Attachment 97814 Details for Bug 22990 – Bug 22990 Add CSRF protection to Koha pages

[patch] Bug 22990 Add CSRF protection to Koha pages

0001-Bug-22990-Add-CSRF-protection-to-Koha-pages.patch (text/plain), 11.44 KB, created by Amit Gupta on 2020-01-23 12:33:18 UTC

(hide)

Description:

Filename:

MIME Type:

Creator: Amit Gupta

Created: 2020-01-23 12:33:18 UTC

Size: 11.44 KB

patch

obsolete

>From 8d2661dd6296b41874656904eb150b04f6e45421 Mon Sep 17 00:00:00 2001
>From: Amit Gupta <amit.gupta@informaticsglobal.com>
>Date: Wed, 22 Jan 2020 21:37:22 +0530
>Subject: [PATCH] Bug 22990 Add CSRF protection to Koha pages
>
>---
> koha-tmpl/intranet-tmpl/prog/en/modules/members/boraccount.tt    | 4 +++-
> koha-tmpl/intranet-tmpl/prog/en/modules/members/pay.tt           | 1 +
> koha-tmpl/intranet-tmpl/prog/en/modules/suggestion/suggestion.tt | 8 +++++---
> members/boraccount.pl                                            | 3 +++
> members/pay.pl                                                   | 7 +++++++
> members/setstatus.pl                                             | 1 +
> suggestion/suggestion.pl                                         | 7 +++++--
> 7 files changed, 25 insertions(+), 6 deletions(-)
>
>diff --git a/koha-tmpl/intranet-tmpl/prog/en/modules/members/boraccount.tt b/koha-tmpl/intranet-tmpl/prog/en/modules/members/boraccount.tt
>index 7427d41..e1acb2f 100644
>--- a/koha-tmpl/intranet-tmpl/prog/en/modules/members/boraccount.tt
>+++ b/koha-tmpl/intranet-tmpl/prog/en/modules/members/boraccount.tt
>@@ -82,7 +82,7 @@
>         [% END %]
>         <a href="accountline-details.pl?accountlines_id=[% account.accountlines_id | uri %]" class="btn btn-default btn-xs"><i class="fa fa-list"></i> Details</a>
>         [% IF account.is_credit %]
>-          <a href="boraccount.pl?action=void&amp;accountlines_id=[% account.accountlines_id | uri %]&amp;borrowernumber=[% account.borrowernumber | uri %]" class="btn btn-default btn-xs void"><i class="fa fa-ban"></i> Void</a>
>+          <a href="boraccount.pl?action=void&amp;accountlines_id=[% account.accountlines_id | uri %]&amp;borrowernumber=[% account.borrowernumber | uri %]&amp;csrf_token=[% csrf_token | html %]" class="btn btn-default btn-xs void"><i class="fa fa-ban"></i> Void</a>
>         [% END %]
>         [% IF CAN_user_updatecharges_payout && account.is_credit && ( account.amountoutstanding < 0 ) %]
>           <button type="button" data-toggle="modal" data-target="#issuePayoutModal" data-account="[%- PROCESS account_type_description account=account -%]" data-accountline="[% account.accountlines_id | html %]" data-amount="[% account.amountoutstanding | $Price %]" class="btn btn-default btn-xs"><i class="fa fa-money"></i> Issue payout</button>
>@@ -125,6 +125,7 @@
>             <input type="hidden" name="accountlines_id" value="" id="payoutline">
>             <input type="hidden" name="action" value="payout">
>             <input type="hidden" name="borrowernumber" value="[% account.borrowernumber | html %]">
>+            [% INCLUDE 'csrf-token.inc' %]
>             <div class="modal-dialog" role="document">
>                 <div class="modal-content">
>                     <div class="modal-header">
>@@ -189,6 +190,7 @@
>             <input type="hidden" name="accountlines_id" value="" id="refundline">
>             <input type="hidden" name="action" value="refund">
>             <input type="hidden" name="borrowernumber" value="[% account.borrowernumber | html %]">
>+            [% INCLUDE 'csrf-token.inc' %]
>             <div class="modal-dialog" role="document">
>                 <div class="modal-content">
>                     <div class="modal-header">
>diff --git a/koha-tmpl/intranet-tmpl/prog/en/modules/members/pay.tt b/koha-tmpl/intranet-tmpl/prog/en/modules/members/pay.tt
>index e2883b3..9b019a7 100644
>--- a/koha-tmpl/intranet-tmpl/prog/en/modules/members/pay.tt
>+++ b/koha-tmpl/intranet-tmpl/prog/en/modules/members/pay.tt
>@@ -39,6 +39,7 @@
> [% IF ( accounts ) %]
>     <form action="/cgi-bin/koha/members/pay.pl" method="post" id="pay-fines-form">
