Attachment 68043 Details for Bug 19117 – Bug 19117: Add CSRF protection to paycollect.pl

[patch] Bug 19117: Add CSRF protection to paycollect.pl

Bug-19117-Add-CSRF-protection-to-paycollectpl.patch (text/plain), 3.74 KB, created by Marcel de Rooy on 2017-10-13 05:45:42 UTC

(hide)

Description:

Filename:

MIME Type:

Creator: Marcel de Rooy

Created: 2017-10-13 05:45:42 UTC

Size: 3.74 KB

patch

obsolete

>From 135a3011ce7e25d9f6c9a2e4aa9d8bfcbf1c80e9 Mon Sep 17 00:00:00 2001
>From: Jonathan Druart <jonathan.druart@bugs.koha-community.org>
>Date: Wed, 4 Oct 2017 17:49:51 -0300
>Subject: [PATCH] Bug 19117: Add CSRF protection to paycollect.pl
>Content-Type: text/plain; charset=utf-8
>
>Security bug, trivial changes, no need to provide procedure for script
>kiddies.
>
>Test plan:
>Pay fines using the different options from the "Pay fines" tab.
>
>Signed-off-by: Katrin Fischer <katrin.fischer.83@web.de>
>
>Signed-off-by: Marcel de Rooy <m.de.rooy@rijksmuseum.nl>
>---
> koha-tmpl/intranet-tmpl/prog/en/modules/members/paycollect.tt | 3 +++
> members/paycollect.pl                                         | 9 +++++++++
> 2 files changed, 12 insertions(+)
>
>diff --git a/koha-tmpl/intranet-tmpl/prog/en/modules/members/paycollect.tt b/koha-tmpl/intranet-tmpl/prog/en/modules/members/paycollect.tt
>index a1458b5..12b2c4b 100644
>--- a/koha-tmpl/intranet-tmpl/prog/en/modules/members/paycollect.tt
>+++ b/koha-tmpl/intranet-tmpl/prog/en/modules/members/paycollect.tt
>@@ -101,6 +101,7 @@ function moneyFormat(textObj) {
> 
> [% IF ( pay_individual ) %]
>     <form name="payindivfine" id="payindivfine" method="post" action="/cgi-bin/koha/members/paycollect.pl">
>+    <input type="hidden" name="csrf_token" value="[% csrf_token %]" />
>     <input type="hidden" name="borrowernumber" id="borrowernumber" value="[% borrower.borrowernumber %]" />
>     <input type="hidden" name="pay_individual" id="pay_individual" value="[% pay_individual %]" />
>     <input type="hidden" name="itemnumber" id="itemnumber" value="[% itemnumber %]" />
>@@ -155,6 +156,7 @@ function moneyFormat(textObj) {
>     </form>
> [% ELSIF ( writeoff_individual ) %]
>     <form name="woindivfine" id="woindivfine" action="/cgi-bin/koha/members/pay.pl" method="post" >
>+    <input type="hidden" name="csrf_token" value="[% csrf_token %]" />
>     <fieldset class="rows">
>     <legend>Write off an individual fine</legend>
>     <input type="hidden" name="borrowernumber" id="borrowernumber" value="[% borrower.borrowernumber %]" />
>@@ -195,6 +197,7 @@ function moneyFormat(textObj) {
> [% ELSE %]
> 
>     <form name="payfine" id="payfine" method="post" action="/cgi-bin/koha/members/paycollect.pl">
>+    <input type="hidden" name="csrf_token" value="[% csrf_token %]" />
>     <input type="hidden" name="borrowernumber" id="borrowernumber" value="[% borrower.borrowernumber %]" />
>     <input type="hidden" name="selected_accts" id="selected_accts" value="[% selected_accts %]" />
>     <input type="hidden" name="total" id="total" value="[% total %]" />
>diff --git a/members/paycollect.pl b/members/paycollect.pl
>index f880f57..9ec3077 100755
>--- a/members/paycollect.pl
>+++ b/members/paycollect.pl
>@@ -31,6 +31,7 @@ use C4::Koha;
> use Koha::Patron::Images;
> use Koha::Patrons;
> use Koha::Account;
>+use Koha::Token;
> 
> use Koha::Patron::Categories;
> 
>@@ -116,6 +117,12 @@ if ( $total_paid and $total_paid ne '0.00' ) {
>             total_due => $total_due
>         );
>     } else {
>+        die "Wrong CSRF token"
>+            unless Koha::Token->new->check_csrf( {
>+                session_id => $input->cookie('CGISESSID'),
>+                token  => scalar $input->param('csrf_token'),
>+            });
>+
>         if ($individual) {
>             my $line = Koha::Account::Lines->find($accountlines_id);
>             Koha::Account->new( { patron_id => $borrowernumber } )->pay(
>@@ -183,6 +190,8 @@ $template->param(
>     total         => $total_due,
>     RoutingSerials => C4::Context->preference('RoutingSerials'),
>     ExtendedPatronAttributes => C4::Context->preference('ExtendedPatronAttributes'),
>+
>+    csrf_token => Koha::Token->new->generate_csrf({ session_id => scalar $input->cookie('CGISESSID') }),
> );
> 
> output_html_with_http_headers $input, $cookie, $template->output;
>-- 
>2.1.4

Actions: View | Diff | Splinter Review

Attachments on bug 19117: 66027 | 67616 | 67800 | 68043