Attachment 74482 Details for Bug 20568 – Bug 20568: CSRF protection

[patch] Bug 20568: CSRF protection

Bug-20568-CSRF-protection.patch (text/plain), 7.26 KB, created by Tomás Cohen Arazi (tcohen) on 2018-04-18 18:00:26 UTC

(hide)

Description:

Filename:

MIME Type:

Creator: Tomás Cohen Arazi (tcohen)

Created: 2018-04-18 18:00:26 UTC

Size: 7.26 KB

patch

obsolete

>From 59718bed43d184a460514e011edbd83e9b14ec1c Mon Sep 17 00:00:00 2001
>From: Tomas Cohen Arazi <tomascohen@theke.io>
>Date: Wed, 18 Apr 2018 14:38:02 -0300
>Subject: [PATCH] Bug 20568: CSRF protection
>
>Edit: fix warning introduced by this patch
>
>Signed-off-by: Tomas Cohen Arazi <tomascohen@theke.io>
>---
> .../prog/en/modules/members/apikeys.tt        |  3 +++
> .../bootstrap/en/modules/opac-apikeys.tt      |  3 +++
> members/apikeys.pl                            | 20 ++++++++++++++++---
> opac/opac-apikeys.pl                          | 16 ++++++++++++++-
> 4 files changed, 38 insertions(+), 4 deletions(-)
>
>diff --git a/koha-tmpl/intranet-tmpl/prog/en/modules/members/apikeys.tt b/koha-tmpl/intranet-tmpl/prog/en/modules/members/apikeys.tt
>index 93ef624a51..73ea916080 100644
>--- a/koha-tmpl/intranet-tmpl/prog/en/modules/members/apikeys.tt
>+++ b/koha-tmpl/intranet-tmpl/prog/en/modules/members/apikeys.tt
>@@ -25,6 +25,7 @@
>                 <h1>API keys for [% INCLUDE 'patron-title.inc' %]</h1>
>                 <form id="add-api-key" action="/cgi-bin/koha/members/apikeys.pl" method="post" style="display:none">
>                     <input type="hidden" name="patron_id" value="[% patron.id %]" />
>+                    <input type="hidden" name="csrf_token" value="[% csrf_token %]" />
>                     <input type="hidden" name="op" value="generate" />
>                     <fieldset class="brief">
>                         <legend>Generate new client id/secret pair</legend>
>@@ -65,12 +66,14 @@
>                                             <form action="/cgi-bin/koha/members/apikeys.pl" method="post">
>                                                 <input type="hidden" name="patron_id" value="[% patron.id %]" />
>                                                 <input type="hidden" name="key" value="[% key.id %]" />
>+                                                <input type="hidden" name="csrf_token" value="[% csrf_token %]" />
>                                                 <input type="hidden" name="op" value="delete" />
>                                                 <button class="btn btn-default btn-xs delete" type="submit"><i class="fa fa-trash"></i> Delete</button>
>                                             </form>
>                                             <form action="/cgi-bin/koha/members/apikeys.pl" method="post">
>                                                 <input type="hidden" name="patron_id" value="[% patron.id %]" />
>                                                 <input type="hidden" name="key" value="[% key.id %]" />
>+                                                <input type="hidden" name="csrf_token" value="[% csrf_token %]" />
>                                                 [% IF key.active %]
>                                                     <input type="hidden" name="op" value="revoke" />
>                                                     <button class="btn btn-default btn-xs" type="submit"><i class="fa fa-remove"></i> Revoke</button>
>diff --git a/koha-tmpl/opac-tmpl/bootstrap/en/modules/opac-apikeys.tt b/koha-tmpl/opac-tmpl/bootstrap/en/modules/opac-apikeys.tt
>index 7aaddf41bd..7d958b74b7 100644
>--- a/koha-tmpl/opac-tmpl/bootstrap/en/modules/opac-apikeys.tt
>+++ b/koha-tmpl/opac-tmpl/bootstrap/en/modules/opac-apikeys.tt
>@@ -35,6 +35,7 @@
>                         <fieldset>
>                             <legend>Generate new client id/secret pair</legend>
>                             <input type="hidden" name="patron_id" value="[% patron.id %]" />
>+                            <input type="hidden" name="csrf_token" value="[% csrf_token %]" />
>                             <input type="hidden" name="op" value="generate" />
>                             <label for="description">Description: </label>
