Bugzilla – Attachment 167173 Details for
Bug 35659
OAI Harvester
Home
|
New
|
Browse
|
Search
|
[?]
|
Reports
|
Help
|
New Account
|
Log In
[x]
|
Forgot Password
Login:
[x]
[patch]
Bug 35659: (follow-up) Make OAI repositories edition comply with CSRF
Bug-35659-follow-up-Make-OAI-repositories-edition-.patch (text/plain), 7.09 KB, created by
Victor Grousset/tuxayo
on 2024-05-24 16:37:10 UTC
(
hide
)
Description:
Bug 35659: (follow-up) Make OAI repositories edition comply with CSRF
Filename:
MIME Type:
Creator:
Victor Grousset/tuxayo
Created:
2024-05-24 16:37:10 UTC
Size:
7.09 KB
patch
obsolete
>From 3ad2bac750002ff6c2975413fa32f6823f200976 Mon Sep 17 00:00:00 2001 >From: Matthias Meusburger <matthias.meusburger@biblibre.com> >Date: Wed, 20 Mar 2024 10:32:51 +0000 >Subject: [PATCH] Bug 35659: (follow-up) Make OAI repositories edition comply > with CSRF > >Signed-off-by: Julian Maurice <julian.maurice@biblibre.com> >Signed-off-by: Pedro Amorim <pedro.amorim@ptfs-europe.com> >--- > admin/oaiservers.pl | 14 +++++++------- > .../prog/en/includes/oai-admin-search.inc | 8 ++++---- > .../prog/en/modules/admin/oaiservers.tt | 16 ++++++++++++++-- > 3 files changed, 25 insertions(+), 13 deletions(-) > >diff --git a/admin/oaiservers.pl b/admin/oaiservers.pl >index cdbe26dcb3..b9dc686b7c 100755 >--- a/admin/oaiservers.pl >+++ b/admin/oaiservers.pl >@@ -23,7 +23,7 @@ > use Modern::Perl; > use CGI qw ( -utf8 ); > use C4::Context; >-use C4::Auth qw( get_template_and_user ); >+use C4::Auth qw( get_template_and_user ); > use C4::Output qw( output_html_with_http_headers ); > use Koha::Database; > use Koha::OaiServers; >@@ -31,8 +31,8 @@ use Koha::OaiServers; > # Initialize CGI, template, database > > my $input = CGI->new; >-my $op = $input->param('op') || 'list'; >-my $id = $input->param('id') || 0; >+my $op = $input->param('op') || 'list'; >+my $id = $input->param('id') || 0; > my $type = $input->param('type') || ''; > my $searchfield = ''; > >@@ -54,7 +54,7 @@ my $schema = Koha::Database->new()->schema(); > # Main code > # First process a confirmed delete, or save a validated record > >-if ( $op eq 'delete_confirmed' && $id ) { >+if ( $op eq 'cud-delete_confirmed' && $id ) { > my $server = Koha::OaiServers->find($id); > if ($server) { > $server->delete; >@@ -63,7 +63,7 @@ if ( $op eq 'delete_confirmed' && $id ) { > $template->param( msg_notfound => 1, msg_add => $id ); > } > $id = 0; >-} elsif ( $op eq 'add_validated' ) { >+} elsif ( $op eq 'cud-add_validated' ) { > my @fields = qw/endpoint oai_set dataformat > recordtype servername > add_xslt/; >@@ -81,7 +81,7 @@ if ( $op eq 'delete_confirmed' && $id ) { > Koha::OaiServer->new($formdata)->store; > $template->param( msg_added => 1, msg_add => $formdata->{servername} ); > } >-} else { >+} elsif ( $op eq 'search' ) { > > #use searchfield only in remaining operations > $searchfield = $input->param('searchfield') || ''; >@@ -92,7 +92,7 @@ if ( $op eq 'delete_confirmed' && $id ) { > my $data = []; > if ( $op eq 'add' || $op eq 'edit' ) { > $data = ServerSearch( $schema, $id, $searchfield ) if $searchfield || $id; >- delete $data->[0]->{id} if @$data && $op eq 'add'; #cloning record >+ delete $data->[0]->{id} if @$data && $op eq 'add'; #cloning record > $template->param( > add_form => 1, server => @$data ? $data->[0] : undef, > op => $op, type => $op eq 'add' ? lc $type : '' >diff --git a/koha-tmpl/intranet-tmpl/prog/en/includes/oai-admin-search.inc b/koha-tmpl/intranet-tmpl/prog/en/includes/oai-admin-search.inc >index 49feedd580..5f7a97c71f 100644 >--- a/koha-tmpl/intranet-tmpl/prog/en/includes/oai-admin-search.inc >+++ b/koha-tmpl/intranet-tmpl/prog/en/includes/oai-admin-search.inc >@@ -3,16 +3,16 @@ > <div id="header_search" role="tablist"> > <div class="tab-content"> > <div