Attachment 95393 Details for Bug 22990 – Bug 22990: Introduce a new param "check" to check csrf token.

[patch] Bug 22990: Introduce a new param "check" to check csrf token.

Bug-22990-Introduce-a-new-param-check-to-check-csr.patch (text/plain), 2.14 KB, created by Martin Renvoize (ashimema) on 2019-11-13 14:34:29 UTC

(hide)

Description:

Filename:

MIME Type:

Creator: Martin Renvoize (ashimema)

Created: 2019-11-13 14:34:29 UTC

Size: 2.14 KB

patch

obsolete

>From 093da4369147c68eac36b124c01771f4fec2ee6d Mon Sep 17 00:00:00 2001
>From: Amit Gupta <amit.gupta@informaticsglobal.com>
>Date: Fri, 31 May 2019 08:35:51 +0530
>Subject: [PATCH] Bug 22990: Introduce a new param "check" to check csrf token.
>
>Signed-off-by: Martin Renvoize <martin.renvoize@ptfs-europe.com>
>---
> C4/Output.pm          | 17 ++++++++---------
> acqui/basketheader.pl |  4 ++--
> 2 files changed, 10 insertions(+), 11 deletions(-)
>
>diff --git a/C4/Output.pm b/C4/Output.pm
>index 52de90718d..3b42bfe14a 100644
>--- a/C4/Output.pm
>+++ b/C4/Output.pm
>@@ -346,16 +346,15 @@ sub output_and_exit_if_error {
>             # But in the long term we will want to get a biblio in parameter
>             $error = 'unknown_biblio' unless $params->{record};
>         }
>-        elsif ( $params->{module} eq 'CSRF_TOKEN_CHECK' ) {
>-            $error = 'wrong_csrf_token'
>-              unless Koha::Token->new->check_csrf(
>-                {
>-                    session_id => scalar $query->cookie('CGISESSID'),
>-                    token      => scalar $query->param('csrf_token'),
>-                }
>-              );
>+    }
>+    elsif ( $params->{check} eq 'csrf_token' ) {
>+        $error = 'wrong_csrf_token'
>+          unless Koha::Token->new->check_csrf(
>+            {
>+                session_id => scalar $query->cookie('CGISESSID'),
>+                token      => scalar $query->param('csrf_token'),
>             }
>-        }
>+          );
>     }
>     output_and_exit( $query, $cookie, $template, $error ) if $error;
>     return;
>diff --git a/acqui/basketheader.pl b/acqui/basketheader.pl
>index 0a59f42407..0af7b7923e 100755
>--- a/acqui/basketheader.pl
>+++ b/acqui/basketheader.pl
>@@ -143,8 +143,8 @@ if ( $op eq 'add_form' ) {
> #End Edit
> } elsif ( $op eq 'add_validate' ) {
> #we are confirming the changes, save the basket
>-#we are checking CSRF Token. Module CSRF_TOKEN_CHECK indicate for CSRF token checking,
>-    output_and_exit_if_error($input, $cookie, $template, { module => 'CSRF_TOKEN_CHECK' });
>+#we are checking CSRF Token.
>+    output_and_exit_if_error($input, $cookie, $template, { check => 'csrf_token' });
> 
>     if ( $is_an_edit ) {
>         ModBasketHeader(
>-- 
>2.20.1

Actions: View | Diff | Splinter Review

Attachments on bug 22990: 90102 | 90192 | 90194 | 90202 | 90204 | 90209 | 90238 | 90239 | 90240 | 95381 | 95382 | 95383 | 95384 | 95385 | 95391 | 95392 | 95393 | 95394 | 95395 | 95396 | 97814 | 122010 | 122011 | 122012 | 122013 | 122014 | 122015 | 122016 | 122023 | 122024 | 122025 | 122026 | 122027 | 122028 | 122029 | 122030 | 122031 | 122046 | 124924 | 124925 | 124926 | 124927 | 124928 | 124929 | 124930 | 124931 | 124932 | 124933 | 124934 | 126091 | 126092 | 126093 | 126094 | 126095 | 126096 | 126097 | 126098 | 126099 | 126100 | 126101 | 133238 | 133239 | 133240 | 133241 | 133242 | 133243 | 133244 | 133245 | 133246 | 133247 | 133248 | 133254 | 133255 | 133256 | 133257 | 133258 | 133422 | 133423 | 133424 | 133425 | 133426 | 133427 | 134848 | 134849 | 134850 | 134851 | 134852 | 134853 | 134854 | 141294 | 141295 | 141296 | 144315 | 144316 | 144317 | 144318 | 144319 | 144320 | 144321 | 144322 | 152626 | 152627 | 152628 | 153394 | 153751 | 153753 | 154044