Bugzilla – Attachment 155980 Details for
Bug 34478
Full CSRF protection
Home
|
New
|
Browse
|
Search
|
[?]
|
Reports
|
Help
|
New Account
|
Log In
[x]
|
Forgot Password
Login:
[x]
[patch]
Bug 34478: Add 'op' to opac-user.tt
Bug-34478-Add-op-to-opac-usertt.patch (text/plain), 2.63 KB, created by
Jonathan Druart
on 2023-09-21 10:05:08 UTC
(
hide
)
Description:
Bug 34478: Add 'op' to opac-user.tt
Filename:
MIME Type:
Creator:
Jonathan Druart
Created:
2023-09-21 10:05:08 UTC
Size:
2.63 KB
patch
obsolete
>From 817da1134759373698c3575ce5af5ccef71fe481 Mon Sep 17 00:00:00 2001 >From: Jonathan Druart <jonathan.druart@bugs.koha-community.org> >Date: Fri, 4 Aug 2023 11:06:16 +0200 >Subject: [PATCH] Bug 34478: Add 'op' to opac-user.tt > >--- > koha-tmpl/opac-tmpl/bootstrap/en/modules/opac-user.tt | 1 + > opac/opac-renew.pl | 3 +++ > opac/opac-user.pl | 4 +++- > 3 files changed, 7 insertions(+), 1 deletion(-) > >diff --git a/koha-tmpl/opac-tmpl/bootstrap/en/modules/opac-user.tt b/koha-tmpl/opac-tmpl/bootstrap/en/modules/opac-user.tt >index 50734dbbf2c..f2c3eab099a 100644 >--- a/koha-tmpl/opac-tmpl/bootstrap/en/modules/opac-user.tt >+++ b/koha-tmpl/opac-tmpl/bootstrap/en/modules/opac-user.tt >@@ -564,6 +564,7 @@ > [% INCLUDE 'csrf-token.inc' %] > <legend class="sr-only">Renew</legend> > <input type="hidden" name="from" value="opac_user" /> >+ <input type="hidden" name="op" value="renew" /> > <input type="hidden" name="borrowernumber" value="[% borrowernumber | html %]" /> > [% FOREACH ISSUE IN ISSUES %] > [% IF ISSUE.status %] >diff --git a/opac/opac-renew.pl b/opac/opac-renew.pl >index db70a167169..dff4d5b21fb 100755 >--- a/opac/opac-renew.pl >+++ b/opac/opac-renew.pl >@@ -31,6 +31,9 @@ use C4::Members; > use Koha::Items; > use Koha::Patrons; > my $query = CGI->new; >+my $op = $query->param('op') || q{}; >+ >+die "op must be set" unless $op eq 'renew'; > > my ( $template, $borrowernumber, $cookie ) = get_template_and_user( > { >diff --git a/opac/opac-user.pl b/opac/opac-user.pl >index 5f86bed3d6a..ec48ded4f5c 100755 >--- a/opac/opac-user.pl >+++ b/opac/opac-user.pl >@@ -57,6 +57,8 @@ use Date::Calc qw( Date_to_Days Today ); > > my $query = CGI->new; > >+my $op = $query->param('op') || q{}; >+ > # CAS single logout handling > # Will print header and exit > if ( C4::Context->preference('casAuthentication') ) { >@@ -87,7 +89,7 @@ $template->param( shibbolethAuthentication => C4::Context->config('useshibboleth > # get borrower information .... > my $patron = Koha::Patrons->find( $borrowernumber ); > >-if( $query->param('update_arc') && C4::Context->preference("AllowPatronToControlAutorenewal") ){ >+if( $op eq 'update_arc' && C4::Context->preference("AllowPatronToControlAutorenewal") ){ > die "Wrong CSRF token" > unless Koha::Token->new->check_csrf({ > session_id => scalar $query->cookie('CGISESSID'), >-- >2.25.1
You cannot view the attachment while viewing its details because your browser does not support IFRAMEs.
View the attachment on a separate page
.
View Attachment As Diff
View Attachment As Raw
Actions:
View
|
Diff
|
Splinter Review
Attachments on
bug 34478
:
154241
|
154242
|
154243
|
154244
|
154245
|
154246
|
154247
|
154248
|
154249
|
154250
|
154251
|
154252
|
154253
|
154254
|
155971
|
155972
|
155973
|
155974
|
155975
|
155976
|
155977
|
155978
|
155979
|
155980
|
155981
|
155982
|
155983
|
155984
|
155985
|
155986
|
155987
|
155988
|
155989
|
155990
|
156070
|
156071
|
156072
|
156073
|
156074
|
162114
|
162165
|
162630