From e311550db2760500bc10ae3e077c99d5eba3e847 Mon Sep 17 00:00:00 2001
From: Amit Gupta <amit.gupta@informaticsglobal.com>
Date: Wed, 22 Jan 2020 21:37:22 +0530
Subject: [PATCH] Bug 22990 Add CSRF protection to Koha pages

---
 .../prog/en/modules/members/boraccount.tt         |  6 ++++--
 .../intranet-tmpl/prog/en/modules/members/pay.tt  |  1 +
 .../prog/en/modules/suggestion/suggestion.tt      |  7 +++++--
 members/boraccount.pl                             | 15 ++++++++++-----
 members/pay.pl                                    |  7 +++++++
 members/setstatus.pl                              |  1 +
 suggestion/suggestion.pl                          |  7 +++++--
 7 files changed, 33 insertions(+), 11 deletions(-)

diff --git a/koha-tmpl/intranet-tmpl/prog/en/modules/members/boraccount.tt b/koha-tmpl/intranet-tmpl/prog/en/modules/members/boraccount.tt
index fd4484aeaa..ebe2aae766 100644
--- a/koha-tmpl/intranet-tmpl/prog/en/modules/members/boraccount.tt
+++ b/koha-tmpl/intranet-tmpl/prog/en/modules/members/boraccount.tt
@@ -111,10 +111,10 @@
         [% END %]
         <a href="accountline-details.pl?accountlines_id=[% account.accountlines_id | uri %]" class="btn btn-default btn-xs"><i class="fa fa-list"></i> Details</a>
         [% IF account.is_debit && account.amountoutstanding > 0 %]
-            <a class="btn btn-default btn-xs" href="/cgi-bin/koha/members/paycollect.pl?borrowernumber=[% account.borrowernumber | html %]&pay_individual=1&debit_type_code=[% account.debit_type_code | html %]&amount=[% account.amount | html %]&amountoutstanding=[% account.amountoutstanding | html %]&description=[% account.description | html %]&itemnumber=[% account.itemnumber | html %]&accountlines_id=[% account.accountlines_id | html %]"><i class="fa fa-money"></i> Pay</a>
+            <a class="btn btn-default btn-xs" href="/cgi-bin/koha/members/paycollect.pl?borrowernumber=[% account.borrowernumber | html %]&pay_individual=1&debit_type_code=[% account.debit_type_code | html %]&amount=[% account.amount | html %]&amountoutstanding=[% account.amountoutstanding | html %]&description=[% account.description | html %]&itemnumber=[% account.itemnumber | html %]&accountlines_id=[% account.accountlines_id | html %]&amp;csrf_token=[% csrf_token | html %]"><i class="fa fa-money"></i> Pay</a>
         [% END %]
         [% IF account.is_credit && account.status != 'VOID' %]
-          <a href="boraccount.pl?action=void&amp;accountlines_id=[% account.accountlines_id | uri %]&amp;borrowernumber=[% account.borrowernumber | uri %]" class="btn btn-default btn-xs void"><i class="fa fa-ban"></i> Void payment</a>
+          <a href="boraccount.pl?action=void&amp;accountlines_id=[% account.accountlines_id | uri %]&amp;borrowernumber=[% account.borrowernumber | uri %]&amp;csrf_token=[% csrf_token | html %]" class="btn btn-default btn-xs void"><i class="fa fa-ban"></i> Void payment</a>
         [% END %]
         [% IF account.is_debit && account.amount == account.amountoutstanding && account.status != 'CANCELLED' && !(account.debit_type_code == 'PAYOUT') %]
           <form method="post" action="/cgi-bin/koha/members/cancel-charge.pl">
@@ -176,6 +176,7 @@
             <input type="hidden" name="accountlines_id" value="" id="payoutline">
             <input type="hidden" name="action" value="payout">
             <input type="hidden" name="borrowernumber" value="[% account.borrowernumber | html %]">
+            [% INCLUDE 'csrf-token.inc' %]
             <div class="modal-dialog" role="document">
                 <div class="modal-content">
                     <div class="modal-header">
@@ -230,6 +231,7 @@
             <input type="hidden" name="accountlines_id" value="" id="refundline">
             <input type="hidden" name="action" value="refund">
             <input type="hidden" name="borrowernumber" value="[% account.borrowernumber | html %]">
+            [% INCLUDE 'csrf-token.inc' %]
             <div class="modal-dialog" role="document">
                 <div class="modal-content">
                     <div class="modal-header">
diff --git a/koha-tmpl/intranet-tmpl/prog/en/modules/members/pay.tt b/koha-tmpl/intranet-tmpl/prog/en/modules/members/pay.tt
index 7ad139cdc9..79ac76ffb1 100644
--- a/koha-tmpl/intranet-tmpl/prog/en/modules/members/pay.tt
+++ b/koha-tmpl/intranet-tmpl/prog/en/modules/members/pay.tt
@@ -54,6 +54,7 @@
 [% IF ( accounts ) %]
     <form action="/cgi-bin/koha/members/pay.pl" method="post" id="pay-fines-form">
     <input type="hidden" name="borrowernumber" id="borrowernumber" value="[% patron.borrowernumber | html %]" />
+    [% INCLUDE 'csrf-token.inc' %]
 <p><span class="checkall"><a id="CheckAll" href="#"><i class="fa fa-check"></i> Select all</a></span> | <span class="clearall"><a id="CheckNone" href="#"><i class="fa fa-remove"></i> Clear all</a></span></p>
 <table id="finest">
 <thead>
diff --git a/koha-tmpl/intranet-tmpl/prog/en/modules/suggestion/suggestion.tt b/koha-tmpl/intranet-tmpl/prog/en/modules/suggestion/suggestion.tt
index 5234d766a4..55bca28336 100644
--- a/koha-tmpl/intranet-tmpl/prog/en/modules/suggestion/suggestion.tt
+++ b/koha-tmpl/intranet-tmpl/prog/en/modules/suggestion/suggestion.tt
@@ -103,6 +103,7 @@
             [% END %]
         </ol>
     </nav> <!-- /.breadcrumbs -->
+    [% INCLUDE 'blocking_errors.inc' %]
 
