Attachment 167173 Details for Bug 35659 – Bug 35659: (follow-up) Make OAI repositories edition comply with CSRF

[patch] Bug 35659: (follow-up) Make OAI repositories edition comply with CSRF

Bug-35659-follow-up-Make-OAI-repositories-edition-.patch (text/plain), 7.09 KB, created by Victor Grousset/tuxayo on 2024-05-24 16:37:10 UTC

(hide)

Description:

Filename:

MIME Type:

Creator: Victor Grousset/tuxayo

Created: 2024-05-24 16:37:10 UTC

Size: 7.09 KB

patch

obsolete

>From 3ad2bac750002ff6c2975413fa32f6823f200976 Mon Sep 17 00:00:00 2001
>From: Matthias Meusburger <matthias.meusburger@biblibre.com>
>Date: Wed, 20 Mar 2024 10:32:51 +0000
>Subject: [PATCH] Bug 35659: (follow-up) Make OAI repositories edition comply
> with CSRF
>
>Signed-off-by: Julian Maurice <julian.maurice@biblibre.com>
>Signed-off-by: Pedro Amorim <pedro.amorim@ptfs-europe.com>
>---
> admin/oaiservers.pl                              | 14 +++++++-------
> .../prog/en/includes/oai-admin-search.inc        |  8 ++++----
> .../prog/en/modules/admin/oaiservers.tt          | 16 ++++++++++++++--
> 3 files changed, 25 insertions(+), 13 deletions(-)
>
>diff --git a/admin/oaiservers.pl b/admin/oaiservers.pl
>index cdbe26dcb3..b9dc686b7c 100755
>--- a/admin/oaiservers.pl
>+++ b/admin/oaiservers.pl
>@@ -23,7 +23,7 @@
> use Modern::Perl;
> use CGI qw ( -utf8 );
> use C4::Context;
>-use C4::Auth qw( get_template_and_user );
>+use C4::Auth   qw( get_template_and_user );
> use C4::Output qw( output_html_with_http_headers );
> use Koha::Database;
> use Koha::OaiServers;
>@@ -31,8 +31,8 @@ use Koha::OaiServers;
> # Initialize CGI, template, database
> 
> my $input       = CGI->new;
>-my $op          = $input->param('op') || 'list';
>-my $id          = $input->param('id') || 0;
>+my $op          = $input->param('op')   || 'list';
>+my $id          = $input->param('id')   || 0;
> my $type        = $input->param('type') || '';
> my $searchfield = '';
> 
>@@ -54,7 +54,7 @@ my $schema = Koha::Database->new()->schema();
> # Main code
> # First process a confirmed delete, or save a validated record
> 
>-if ( $op eq 'delete_confirmed' && $id ) {
>+if ( $op eq 'cud-delete_confirmed' && $id ) {
>     my $server = Koha::OaiServers->find($id);
>     if ($server) {
>         $server->delete;
>@@ -63,7 +63,7 @@ if ( $op eq 'delete_confirmed' && $id ) {
>         $template->param( msg_notfound => 1, msg_add => $id );
>     }
>     $id = 0;
>-} elsif ( $op eq 'add_validated' ) {
>+} elsif ( $op eq 'cud-add_validated' ) {
>     my @fields = qw/endpoint oai_set dataformat
>         recordtype servername
>         add_xslt/;
>@@ -81,7 +81,7 @@ if ( $op eq 'delete_confirmed' && $id ) {
>         Koha::OaiServer->new($formdata)->store;
>         $template->param( msg_added => 1, msg_add => $formdata->{servername} );
>     }
>-} else {
>+} elsif ( $op eq 'search' ) {
> 
>     #use searchfield only in remaining operations
>     $searchfield = $input->param('searchfield') || '';
>@@ -92,7 +92,7 @@ if ( $op eq 'delete_confirmed' && $id ) {
> my $data = [];
> if ( $op eq 'add' || $op eq 'edit' ) {
>     $data = ServerSearch( $schema, $id, $searchfield ) if $searchfield || $id;
>-    delete $data->[0]->{id} if @$data && $op eq 'add';    #cloning record
>+    delete $data->[0]->{id}                            if @$data && $op eq 'add';    #cloning record
>     $template->param(
>         add_form => 1, server => @$data ? $data->[0] : undef,
>         op => $op, type => $op eq 'add' ? lc $type : ''
>diff --git a/koha-tmpl/intranet-tmpl/prog/en/includes/oai-admin-search.inc b/koha-tmpl/intranet-tmpl/prog/en/includes/oai-admin-search.inc
>index 49feedd580..5f7a97c71f 100644
>--- a/koha-tmpl/intranet-tmpl/prog/en/includes/oai-admin-search.inc
>+++ b/koha-tmpl/intranet-tmpl/prog/en/includes/oai-admin-search.inc
>@@ -3,16 +3,16 @@
> <div id="header_search" role="tablist">
>     <div class="tab-content">
>         <div id="oai_search" role="tabpanel" class="tab-pane active">
>-            <form action="/cgi-bin/koha/admin/oaiservers.pl" method="post">
>+            <form action="/cgi-bin/koha/admin/oaiservers.pl" method="get">
>                 <div class="form-title">
>-                    <label class="control-label">Search OAI repositories</label>
>+                    <label class="control-label" for="searchfield">Search OAI repositories</label>
>                 </div>
> 
>                 <div class="form-content">
>                     <input class="head-searchbox form-control" type="text" name="searchfield" id="searchfield" value="[% searchfield | html %]" placeholder="OAI repository search" />
>                 </div>
>-
>-                <button type="submit"><i class="fa fa-arrow-right"></i></button>
>+                <input type="hidden" name="op" value="search" />
>+                <button type="submit" aria-label="Search"><i class="fa fa-arrow-right"></i></button>
>             </form>
>         </div>
> 
>diff --git a/koha-tmpl/intranet-tmpl/prog/en/modules/admin/oaiservers.tt b/koha-tmpl/intranet-tmpl/prog/en/modules/admin/oaiservers.tt
>index 7f95726ab9..eee0c85d80 100644
>--- a/koha-tmpl/intranet-tmpl/prog/en/modules/admin/oaiservers.tt
>+++ b/koha-tmpl/intranet-tmpl/prog/en/modules/admin/oaiservers.tt
>@@ -67,13 +67,15 @@
> 
> [% IF ( add_form ) %]
>     <form action="[% script_name | html %]" name="Aform" method="post" id="serverentry">
>-        <input type="hidden" name="op" value="add_validated" />
>+        [% INCLUDE 'csrf-token.inc' %]
>         [% IF op == 'edit' %]
>             <h1>Modify OAI repository</h1>
>             <input type="hidden" name="id" value="[% server.id | html %]" />
>         [% ELSE %]
>             <h1>New OAI repository</h1>
>         [% END %]
>+
>+        <input type="hidden" name="op" value="cud-add_validated" />
>         <fieldset class="rows">
>         <ol>
>         <li><label for="name" class="required">Repository name: </label>
>@@ -153,7 +155,15 @@
>                     <ul class="dropdown-menu pull-right" role="menu" aria-labelledby="reportactions[% savedreport.id | html %]">
>                         <li><a href="/cgi-bin/koha/admin/oaiservers.pl?op=edit&amp;id=[% loo.id | uri %]"><i class="fa-solid fa-pencil" aria-hidden="true"></i> Edit</a></li>
>                         <li><a href="/cgi-bin/koha/admin/oaiservers.pl?op=add&amp;id=[% loo.id | uri %]"><i class="fa fa-copy"></i> Copy</a></li>
>-                        <li><a href="/cgi-bin/koha/admin/oaiservers.pl?op=delete_confirmed&amp;id=[% loo.id | uri %]" class="delete" data-servername="[% loo.servername | html %]"><i class="fa fa-trash-can"></i> Delete</a></li>
>+                        <li>
>+                            <a href="#" class="delete" data-formid="server_row_[% loo.id | uri %]" data-servername="[% loo.servername | html %]"><i class="fa fa-trash-can"></i> Delete</a>
>+                            <form id="server_row_[% loo.id | uri %]" action="/cgi-bin/koha/admin/oaiservers.pl" method="post">
>+                                [% INCLUDE 'csrf-token.inc' %]
>+                                <input type="hidden" name="op" value="cud-delete_confirmed">
>+                                <input type="hidden" name="id" value="[% loo.id | uri %]">
>+                            </form>
>+                        </li>
>+
>                     </ul>
>                 </div>
>             </td>
>@@ -216,7 +226,9 @@
>                 }));
>                 $(".delete").on("click",function(e){
>                     var servername = $(this).data("servername");
>+                    let formid = $(this).data("formid");
>                     if( confirm( _("Are you sure you want to delete repository %s?").format(servername) ) ) {
>+                        $('#'+formid).submit();
>                         return true;
>                     } else {
>                         e.preventDefault();
>-- 
>2.45.1

