Attachment 54708 Details for Bug 17109 – Bug 17109: [QA Follow-up] Die when wrong token

[patch] Bug 17109: [QA Follow-up] Die when wrong token

Bug-17109-QA-Follow-up-Die-when-wrong-token.patch (text/plain), 4.17 KB, created by Jonathan Druart on 2016-08-22 14:15:55 UTC

(hide)

Description:

Filename:

MIME Type:

Creator: Jonathan Druart

Created: 2016-08-22 14:15:55 UTC

Size: 4.17 KB

patch

obsolete

>From 64e6659ff5536a05746339fa3c9287da20a1cb13 Mon Sep 17 00:00:00 2001
>From: Marcel de Rooy <m.de.rooy@rijksmuseum.nl>
>Date: Tue, 16 Aug 2016 14:20:36 +0200
>Subject: [PATCH] Bug 17109: [QA Follow-up] Die when wrong token
>
>Removes template var csrf_error and associated handling.
>
>Signed-off-by: Marcel de Rooy <m.de.rooy@rijksmuseum.nl>
>Restested with opac and intranet: Still sends or dies elegantly..
>
>Signed-off-by: Jonathan Druart <jonathan.druart@bugs.koha-community.org>
>---
> basket/sendbasket.pl | 9 +--------
> koha-tmpl/intranet-tmpl/prog/en/modules/basket/sendbasketform.tt | 4 ----
> koha-tmpl/opac-tmpl/bootstrap/en/modules/opac-sendbasketform.tt | 4 ----
> opac/opac-sendbasket.pl | 9 +--------
> 4 files changed, 2 insertions(+), 24 deletions(-)
>
>diff --git a/basket/sendbasket.pl b/basket/sendbasket.pl
>index f54caba..040ae09 100755
>--- a/basket/sendbasket.pl
>+++ b/basket/sendbasket.pl
>@@ -50,19 +50,12 @@ my $email_add = $query->param('email_add');
> 
> my $dbh = C4::Context->dbh;
> 
>-my $csrf_err;
> if ( $email_add ) {
>- $csrf_err = 1 unless Koha::Token->new->check_csrf({
>+ die "Wrong CSRF token" unless Koha::Token->new->check_csrf({
> id => C4::Context->userenv->{id},
> secret => md5_base64( C4::Context->config('pass') ),
> token => scalar $query->param('csrf_token'),
> });
>-}
>-
>-if( $csrf_err ) {
>- $template->param( csrf_error => 1, email_add => 1 );
>- output_html_with_http_headers $query, $cookie, $template->output;
>-} elsif ( $email_add ) {
> my $email = Koha::Email->new();
> my %mail = $email->create_message_headers({ to => $email_add });
> my $comment = $query->param('comment');
>diff --git a/koha-tmpl/intranet-tmpl/prog/en/modules/basket/sendbasketform.tt b/koha-tmpl/intranet-tmpl/prog/en/modules/basket/sendbasketform.tt
>index 07d004d..b78a650 100644
>--- a/koha-tmpl/intranet-tmpl/prog/en/modules/basket/sendbasketform.tt
>+++ b/koha-tmpl/intranet-tmpl/prog/en/modules/basket/sendbasketform.tt
>@@ -10,10 +10,6 @@
> The cart was sent to: [% email_add |html %]
> 		<a class="focus close" href="#">Close window</a>
> 	[% END %]
>- [% IF csrf_error %]
>- No valid CSRF token!
>- <a class="focus close" href="#">Close window</a>
>- [% END %]
> 	[% IF ( error ) %]
> 	Problem sending the cart...
> 	[% END %]
>diff --git a/koha-tmpl/opac-tmpl/bootstrap/en/modules/opac-sendbasketform.tt b/koha-tmpl/opac-tmpl/bootstrap/en/modules/opac-sendbasketform.tt
>index e1f8f60..fed5013 100644
>--- a/koha-tmpl/opac-tmpl/bootstrap/en/modules/opac-sendbasketform.tt
>+++ b/koha-tmpl/opac-tmpl/bootstrap/en/modules/opac-sendbasketform.tt
>@@ -19,10 +19,6 @@
> <a class="focus close" href="#">Close window</a>
> [% END %]
> 
>- [% IF csrf_error %]
>- No valid CSRF token!
>- <a class="focus close" href="#">Close window</a>
>- [% END %]
> [% IF ( error ) %]
> <div class="alert">
> There was an error sending the cart.
>diff --git a/opac/opac-sendbasket.pl b/opac/opac-sendbasket.pl
>index 6b9ba43..77fc370 100755
>--- a/opac/opac-sendbasket.pl
>+++ b/opac/opac-sendbasket.pl
>@@ -52,19 +52,12 @@ my $email_add = $query->param('email_add');
> 
> my $dbh = C4::Context->dbh;
> 
>-my $csrf_err;
> if ( $email_add ) {
>- $csrf_err = 1 unless Koha::Token->new->check_csrf({
>+ die "Wrong CSRF token" unless Koha::Token->new->check_csrf({
> id => C4::Context->userenv->{id},
> secret => md5_base64( C4::Context->config('pass') ),
> token => scalar $query->param('csrf_token'),
> });
>-}
>-
>-if( $csrf_err ) {
>- $template->param( csrf_error => 1, email_add => 1 );
>- output_html_with_http_headers $query, $cookie, $template->output;
>-} elsif ( $email_add ) {
> my $email = Koha::Email->new();
> my $user = GetMember(borrowernumber => $borrowernumber);
> my $user_email = GetFirstValidEmailAddress($borrowernumber)
>-- 
>2.8.1

Actions: View | Diff | Splinter Review

Attachments on bug 17109: 54309 | 54310 | 54325 | 54470 | 54471 | 54472 | 54503 | 54705 | 54706 | 54707 | 54708