Bugzilla – Attachment 191672 Details for
Bug 41662
CSRF-vulnerability in opac-patron-consent.pl.
Home
|
New
|
Browse
|
Search
|
[?]
|
Reports
|
Help
|
New Account
|
Log In
[x]
|
Forgot Password
Login:
[x]
[patch]
Bug 41662: Prevent CSRF on opac-patron-consent.pl
Bug-41662-Prevent-CSRF-on-opac-patron-consentpl.patch (text/plain), 2.83 KB, created by
Marcel de Rooy
on 2026-01-20 12:19:31 UTC
(
hide
)
Description:
Bug 41662: Prevent CSRF on opac-patron-consent.pl
Filename:
MIME Type:
Creator:
Marcel de Rooy
Created:
2026-01-20 12:19:31 UTC
Size:
2.83 KB
patch
obsolete
>From 99bd8fe9aac12404f85fb5bb6cf37d5f16b06b1e Mon Sep 17 00:00:00 2001 >From: David Cook <dcook@prosentient.com.au> >Date: Mon, 19 Jan 2026 23:29:01 +0000 >Subject: [PATCH] Bug 41662: Prevent CSRF on opac-patron-consent.pl >Content-Type: text/plain; charset=utf-8 > >This change prevents CSRF on opac-patron-consent.pl by >adding checking of the "op". > >Test plan: >0. Apply the patch and koha-plack --restart kohadev >1. Set system preference PrivacyPolicyConsent to "permissive" >2. Log into the OPAC and go to this path: >/cgi-bin/koha/opac-patron-consent.pl?check_GDPR_PROCESSING=1 >3. Note that it doesn't change the consent >4. Go to this path: >/cgi-bin/koha/opac-patron-consent.pl?check_GDPR_PROCESSING=0 >5. Note that it doesn't change the consent >6. Click the "Yes" radio button and click "Save" >7. Note it changes the consent to Yes >8. Click the "No" radio button and click "Save" >9. Note it changes the consent to No > >Signed-off-by: Marcel de Rooy <m.de.rooy@rijksmuseum.nl> >--- > opac/opac-patron-consent.pl | 35 +++++++++++++++++++---------------- > 1 file changed, 19 insertions(+), 16 deletions(-) > >diff --git a/opac/opac-patron-consent.pl b/opac/opac-patron-consent.pl >index a6cd3421f3..ea26cbc168 100755 >--- a/opac/opac-patron-consent.pl >+++ b/opac/opac-patron-consent.pl >@@ -48,24 +48,27 @@ foreach my $consent_type ( sort keys %$consent_types ) { > push @consents, $patron->consent($consent_type); > } > >-# Handle saves here > my $needs_redirect; >-foreach my $consent (@consents) { >- my $check = $vars->{ "check_" . $consent->type }; >- next if !defined($check); # no choice made >- $needs_redirect = 1 >- if $consent->type eq q/GDPR_PROCESSING/ >- && !$check >- && C4::Context->preference('PrivacyPolicyConsent') eq 'Enforced'; >- next if $consent->given_on && $check || $consent->refused_on && !$check; > >- # No update if no consent change >- $consent->set( >- { >- given_on => $check ? dt_from_string() : undef, >- refused_on => $check ? undef : dt_from_string(), >- } >- )->store; >+# Handle saves here >+if ( $op && $op eq 'cud-save' ) { >+ foreach my $consent (@consents) { >+ my $check = $vars->{ "check_" . $consent->type }; >+ next if !defined($check); # no choice made >+ $needs_redirect = 1 >+ if $consent->type eq q/GDPR_PROCESSING/ >+ && !$check >+ && C4::Context->preference('PrivacyPolicyConsent') eq 'Enforced'; >+ next if $consent->given_on && $check || $consent->refused_on && !$check; >+ >+ # No update if no consent change >+ $consent->set( >+ { >+ given_on => $check ? dt_from_string() : undef, >+ refused_on => $check ? undef : dt_from_string(), >+ } >+ )->store; >+ } > } > > # If user refused GDPR consent and we enforce GDPR, logout (when saving) >-- >2.39.5
You cannot view the attachment while viewing its details because your browser does not support IFRAMEs.
View the attachment on a separate page
.
View Attachment As Diff
View Attachment As Raw
Actions:
View
|
Diff
|
Splinter Review
Attachments on
bug 41662
:
191658
| 191672