Actions: View | Diff | Splinter Review

Attachments on bug 35659: 160356 | 160357 | 160744 | 161813 | 161960 | 162004 | 162005 | 162006 | 162007 | 162008 | 162009 | 162010 | 162011 | 162527 | 162528 | 162692 | 162693 | 162694 | 163527 | 164586 | 164590 | 164602 | 164603 | 164604 | 164605 | 164606 | 164618 | 164619 | 164620 | 164621 | 164622 | 165199 | 165594 | 165595 | 165596 | 165597 | 165598 | 167106 | 167107 | 167171 | 167172 | 167173 | 167174 | 167175 | 167176 | 168982 | 168983 | 169941 | 171255 | 171258 | 171260 | 171264 | 171265 | 171267 | 171675 | 171676 | 171678 | 171679 | 172072 | 172073 | 172074 | 172075 | 172076 | 172077 | 172078 | 172079 | 172080 | 172081 | 172082 | 172083 | 172202 | 172203 | 172204 | 172205 | 172206 | 172207 | 172208 | 172209 | 172210 | 172211 | 172212 | 172213 | 173088 | 173089 | 173090 | 173091 | 173092 | 173093 | 173094 | 173095 | 173096 | 173097 | 173098 | 173099 | 173100 | 173101 | 173561 | 173599 | 173600 | 173601 | 173614 | 174790