>                             <input type="text" name="description" />
>@@ -64,11 +65,13 @@
>                                         <td>
>                                             <form action="/cgi-bin/koha/opac-apikeys.pl" method="post" class="form-inline">
>                                                 <input type="hidden" name="key" value="[% key.id %]" />
>+                                                <input type="hidden" name="csrf_token" value="[% csrf_token %]" />
>                                                 <input type="hidden" name="op" value="delete" />
>                                                 <button class="btn btn-link btn-xs delete-key" type="submit"><i class="fa fa-trash"></i> Delete</button>
>                                             </form>
>                                             <form action="/cgi-bin/koha/opac-apikeys.pl" method="post" class="form-inline">
>                                                 <input type="hidden" name="key" value="[% key.id %]" />
>+                                                <input type="hidden" name="csrf_token" value="[% csrf_token %]" />
>                                                 [% IF key.active %]
>                                                     <input type="hidden" name="op" value="revoke" />
>                                                     <button class="btn btn-link btn-xs" type="submit"><i class="fa fa-remove"></i> Revoke</button>
>diff --git a/members/apikeys.pl b/members/apikeys.pl
>index fda98ed984..7354fcef66 100755
>--- a/members/apikeys.pl
>+++ b/members/apikeys.pl
>@@ -26,6 +26,7 @@ use C4::Output;
> 
> use Koha::ApiKeys;
> use Koha::Patrons;
>+use Koha::Token;
> 
> my $cgi = new CGI;
> 
>@@ -51,7 +52,19 @@ if ( not defined $patron ) {
>     exit;
> }
> 
>-my $op = $cgi->param('op');
>+my $op = $cgi->param('op') // '';
>+
>+if ( $op eq 'generate' or
>+     $op eq 'delete' or
>+     $op eq 'revoke' or
>+     $op eq 'activate' ) {
>+
>+    die "Wrong CSRF token"
>+    unless Koha::Token->new->check_csrf({
>+        session_id => scalar $cgi->cookie('CGISESSID'),
>+        token      => scalar $cgi->param('csrf_token'),
>+    });
>+}
> 
> if ($op) {
>     if ( $op eq 'generate' ) {
>@@ -102,8 +115,9 @@ if ($op) {
> my @api_keys = Koha::ApiKeys->search({ patron_id => $patron_id });
> 
> $template->param(
>-    api_keys => \@api_keys,
>-    patron   => $patron
>+    api_keys   => \@api_keys,
>+    csrf_token => Koha::Token->new->generate_csrf({ session_id => scalar $cgi->cookie('CGISESSID') }),
>+    patron     => $patron
> );
> 
> output_html_with_http_headers $cgi, $cookie, $template->output;
>diff --git a/opac/opac-apikeys.pl b/opac/opac-apikeys.pl
>index a571c16ffd..021c21b91b 100755
>--- a/opac/opac-apikeys.pl
>+++ b/opac/opac-apikeys.pl
>@@ -26,6 +26,7 @@ use C4::Output;
> 
> use Koha::ApiKeys;
> use Koha::Patrons;
>+use Koha::Token;
> 
> my $cgi = new CGI;
> 
>@@ -47,7 +48,19 @@ if ( not defined $patron
>     exit;
> }
> 
>-my $op = $cgi->param('op');
>+my $op = $cgi->param('op') // '';
>+
>+if ( $op eq 'generate' or
>+     $op eq 'delete' or
>+     $op eq 'revoke' or
>+     $op eq 'activate' ) {
>+
>+    die "Wrong CSRF token"
>+    unless Koha::Token->new->check_csrf({
>+        session_id => scalar $cgi->cookie('CGISESSID'),
>+        token      => scalar $cgi->param('csrf_token'),
>+    });
>+}
> 
> if ($op) {
>     if ($op eq 'generate') {
>@@ -99,6 +112,7 @@ my @api_keys = Koha::ApiKeys->search({ patron_id => $patron_id });
> $template->param(
>     api_keys    => \@api_keys,
>     apikeysview => 1,
>+    csrf_token  => Koha::Token->new->generate_csrf({ session_id => scalar $cgi->cookie('CGISESSID') }),
>     patron      => $patron
> );
> 
>-- 
>2.17.0

Actions: View | Diff | Splinter Review

Attachments on bug 20568: 74179 | 74180 | 74229 | 74230 | 74231 | 74232 | 74233 | 74234 | 74235 | 74236 | 74248 | 74254 | 74255 | 74256 | 74257 | 74258 | 74259 | 74343 | 74344 | 74345 | 74346 | 74347 | 74348 | 74388 | 74389 | 74434 | 74454 | 74476 | 74477 | 74478 | 74479 | 74480 | 74481 | 74482 | 74486 | 74487 | 74488 | 74489 | 74490 | 74491 | 74492 | 74493 | 74494 | 74495 | 74496 | 74980 | 74981 | 75023 | 75186 | 75187 | 75188