Attachment 99066 Details for Bug 24673 – Bug 24673: Add CSRF token support to opac-messaging.pl

[patch] Bug 24673: Add CSRF token support to opac-messaging.pl

Bug-24673-Add-CSRF-token-support-to-opac-messaging.patch (text/plain), 3.70 KB, created by David Cook on 2020-02-17 06:59:04 UTC

(hide)

Description:

Filename:

MIME Type:

Creator: David Cook

Created: 2020-02-17 06:59:04 UTC

Size: 3.70 KB

patch

obsolete

>From bb3ac59198867e182f591ff9046e2dd5b86815f0 Mon Sep 17 00:00:00 2001
>From: David Cook <dcook@prosentient.com.au>
>Date: Mon, 17 Feb 2020 06:50:49 +0000
>Subject: [PATCH] Bug 24673: Add CSRF token support to opac-messaging.pl
>
>This patch adds CSRF token support to opac-messaging.pl,
>which allows users to manually update their messaging preferences,
>but prevents bad actors from tricking people into updating their
>preferences from cross-site requests.
>
>Test plan:
>0. Set SMSSendDriver global system preference to "Test" if unset
>1. Log into the OPAC
>2. Navigate to a URL in your browser like the following:
>http://localhost:8080/cgi-bin/koha/opac-messaging.pl?modify=yes
>&1=email&digest=1&2-DAYS=5&2=email&digest=2&4=email&SMSnumber=0444444444
>3. Observe that the preference and SMS number update
>
>4. Apply the patch
>
>5. Navigate to a URL in your browser like the following:
>http://localhost:8080/cgi-bin/koha/opac-messaging.pl?modify=yes
>&1=email&digest=1&2-DAYS=5&2=email&digest=2&4=email&SMSnumber=0444444444
>6. Observe that you get an error message of "Wrong CSRF token" instead
>of the previous behaviour
>7. Navigate to a URL in your browser like the following:
>http://localhost:8080/cgi-bin/koha/opac-messaging.pl
>8. Update "Advance notice" to 3 and update "SMS number" to 61111111111
>9. Observe that the "Advance notice" and "SMS number" fields update
>correctly
>---
> koha-tmpl/opac-tmpl/bootstrap/en/modules/opac-messaging.tt |  1 +
> opac/opac-messaging.pl                                     | 13 +++++++++++++
> 2 files changed, 14 insertions(+)
>
>diff --git a/koha-tmpl/opac-tmpl/bootstrap/en/modules/opac-messaging.tt b/koha-tmpl/opac-tmpl/bootstrap/en/modules/opac-messaging.tt
>index 3d25f5372f..7fd4786503 100644
>--- a/koha-tmpl/opac-tmpl/bootstrap/en/modules/opac-messaging.tt
>+++ b/koha-tmpl/opac-tmpl/bootstrap/en/modules/opac-messaging.tt
>@@ -29,6 +29,7 @@
>                         <div class="alert alert-success"><h4>Settings updated</h4></div>
>                     [% END %]
>                     <form action="/cgi-bin/koha/opac-messaging.pl" method="get" name="opacmessaging">
>+                        <input type="hidden" name="csrf_token" value="[% csrf_token | html %]" />
>                         <input type="hidden" name="modify" value="yes" />
> 
>                             <table class="table table-bordered table-condensed table-striped">
>diff --git a/opac/opac-messaging.pl b/opac/opac-messaging.pl
>index 8a6996ae18..98add2dd7b 100755
>--- a/opac/opac-messaging.pl
>+++ b/opac/opac-messaging.pl
>@@ -31,6 +31,7 @@ use C4::Members::Messaging;
> use C4::Form::MessagingPreferences;
> use Koha::Patrons;
> use Koha::SMS::Providers;
>+use Koha::Token;
> 
> my $query = CGI->new();
> 
>@@ -55,6 +56,11 @@ my $patron = Koha::Patrons->find( $borrowernumber ); # FIXME and if borrowernumb
> my $messaging_options = C4::Members::Messaging::GetMessagingOptions();
> 
> if ( defined $query->param('modify') && $query->param('modify') eq 'yes' ) {
>+    die "Wrong CSRF token" unless Koha::Token->new->check_csrf({
>+        session_id => scalar $query->cookie('CGISESSID'),
>+        token  => scalar $query->param('csrf_token'),
>+    });
>+
>     my $sms = $query->param('SMSnumber');
>     my $sms_provider_id = $query->param('sms_provider_id');
>     if ( defined $sms && ( $patron->smsalertnumber // '' ) ne $sms
>@@ -81,4 +87,11 @@ if ( C4::Context->preference("SMSSendDriver") eq 'Email' ) {
>     $template->param( sms_providers => \@providers, sms_provider_id => $patron->sms_provider_id );
> }
> 
>+my $new_session_id = $cookie->value;
>+$template->param(
>+    csrf_token => Koha::Token->new->generate_csrf({
>+            session_id => $new_session_id,
>+        }),
>+);
>+
> output_html_with_http_headers $query, $cookie, $template->output, undef, { force_no_caching => 1 };
>-- 
>2.11.0

Actions: View | Diff | Splinter Review

Attachments on bug 24673: 99066 | 99654