Attachment 166578 Details for Bug 19316 – Bug 19316: Add CSRF protection

[patch] Bug 19316: Add CSRF protection

Bug-19316-Add-CSRF-protection.patch (text/plain), 3.98 KB, created by Matt Blenkinsop on 2024-05-10 15:10:15 UTC

(hide)

Description:

Filename:

MIME Type:

Creator: Matt Blenkinsop

Created: 2024-05-10 15:10:15 UTC

Size: 3.98 KB

patch

obsolete

>From 2f1acc9cd85bd3014f505e2026ddc0f5279e4638 Mon Sep 17 00:00:00 2001
>From: Matt Blenkinsop <matt.blenkinsop@ptfs-europe.com>
>Date: Fri, 10 May 2024 15:09:21 +0000
>Subject: [PATCH] Bug 19316: Add CSRF protection
>
>---
> catalogue/updateitem.pl                                     | 4 ++--
> .../intranet-tmpl/prog/en/modules/catalogue/moredetail.tt   | 6 ++++--
> 2 files changed, 6 insertions(+), 4 deletions(-)
>
>diff --git a/catalogue/updateitem.pl b/catalogue/updateitem.pl
>index 64bc6b2682..8718653b38 100755
>--- a/catalogue/updateitem.pl
>+++ b/catalogue/updateitem.pl
>@@ -82,9 +82,9 @@ elsif ( $op eq "cud-set_public_note" ) { # i.e., itemnotes parameter passed from
>     $item->bookable($bookable);
> } elsif ( $op eq "cud-set_damaged" && $damaged ne $item_data_hashref->{'damaged'}) {
>     $item->damaged($damaged);
>-} elsif ( $op eq "set_sort1" && $sort1 ne $item_data_hashref->{'sort1'} ) {
>+} elsif ( $op eq "cud-set_sort1" && $sort1 ne $item_data_hashref->{'sort1'} ) {
>     $item->sort1($sort1);
>-} elsif ( $op eq "set_sort2" && $sort2 ne $item_data_hashref->{'sort2'} ) {
>+} elsif ( $op eq "cud-set_sort2" && $sort2 ne $item_data_hashref->{'sort2'} ) {
>     $item->sort2($sort2);
> } else {
>     #nothings changed, so do nothing.
>diff --git a/koha-tmpl/intranet-tmpl/prog/en/modules/catalogue/moredetail.tt b/koha-tmpl/intranet-tmpl/prog/en/modules/catalogue/moredetail.tt
>index d5bb9586d4..f79d779e38 100644
>--- a/koha-tmpl/intranet-tmpl/prog/en/modules/catalogue/moredetail.tt
>+++ b/koha-tmpl/intranet-tmpl/prog/en/modules/catalogue/moredetail.tt
>@@ -387,8 +387,9 @@
>                                             <span class="label">Sort 1:</span>
>                                             [% IF ( CAN_user_editcatalogue_edit_items ) %]
>                                                 <form class="inline" action="updateitem.pl" method="post"><input type="hidden" name="biblionumber" value="[% ITEM_DAT.biblionumber | html %]" />
>+                                                    [% INCLUDE 'csrf-token.inc' %]
>                                                     <input type="hidden" name="biblioitemnumber" value="[% ITEM_DAT.biblioitemnumber | html %]" /><input type="hidden" name="itemnumber" value="[% ITEM_DAT.itemnumber | html %]" />
>-                                                    <input type="hidden" name="op" value="set_sort1" />
>+                                                    <input type="hidden" name="op" value="cud-set_sort1" />
>                                                     <textarea name="sort1" rows="2" cols="30">[% ITEM_DAT.sort1 | html %]</textarea><input type="submit" name="submit" class="btn btn-primary btn-xs" value="Update" />
>                                                 </form>
>                                             [% ELSE %]
>@@ -399,8 +400,9 @@
>                                             <span class="label">Sort 2:</span>
>                                             [% IF ( CAN_user_editcatalogue_edit_items ) %]
>                                                 <form class="inline" action="updateitem.pl" method="post"><input type="hidden" name="biblionumber" value="[% ITEM_DAT.biblionumber | html %]" />
>+                                                    [% INCLUDE 'csrf-token.inc' %]
>                                                     <input type="hidden" name="biblioitemnumber" value="[% ITEM_DAT.biblioitemnumber | html %]" /><input type="hidden" name="itemnumber" value="[% ITEM_DAT.itemnumber | html %]" />
>-                                                    <input type="hidden" name="op" value="set_sort2" />
>+                                                    <input type="hidden" name="op" value="cud-set_sort2" />
>                                                     <textarea name="sort2" rows="2" cols="30">[% ITEM_DAT.sort2 | html %]</textarea><input type="submit" name="submit" class="btn btn-primary btn-xs" value="Update" />
>                                                 </form>
>                                             [% ELSE %]
>-- 
>2.37.1 (Apple Git-137.1)

Actions: View | Diff | Splinter Review

Attachments on bug 19316: 154963 | 154964 | 154965 | 154966 | 154967 | 166298 | 166299 | 166300 | 166301 | 166578 | 166593 | 169466 | 169467 | 169468 | 169469 | 169470 | 169503 | 169504 | 169505 | 169506 | 169507