Attachment 90204 Details for Bug 22990 – Bug 22990: Introduce a new param "check" to check csrf token.

[patch] Bug 22990: Introduce a new param "check" to check csrf token.

0001-Bug-22990-Introduce-a-new-param-check-to-check-csrf-.patch (text/plain), 1.83 KB, created by Amit Gupta on 2019-05-30 15:30:16 UTC

(hide)

Description:

Filename:

MIME Type:

Creator: Amit Gupta

Created: 2019-05-30 15:30:16 UTC

Size: 1.83 KB

patch

obsolete

>From 21d74e239d9660d01b632e5c821167f24522b06a Mon Sep 17 00:00:00 2001
>From: Amit Gupta <amit.gupta@informaticsglobal.com>
>Date: Thu, 30 May 2019 20:57:57 +0530
>Subject: [PATCH] Bug 22990: Introduce a new param "check" to check csrf token.
>
>---
> C4/Output.pm          | 9 ++++-----
> acqui/basketheader.pl | 4 ++--
> 2 files changed, 6 insertions(+), 7 deletions(-)
>
>diff --git a/C4/Output.pm b/C4/Output.pm
>index 7193ee3..10a7d1c 100644
>--- a/C4/Output.pm
>+++ b/C4/Output.pm
>@@ -340,16 +340,15 @@ sub output_and_exit_if_error {
>             {
>                 $error = 'cannot_see_patron_infos';
>             }
>-        }
>-        elsif ( $params->{module} eq 'CSRF_TOKEN_CHECK' ) {
>+        }        
>+    } elsif ( $params->{check} eq 'CSRF_TOKEN_CHECK' ) {
>             $error = 'wrong_csrf_token'
>-              unless Koha::Token->new->check_csrf(
>+            unless Koha::Token->new->check_csrf(
>                 {
>                     session_id => scalar $query->cookie('CGISESSID'),
>                     token      => scalar $query->param('csrf_token'),
>                 }
>-              );
>-        }
>+            );
>     }
>     output_and_exit( $query, $cookie, $template, $error ) if $error;
>     return;
>diff --git a/acqui/basketheader.pl b/acqui/basketheader.pl
>index 2cb3584..39270ae 100755
>--- a/acqui/basketheader.pl
>+++ b/acqui/basketheader.pl
>@@ -142,8 +142,8 @@ if ( $op eq 'add_form' ) {
> #End Edit
> } elsif ( $op eq 'add_validate' ) {
> #we are confirming the changes, save the basket
>-#we are checking CSRF Token. Module CSRF_TOKEN_CHECK indicate for CSRF token checking,
>-    output_and_exit_if_error($input, $cookie, $template, { module => 'CSRF_TOKEN_CHECK' });
>+#we are checking CSRF Token.
>+    output_and_exit_if_error($input, $cookie, $template, { check => 'CSRF_TOKEN_CHECK' });
> 
>     if ( $is_an_edit ) {
>         ModBasketHeader(
>-- 
>2.7.4
>

Actions: View | Diff | Splinter Review

Attachments on bug 22990: 90102 | 90192 | 90194 | 90202 | 90204 | 90209 | 90238 | 90239 | 90240 | 95381 | 95382 | 95383 | 95384 | 95385 | 95391 | 95392 | 95393 | 95394 | 95395 | 95396 | 97814 | 122010 | 122011 | 122012 | 122013 | 122014 | 122015 | 122016 | 122023 | 122024 | 122025 | 122026 | 122027 | 122028 | 122029 | 122030 | 122031 | 122046 | 124924 | 124925 | 124926 | 124927 | 124928 | 124929 | 124930 | 124931 | 124932 | 124933 | 124934 | 126091 | 126092 | 126093 | 126094 | 126095 | 126096 | 126097 | 126098 | 126099 | 126100 | 126101 | 133238 | 133239 | 133240 | 133241 | 133242 | 133243 | 133244 | 133245 | 133246 | 133247 | 133248 | 133254 | 133255 | 133256 | 133257 | 133258 | 133422 | 133423 | 133424 | 133425 | 133426 | 133427 | 134848 | 134849 | 134850 | 134851 | 134852 | 134853 | 134854 | 141294 | 141295 | 141296 | 144315 | 144316 | 144317 | 144318 | 144319 | 144320 | 144321 | 144322 | 152626 | 152627 | 152628 | 153394 | 153751 | 153753 | 154044