id="oai_search" role="tabpanel" class="tab-pane active"> >- <form action="/cgi-bin/koha/admin/oaiservers.pl" method="post"> >+ <form action="/cgi-bin/koha/admin/oaiservers.pl" method="get"> > <div class="form-title"> >- <label class="control-label">Search OAI repositories</label> >+ <label class="control-label" for="searchfield">Search OAI repositories</label> > </div> > > <div class="form-content"> > <input class="head-searchbox form-control" type="text" name="searchfield" id="searchfield" value="[% searchfield | html %]" placeholder="OAI repository search" /> > </div> >- >- <button type="submit"><i class="fa fa-arrow-right"></i></button> >+ <input type="hidden" name="op" value="search" /> >+ <button type="submit" aria-label="Search"><i class="fa fa-arrow-right"></i></button> > </form> > </div> > >diff --git a/koha-tmpl/intranet-tmpl/prog/en/modules/admin/oaiservers.tt b/koha-tmpl/intranet-tmpl/prog/en/modules/admin/oaiservers.tt >index 7f95726ab9..eee0c85d80 100644 >--- a/koha-tmpl/intranet-tmpl/prog/en/modules/admin/oaiservers.tt >+++ b/koha-tmpl/intranet-tmpl/prog/en/modules/admin/oaiservers.tt >@@ -67,13 +67,15 @@ > > [% IF ( add_form ) %] > <form action="[% script_name | html %]" name="Aform" method="post" id="serverentry"> >- <input type="hidden" name="op" value="add_validated" /> >+ [% INCLUDE 'csrf-token.inc' %] > [% IF op == 'edit' %] > <h1>Modify OAI repository</h1> > <input type="hidden" name="id" value="[% server.id | html %]" /> > [% ELSE %] > <h1>New OAI repository</h1> > [% END %] >+ >+ <input type="hidden" name="op" value="cud-add_validated" /> > <fieldset class="rows"> > <ol> > <li><label for="name" class="required">Repository name: </label> >@@ -153,7 +155,15 @@ > <ul class="dropdown-menu pull-right" role="menu" aria-labelledby="reportactions[% savedreport.id | html %]"> > <li><a href="/cgi-bin/koha/admin/oaiservers.pl?op=edit&id=[% loo.id | uri %]"><i class="fa-solid fa-pencil" aria-hidden="true"></i> Edit</a></li> > <li><a href="/cgi-bin/koha/admin/oaiservers.pl?op=add&id=[% loo.id | uri %]"><i class="fa fa-copy"></i> Copy</a></li> >- <li><a href="/cgi-bin/koha/admin/oaiservers.pl?op=delete_confirmed&id=[% loo.id | uri %]" class="delete" data-servername="[% loo.servername | html %]"><i class="fa fa-trash-can"></i> Delete</a></li> >+ <li> >+ <a href="#" class="delete" data-formid="server_row_[% loo.id | uri %]" data-servername="[% loo.servername | html %]"><i class="fa fa-trash-can"></i> Delete</a> >+ <form id="server_row_[% loo.id | uri %]" action="/cgi-bin/koha/admin/oaiservers.pl" method="post"> >+ [% INCLUDE 'csrf-token.inc' %] >+ <input type="hidden" name="op" value="cud-delete_confirmed"> >+ <input type="hidden" name="id" value="[% loo.id | uri %]"> >+ </form> >+ </li> >+ > </ul> > </div> > </td> >@@ -216,7 +226,9 @@ > })); > $(".delete").on("click",function(e){ > var servername = $(this).data("servername"); >+ let formid = $(this).data("formid"); > if( confirm( _("Are you sure you want to delete repository %s?").format(servername) ) ) { >+ $('#'+formid).submit(); > return true; > } else { > e.preventDefault(); >-- >2.45.1
You cannot view the attachment while viewing its details because your browser does not support IFRAMEs.
View the attachment on a separate page
.
View Attachment As Diff
View Attachment As Raw
Actions:
View
|
Diff
|
Splinter Review
Attachments on
bug 35659
:
160356
|
160357
|
160744
|
161813
|
161960
|
162004
|
162005
|
162006
|
162007
|
162008
|
162009
|
162010
|
162011
|
162527
|
162528
|
162692
|
162693
|
162694
|
163527
|
164586
|
164590
|
164602
|
164603
|
164604
|
164605
|
164606
|
164618
|
164619
|
164620
|
164621
|
164622
|
165199
|
165594
|
165595
|
165596
|
165597
|
165598
|
167106
|
167107
|
167171
|
167172
| 167173 |
167174
|
167175
|
167176
|
168982
|
168983
|
169941