>     <input type="hidden" name="borrowernumber" id="borrowernumber" value="[% patron.borrowernumber | html %]" />
>+    [% INCLUDE 'csrf-token.inc' %]
> <p><span class="checkall"><a id="CheckAll" href="#"><i class="fa fa-check"></i> Select all</a></span> | <span class="clearall"><a id="CheckNone" href="#"><i class="fa fa-remove"></i> Clear all</a></span></p>
> <table id="finest">
> <thead>
>diff --git a/koha-tmpl/intranet-tmpl/prog/en/modules/suggestion/suggestion.tt b/koha-tmpl/intranet-tmpl/prog/en/modules/suggestion/suggestion.tt
>index 38d74c8..1e08e91 100644
>--- a/koha-tmpl/intranet-tmpl/prog/en/modules/suggestion/suggestion.tt
>+++ b/koha-tmpl/intranet-tmpl/prog/en/modules/suggestion/suggestion.tt
>@@ -48,6 +48,7 @@
>         Suggestions management
>     [% END %]
> </div>
>+[% INCLUDE 'blocking_errors.inc' %]
> 
> [% IF ( op == 'show' ) %]
>     <div class="main container-fluid">
>@@ -251,6 +252,7 @@
>         </div>
>     [% END %]
>     <form id="add_edit" action="suggestion.pl" method="post" class="validated">
>+    [% INCLUDE 'csrf-token.inc' %]
>     <input type="hidden" name="redirect" id="redirect" value="[% redirect | html %]" />
>     <input type="hidden" name="borrowernumber" id="borrowernumber" value="[% borrowernumber | html %]" />
>     [% IF ( suggestionid ) %]
>@@ -496,7 +498,7 @@
> [% FOREACH suggestion IN suggestions %]
> <div id="[% suggestion.suggestiontype | html %]">
> <form class="update_suggestions" name="f[% suggestion.suggestiontype | html %]" method="post" action="/cgi-bin/koha/suggestion/suggestion.pl#[% suggestion.suggestiontype | html %]">
>-
>+[% INCLUDE 'csrf-token.inc' %]
> [% IF ( suggestion.suggestions_loop ) %]
> <p><a id="CheckAll[% suggestion.suggestiontype | html %]" href="#">Check all</a> | <a id="UncheckAll[% suggestion.suggestiontype | html %]" href="#">Uncheck all</a></p>
>     <table id="[% suggestion.suggestiontype | html %]t" class="sorted">
>@@ -570,8 +572,8 @@
>                     [% END %]
>                 </td>
>                 <td class="actions">
>-                    <a class="btn btn-xs btn-default" href="suggestion.pl?suggestionid=[% suggestions_loo.suggestionid | html %]&amp;op=edit"><i class="fa fa-pencil"></i> Edit</a>
>-                    <a class="btn btn-default btn-xs deletesuggestion" href="suggestion.pl?op=delete&amp;edit_field=[% suggestions_loo.suggestionid | html %]"><i class="fa fa-trash"></i> Delete</a>
>+                    <a class="btn btn-xs btn-default" href="suggestion.pl?suggestionid=[% suggestions_loo.suggestionid | html %]&amp;csrf_token=[% csrf_token | html %]&amp;op=edit"><i class="fa fa-pencil"></i> Edit</a>
>+                    <a class="btn btn-default btn-xs deletesuggestion" href="suggestion.pl?op=delete&amp;edit_field=[% suggestions_loo.suggestionid | html %]&amp;csrf_token=[% csrf_token | html %]"><i class="fa fa-trash"></i> Delete</a>
>                 </td>
>         </tr>
>         [% END %]</tbody>
>diff --git a/members/boraccount.pl b/members/boraccount.pl
>index 8dfe35d..6e01a21 100755
>--- a/members/boraccount.pl
>+++ b/members/boraccount.pl
>@@ -92,12 +92,14 @@ if ( C4::Context->preference('UseCashRegisters') ) {
> }
> 
> if ( $action eq 'void' ) {
>+    output_and_exit_if_error($input, $cookie, $template, { check => 'csrf_token' });
>     my $payment_id = scalar $input->param('accountlines_id');
>     my $payment    = Koha::Account::Lines->find( $payment_id );
>     $payment->void();
> }
> 
> if ( $action eq 'payout' ) {
>+    output_and_exit_if_error($input, $cookie, $template, { check => 'csrf_token' });
>     my $payment_id        = scalar $input->param('accountlines_id');
>     my $payment           = Koha::Account::Lines->find($payment_id);
>     my $amount           = scalar $input->param('amount');
>@@ -119,6 +121,7 @@ if ( $action eq 'payout' ) {
> }
> 
> if ( $action eq 'refund' ) {
>+    output_and_exit_if_error($input, $cookie, $template, { check => 'csrf_token' });
>     my $charge_id        = scalar $input->param('accountlines_id');
>     my $charge           = Koha::Account::Lines->find($charge_id);
>     my $amount           = scalar $input->param('amount');
