Attachment 90238 Details for Bug 22990 – Bug 22990: Introduce a new param "check" to check csrf token.

[patch] Bug 22990: Introduce a new param "check" to check csrf token.

Bug-22990-Introduce-a-new-param-check-to-check-csr.patch (text/plain), 2.01 KB, created by Jonathan Druart on 2019-05-31 17:14:09 UTC

(hide)

Description:

Filename:

MIME Type:

Creator: Jonathan Druart

Created: 2019-05-31 17:14:09 UTC

Size: 2.01 KB

patch

obsolete

>From 040dbadee254f02f7396d80c919f93cc95f91272 Mon Sep 17 00:00:00 2001
>From: Amit Gupta <amit.gupta@informaticsglobal.com>
>Date: Fri, 31 May 2019 08:35:51 +0530
>Subject: [PATCH] Bug 22990: Introduce a new param "check" to check csrf token.
>
>---
> C4/Output.pm          | 18 +++++++++---------
> acqui/basketheader.pl |  4 ++--
> 2 files changed, 11 insertions(+), 11 deletions(-)
>
>diff --git a/C4/Output.pm b/C4/Output.pm
>index 7193ee36cf..d49c8aa0c9 100644
>--- a/C4/Output.pm
>+++ b/C4/Output.pm
>@@ -341,15 +341,15 @@ sub output_and_exit_if_error {
>                 $error = 'cannot_see_patron_infos';
>             }
>         }
>-        elsif ( $params->{module} eq 'CSRF_TOKEN_CHECK' ) {
>-            $error = 'wrong_csrf_token'
>-              unless Koha::Token->new->check_csrf(
>-                {
>-                    session_id => scalar $query->cookie('CGISESSID'),
>-                    token      => scalar $query->param('csrf_token'),
>-                }
>-              );
>-        }
>+    }
>+    elsif ( $params->{check} eq 'csrf_token' ) {
>+        $error = 'wrong_csrf_token'
>+          unless Koha::Token->new->check_csrf(
>+            {
>+                session_id => scalar $query->cookie('CGISESSID'),
>+                token      => scalar $query->param('csrf_token'),
>+            }
>+          );
>     }
>     output_and_exit( $query, $cookie, $template, $error ) if $error;
>     return;
>diff --git a/acqui/basketheader.pl b/acqui/basketheader.pl
>index 2cb3584823..04ed473f25 100755
>--- a/acqui/basketheader.pl
>+++ b/acqui/basketheader.pl
>@@ -142,8 +142,8 @@ if ( $op eq 'add_form' ) {
> #End Edit
> } elsif ( $op eq 'add_validate' ) {
> #we are confirming the changes, save the basket
>-#we are checking CSRF Token. Module CSRF_TOKEN_CHECK indicate for CSRF token checking,
>-    output_and_exit_if_error($input, $cookie, $template, { module => 'CSRF_TOKEN_CHECK' });
>+#we are checking CSRF Token.
>+    output_and_exit_if_error($input, $cookie, $template, { check => 'csrf_token' });
> 
>     if ( $is_an_edit ) {
>         ModBasketHeader(
>-- 
>2.11.0

Actions: View | Diff | Splinter Review

Attachments on bug 22990: 90102 | 90192 | 90194 | 90202 | 90204 | 90209 | 90238 | 90239 | 90240 | 95381 | 95382 | 95383 | 95384 | 95385 | 95391 | 95392 | 95393 | 95394 | 95395 | 95396 | 97814 | 122010 | 122011 | 122012 | 122013 | 122014 | 122015 | 122016 | 122023 | 122024 | 122025 | 122026 | 122027 | 122028 | 122029 | 122030 | 122031 | 122046 | 124924 | 124925 | 124926 | 124927 | 124928 | 124929 | 124930 | 124931 | 124932 | 124933 | 124934 | 126091 | 126092 | 126093 | 126094 | 126095 | 126096 | 126097 | 126098 | 126099 | 126100 | 126101 | 133238 | 133239 | 133240 | 133241 | 133242 | 133243 | 133244 | 133245 | 133246 | 133247 | 133248 | 133254 | 133255 | 133256 | 133257 | 133258 | 133422 | 133423 | 133424 | 133425 | 133426 | 133427 | 134848 | 134849 | 134850 | 134851 | 134852 | 134853 | 134854 | 141294 | 141295 | 141296 | 144315 | 144316 | 144317 | 144318 | 144319 | 144320 | 144321 | 144322 | 152626 | 152627 | 152628 | 153394 | 153751 | 153753 | 154044