32ff1819..e2f839607ca 100755 >--- a/members/memberentry.pl >+++ b/members/memberentry.pl >@@ -772,11 +772,6 @@ $template->param( > CanUpdatePasswordExpiration => $CanUpdatePasswordExpiration, > ); > >-# Generate CSRF token >-$template->param( csrf_token => >- Koha::Token->new->generate_csrf( { session_id => scalar $input->cookie('CGISESSID'), } ), >-); >- > # HouseboundModule data > $template->param( > housebound_role => Koha::Patron::HouseboundRoles->find($borrowernumber), >diff --git a/members/moremember.pl b/members/moremember.pl >index 5813c8d87f8..3eea151796c 100755 >--- a/members/moremember.pl >+++ b/members/moremember.pl >@@ -128,11 +128,6 @@ if ( !$patron->is_valid_age ) { > $template->param( age_high => $patron->category->upperagelimit ); > } > >-# Generate CSRF token for upload and delete image buttons >-$template->param( >- csrf_token => Koha::Token->new->generate_csrf({ session_id => $input->cookie('CGISESSID'),}), >-); >- > if (C4::Context->preference('ExtendedPatronAttributes')) { > my @attributes = $patron->extended_attributes->as_list; # FIXME Must be improved! > my @classes = uniq( map {$_->type->class} @attributes ); >diff --git a/members/paycollect.pl b/members/paycollect.pl >index b189107f25b..e90358ddd6c 100755 >--- a/members/paycollect.pl >+++ b/members/paycollect.pl >@@ -282,8 +282,6 @@ $template->param( > borrowernumber => $borrowernumber, # some templates require global > patron => $patron, > total => $total_due, >- >- csrf_token => Koha::Token->new->generate_csrf( { session_id => scalar $input->cookie('CGISESSID') } ), > available_additional_fields => [ Koha::AdditionalFields->search({ tablename => 'accountlines:credit' })->as_list ], > ); > >diff --git a/members/two_factor_auth.pl b/members/two_factor_auth.pl >index 81220c4b274..5a1e28860d1 100755 >--- a/members/two_factor_auth.pl >+++ b/members/two_factor_auth.pl >@@ -84,9 +84,6 @@ else { > } > > $template->param( >- csrf_token => Koha::Token->new->generate_csrf( >- { session_id => scalar $cgi->cookie('CGISESSID') } >- ), > patron => $logged_in_user, > op => $op, > ); >diff --git a/opac/opac-memberentry.pl b/opac/opac-memberentry.pl >index 56743e97d85..38cc17bf463 100755 >--- a/opac/opac-memberentry.pl >+++ b/opac/opac-memberentry.pl >@@ -331,9 +331,6 @@ elsif ( $action eq 'update' ) { > empty_mandatory_fields => \@empty_mandatory_fields, > invalid_form_fields => $invalidformfields, > borrower => \%borrower, >- csrf_token => Koha::Token->new->generate_csrf({ >- session_id => scalar $cgi->cookie('CGISESSID'), >- }), > ); > $template->param( patron_attribute_classes => GeneratePatronAttributesForm( $borrowernumber, $attributes ) ); > >@@ -379,9 +376,6 @@ elsif ( $action eq 'update' ) { > nochanges => 1, > borrower => $patron->unblessed, > patron_attribute_classes => GeneratePatronAttributesForm( $borrowernumber, $attributes ), >- csrf_token => Koha::Token->new->generate_csrf({ >- session_id => scalar $cgi->cookie('CGISESSID'), >- }), > ); > } > } >@@ -393,9 +387,6 @@ elsif ( $action eq 'edit' ) { #Display logged in borrower's data > $template->param( > borrower => $borrower, > hidden => GetHiddenFields( $mandatory, 'edit' ), >- csrf_token => Koha::Token->new->generate_csrf({ >- session_id => scalar $cgi->cookie('CGISESSID'), >- }), > ); > > if (C4::Context->preference('OPACpatronimages')) { >diff --git a/opac/opac-messaging.pl b/opac/opac-messaging.pl >index 3fef7eb862f..fd239a76144 100755 >--- a/opac/opac-messaging.pl >+++ b/opac/opac-messaging.pl >@@ -92,11 +92,6 @@ if( $opac_messaging && C4::Context->preference("SMSSendDriver") eq 'Email' ) { > } > > my $new_session_id = $query->cookie('CGISESSID'); >-$template->param( >- csrf_token => Koha::Token->new->generate_csrf({ >- session_id => $new_session_id, >- }), >-); > > if ( C4::Context->preference('TranslateNotices') ) { > my $translated_languages = C4::Languages::getTranslatedLanguages( 'opac', C4::Context->preference('template') ); >diff --git a/opac/opac-sendbasket.pl b/opac/opac-sendbasket.pl >index d0ff9fc53a6..9ffb46a2204 100755 >--- a/opac/opac-sendbasket.pl >+++ b/opac/opac-sendbasket.pl >@@ -126,8 +126,6 @@ else { > url => "/cgi-bin/koha/opac-sendbasket.pl", > suggestion => C4::Context->preference("suggestion"), > virtualshelves => C4::Context->preference("virtualshelves"), >- csrf_token => >- Koha::Token->new->generate_csrf( { session_id => $new_session_id, } ), > ); > output_html_with_http_headers $query, $cookie, $template->output, undef, > { force_no_caching => 1 }; >diff --git a/opac/opac-user.pl b/opac/opac-user.pl >index f5588c0aa35..5f86bed3d6a 100755 >--- a/opac/opac-user.pl >+++ b/opac/opac-user.pl >@@ -181,9 +181,6 @@ $template->param( > surname => $borr->{surname}, > RENEW_ERROR => $renew_error, > borrower => $borr, >- csrf_token => Koha::Token->new->generate_csrf({ >- session_id => scalar $query->cookie('CGISESSID'), >- }), > ); > > #get issued items .... >diff --git a/opac/sco/sco-main.pl b/opac/sco/sco-main.pl >index 9f70a415cc4..b945da700f4 100755 >--- a/opac/sco/sco-main.pl >+++ b/opac/sco/sco-main.pl >@@ -363,7 +363,6 @@ if ( $patron) { > my $patron_image = $patron->image; > $template->param( > display_patron_image => 1, >- csrf_token => Koha::Token->new->generate_csrf( { session_id => scalar $query->cookie('CGISESSID') . $patron->cardnumber, id => $patron->userid } ), > ) if $patron_image; > } > } else { >diff --git a/tools/import_borrowers.pl b/tools/import_borrowers.pl >index a02f14dc40d..ffa452b7957 100755 >--- a/tools/import_borrowers.pl >+++ b/tools/import_borrowers.pl >@@ -176,13 +176,6 @@ else { > } > $template->param( matchpoints => \@matchpoints ); > } >- >- $template->param( >- csrf_token => Koha::Token->new->generate_csrf( >- { session_id => scalar $input->cookie('CGISESSID'), } >- ), >- ); >- > } > > output_html_with_http_headers $input, $cookie, $template->output; >diff --git a/tools/picture-upload.pl b/tools/picture-upload.pl >index 1f4c62b5de9..b1d09a6c881 100755 >--- a/tools/picture-upload.pl >+++ b/tools/picture-upload.pl >@@ -209,11 +209,6 @@ if ( $borrowernumber && !%errors && !$template->param('ERRORS') ) { > "/cgi-bin/koha/members/moremember.pl?borrowernumber=$borrowernumber"); > } > else { >- $template->param( >- csrf_token => Koha::Token->new->generate_csrf({ >- session_id => scalar $input->cookie('CGISESSID'), >- }), >- ); > output_html_with_http_headers $input, $cookie, $template->output; > } > >-- >2.25.1
You cannot view the attachment while viewing its details because your browser does not support IFRAMEs.
View the attachment on a separate page
.
View Attachment As Diff
View Attachment As Raw
Actions:
View
|
Diff
|
Splinter Review
Attachments on
bug 34478
:
154241
|
154242
|
154243
|
154244
|
154245
|
154246
|
154247
|
154248
|
154249
|
154250
|
154251
|
154252
|
154253
|
154254
|
155971
|
155972
|
155973
|
155974
|
155975
|
155976
|
155977
|
155978
|
155979
|
155980
|
155981
|
155982
|
155983
|
155984
|
155985
|
155986
|
155987
|
155988
|
155989
|
155990
|
156070
|
156071
|
156072
|
156073
|
156074
|
162114
|
162165
|
162630