>diff --git a/members/pay.pl b/members/pay.pl
>index a126bfe..3cbae4c 100755
>--- a/members/pay.pl
>+++ b/members/pay.pl
>@@ -77,19 +77,24 @@ $user ||= q{};
> our $branch = C4::Context->userenv->{'branch'};
> 
> if ( $input->param('paycollect') ) {
>+    output_and_exit_if_error($input, $cookie, $template, { check => 'csrf_token' });
>     print $input->redirect(
>         "/cgi-bin/koha/members/paycollect.pl?borrowernumber=$borrowernumber&change_given=$change_given");
> }
> elsif ( $input->param('payselected') ) {
>+    output_and_exit_if_error($input, $cookie, $template, { check => 'csrf_token' });
>     payselected({ params => \@names });
> }
> elsif ( $input->param('writeoff_selected') ) {
>+    output_and_exit_if_error($input, $cookie, $template, { check => 'csrf_token' });
>     payselected({ params => \@names, type => 'WRITEOFF' });
> }
> elsif ( $input->param('woall') ) {
>+    output_and_exit_if_error($input, $cookie, $template, { check => 'csrf_token' });
>     writeoff_all(@names);
> }
> elsif ( $input->param('apply_credits') ) {
>+    output_and_exit_if_error($input, $cookie, $template, { check => 'csrf_token' });
>     apply_credits({ patron => $patron, cgi => $input });
> }
> elsif ( $input->param('confirm_writeoff') ) {
>@@ -127,9 +132,11 @@ elsif ( $input->param('confirm_writeoff') ) {
> 
> for (@names) {
>     if (/^pay_indiv_(\d+)$/) {
>+        output_and_exit_if_error($input, $cookie, $template, { check => 'csrf_token' });
>         my $line_no = $1;
>         redirect_to_paycollect( 'pay_individual', $line_no );
>     } elsif (/^wo_indiv_(\d+)$/) {
>+        output_and_exit_if_error($input, $cookie, $template, { check => 'csrf_token' });
>         my $line_no = $1;
>         redirect_to_paycollect( 'writeoff_individual', $line_no );
>     }
>diff --git a/members/setstatus.pl b/members/setstatus.pl
>index a98d555..e636565 100755
>--- a/members/setstatus.pl
>+++ b/members/setstatus.pl
>@@ -53,6 +53,7 @@ my $patron         = Koha::Patrons->find( $borrowernumber );
> if ( $logged_in_user->can_see_patron_infos($patron) ) {
>     if ( $reregistration eq 'y' ) {
>         # re-reregistration function to automatic calcul of date expiry
>+        output_and_exit_if_error($input, $cookie, $template, { check => 'csrf_token' });
>         $dateexpiry = $patron->renew_account;
>     } else {
>         my $sth = $dbh->prepare("UPDATE borrowers SET debarred = ?, debarredcomment = '' WHERE borrowernumber = ?");
>diff --git a/suggestion/suggestion.pl b/suggestion/suggestion.pl
>index 6b655f8..3fd47fd 100755
>--- a/suggestion/suggestion.pl
>+++ b/suggestion/suggestion.pl
>@@ -125,6 +125,7 @@ my $branchfilter = $input->param('branchcode') || C4::Context->userenv->{'branch
> ##
> 
> if ( $op =~ /save/i ) {
>+    output_and_exit_if_error($input, $cookie, $template, { check => 'csrf_token' });
>     my @messages;
>     my $biblio = MarcRecordFromNewSuggestion({
>             title => $suggestion_only->{title},
>@@ -196,7 +197,8 @@ elsif ($op=~/add/) {
>     $op ='save';
> }
> elsif ($op=~/edit/) {
>-    #Edit suggestion  
>+    #Edit suggestion
>+    output_and_exit_if_error($input, $cookie, $template, { check => 'csrf_token' });
>     $suggestion_ref=&GetSuggestion($$suggestion_ref{'suggestionid'});
>     $suggestion_ref->{reasonsloop} = $reasonsloop;
>     my $other_reason = 1;
>@@ -211,7 +213,7 @@ elsif ($op=~/edit/) {
>     $op ='save';
> }  
> elsif ($op eq "change" ) {
>-
>+    output_and_exit_if_error($input, $cookie, $template, { check => 'csrf_token' });
>     my $suggestion;
>     # set accepted/rejected/managed informations if applicable
>     # ie= if the librarian has chosen some action on the suggestions
>@@ -261,6 +263,7 @@ elsif ($op eq "change" ) {
>     }
>     print $input->redirect("/cgi-bin/koha/suggestion/suggestion.pl?$params");
> }elsif ($op eq "delete" ) {
>+    output_and_exit_if_error($input, $cookie, $template, { check => 'csrf_token' });
>     foreach my $delete_field (@editsuggestions) {
>         &DelSuggestion( $borrowernumber, $delete_field,'intranet' );
>     }
>-- 
>2.7.4
>

