From a9f077c7a497a39fdcc63d7fb12c841c3bdf1fb0 Mon Sep 17 00:00:00 2001 From: Amit Gupta Date: Wed, 29 May 2019 22:46:18 +0530 Subject: [PATCH] Bug 22990 - Add CSRF protection to basketheader.pl Test plan 1. Create vendor 2. Create basket using the form
3. You can able to create the basket. 4. Apply the patch. 5. Create basket using the form 6. Now you can get error "The form submission failed (Wrong CSRF token). Try to come back, refresh the page, then try again." Signed-off-by: Martin Renvoize --- C4/Auth.pm | 2 ++ C4/Output.pm | 31 +++++++++++++------ acqui/basketheader.pl | 2 ++ .../prog/en/includes/csrf-token.inc | 1 + .../prog/en/modules/acqui/basketheader.tt | 3 +- 5 files changed, 28 insertions(+), 11 deletions(-) create mode 100644 koha-tmpl/intranet-tmpl/prog/en/includes/csrf-token.inc diff --git a/C4/Auth.pm b/C4/Auth.pm index cb35984b2e..fff1a251bb 100644 --- a/C4/Auth.pm +++ b/C4/Auth.pm @@ -76,6 +76,7 @@ use Encode qw( encode is_utf8); use C4::Auth_with_shibboleth; use Net::CIDR; use C4::Log qw/logaction/; +use Koha::Token; # use utf8; use vars qw(@ISA @EXPORT @EXPORT_OK %EXPORT_TAGS $debug $ldap $cas $caslogout); @@ -309,6 +310,7 @@ sub get_template_and_user { $template->param( loggedinusernumber => $borrowernumber ); # FIXME Should be replaced with logged_in_user.borrowernumber $template->param( logged_in_user => $patron ); $template->param( sessionID => $sessionID ); + $template->param( csrf_token => Koha::Token->new->generate_csrf({ session_id => scalar $sessionID })); if ( $in->{'type'} eq 'opac' ) { require Koha::Virtualshelves; diff --git a/C4/Output.pm b/C4/Output.pm index 8ea7bb51fa..3d03922820 100644 --- a/C4/Output.pm +++ b/C4/Output.pm @@ -33,6 +33,7 @@ use Scalar::Util qw( looks_like_number ); use C4::Auth qw(get_template_and_user); use C4::Context; use C4::Templates; +use Koha::Token; use vars qw(@ISA @EXPORT @EXPORT_OK %EXPORT_TAGS); @@ -331,15 +332,26 @@ Others will be added here depending on the needs (for instance biblio does not e sub output_and_exit_if_error { my ( $query, $cookie, $template, $params ) = @_; my $error; - if ( $params and exists $params->{module} ) { - if ( $params->{module} eq 'members' ) { - my $logged_in_user = $params->{logged_in_user}; - my $current_patron = $params->{current_patron}; - if ( not $current_patron ) { - $error = 'unknown_patron'; - } - elsif( not $logged_in_user->can_see_patron_infos( $current_patron ) ) { - $error = 'cannot_see_patron_infos'; + if ($params->{module} eq 'CSRF_TOKEN_CHECK') { + my $csrfcheck = Koha::Token->new->check_csrf( { + session_id => scalar $cookie, + token => scalar $params->{csrf_token}, + }); + unless ($csrfcheck) { + $error = 'wrong_csrf_token'; + } + + } else { + if ( $params and exists $params->{module} ) { + if ( $params->{module} eq 'members' ) { + my $logged_in_user = $params->{logged_in_user}; + my $current_patron = $params->{current_patron}; + if ( not $current_patron ) { + $error = 'unknown_patron'; + } + elsif( not $logged_in_user->can_see_patron_infos( $current_patron ) ) { + $error = 'cannot_see_patron_infos'; + } } } elsif ( $params->{module} eq 'cataloguing' ) { # We are testing the record to avoid additem to fetch the Koha::Biblio @@ -347,7 +359,6 @@ sub output_and_exit_if_error { $error = 'unknown_biblio' unless $params->{record}; } } - output_and_exit( $query, $cookie, $template, $error ) if $error; return; } diff --git a/acqui/basketheader.pl b/acqui/basketheader.pl index f06900ce85..d309fbf5c8 100755 --- a/acqui/basketheader.pl +++ b/acqui/basketheader.pl @@ -142,6 +142,8 @@ if ( $op eq 'add_form' ) { #End Edit } elsif ( $op eq 'add_validate' ) { #we are confirming the changes, save the basket +#we are checking CSRF Token. Module CSRF_TOKEN_CHECK indicate for CSRF token checking, + output_and_exit_if_error( $input, $input->cookie('CGISESSID'), $template, { module => 'CSRF_TOKEN_CHECK', csrf_token => $input->param('csrf_token') } ); if ( $is_an_edit ) { ModBasketHeader( $basketno, diff --git a/koha-tmpl/intranet-tmpl/prog/en/includes/csrf-token.inc b/koha-tmpl/intranet-tmpl/prog/en/includes/csrf-token.inc new file mode 100644 index 0000000000..703d4eb036 --- /dev/null +++ b/koha-tmpl/intranet-tmpl/prog/en/includes/csrf-token.inc @@ -0,0 +1 @@ + diff --git a/koha-tmpl/intranet-tmpl/prog/en/modules/acqui/basketheader.tt b/koha-tmpl/intranet-tmpl/prog/en/modules/acqui/basketheader.tt index b3bc583040..f855dc624c 100644 --- a/koha-tmpl/intranet-tmpl/prog/en/modules/acqui/basketheader.tt +++ b/koha-tmpl/intranet-tmpl/prog/en/modules/acqui/basketheader.tt @@ -50,13 +50,14 @@
- + [% INCLUDE 'blocking_errors.inc' %] [% IF ( add_form ) %] [% IF ( basketno ) %]

Edit basket [% basketname | html %]

[% ELSE %]

Add a basket to [% booksellername | html %]

[% END %]
+ [% INCLUDE 'csrf-token.inc' %]
    -- 2.20.1