Actions: View | Diff | Splinter Review

Attachments on bug 22990: 90102 | 90192 | 90194 | 90202 | 90204 | 90209 | 90238 | 90239 | 90240 | 95381 | 95382 | 95383 | 95384 | 95385 | 95391 | 95392 | 95393 | 95394 | 95395 | 95396 | 97814 | 122010 | 122011 | 122012 | 122013 | 122014 | 122015 | 122016 | 122023 | 122024 | 122025 | 122026 | 122027 | 122028 | 122029 | 122030 | 122031 | 122046 | 124924 | 124925 | 124926 | 124927 | 124928 | 124929 | 124930 | 124931 | 124932 | 124933 | 124934 | 126091 | 126092 | 126093 | 126094 | 126095 | 126096 | 126097 | 126098 | 126099 | 126100 | 126101 | 133238 | 133239 | 133240 | 133241 | 133242 | 133243 | 133244 | 133245 | 133246 | 133247 | 133248 | 133254 | 133255 | 133256 | 133257 | 133258 | 133422 | 133423 | 133424 | 133425 | 133426 | 133427 | 134848 | 134849 | 134850 | 134851 | 134852 | 134853 | 134854 | 141294 | 141295 | 141296 | 144315 | 144316 | 144317 | 144318 | 144319 | 144320 | 144321 | 144322 | 152626 | 152627 | 152628 | 153394 | 153751 | 153753 | 154044