     [% IF ( op == 'show' ) %]
         <div class="main container-fluid">
@@ -345,6 +346,7 @@
             [% END %]
 
             <form id="add_edit" action="suggestion.pl" method="post" class="validated">
+                [% INCLUDE 'csrf-token.inc' %]
                 <input type="hidden" name="redirect" id="redirect" value="[% redirect | html %]" />
                 <input type="hidden" name="borrowernumber" id="borrowernumber" value="[% borrowernumber | html %]" />
                 [% IF ( suggestionid ) %]
@@ -716,6 +718,7 @@
             [% FOREACH suggestion IN suggestions %]
                 <div id="[% suggestion.suggestiontype | html %]">
                     <form class="update_suggestions" name="f" method="post" action="/cgi-bin/koha/suggestion/suggestion.pl#[% suggestion.suggestiontype| uri %]">
+                        [% INCLUDE 'csrf-token.inc' %]
 
                         [% IF ( suggestion.suggestions_loop ) %]
                             <p>
@@ -831,9 +834,9 @@
                                             </td>
                                             <td class="actions">
                                                 <div class="btn-group dropup">
-                                                    <a class="btn btn-default btn-xs" role="button" href="suggestion.pl?suggestionid=[% suggestions_loo.suggestionid | html %]&amp;op=edit"><i class="fa fa-pencil"></i> Edit</a><a class="btn btn-default btn-xs dropdown-toggle" id="more_actions_[% suggestions_loo.suggestionid | html %]" role="button" data-toggle="dropdown" href="#"><b class="caret"></b></a>
+                                                    <a class="btn btn-default btn-xs" role="button" href="suggestion.pl?suggestionid=[% suggestions_loo.suggestionid | html %]&amp;csrf_token=[% csrf_token | html %]&amp;op=edit"><i class="fa fa-pencil"></i> Edit</a><a class="btn btn-default btn-xs dropdown-toggle" id="more_actions_[% suggestions_loo.suggestionid | html %]" role="button" data-toggle="dropdown" href="#"><b class="caret"></b></a>
                                                     <ul class="dropdown-menu pull-right" role="menu" aria-labelledby="more_actions_[% suggestions_loo.suggestionid | html %]">
-                                                        <li><a class="deletesuggestion" href="suggestion.pl?op=delete&amp;suggestionid=[% suggestions_loo.suggestionid | html %]"><i class="fa fa-trash"></i> Delete</a></li>
+                                                        <li><a class="deletesuggestion" href="suggestion.pl?op=delete&amp;suggestionid=[% suggestions_loo.suggestionid | html %]&amp;csrf_token=[% csrf_token | html %]"><i class="fa fa-trash"></i> Delete</a></li>
                                                         [% UNLESS suggestions_loo.archived %]
                                                             <li><a class="archivesuggestion" href="suggestion.pl?op=archive&amp;suggestionid=[% suggestions_loo.suggestionid | html %]"><i class="fa fa-archive"></i> Archive</a></li>
                                                         [% ELSE %]
diff --git a/members/boraccount.pl b/members/boraccount.pl
index c2befdabd0..187cf0f40c 100755
--- a/members/boraccount.pl
+++ b/members/boraccount.pl
@@ -70,6 +70,7 @@ output_and_exit_if_error( $input, $cookie, $template, { module => 'members', log
 my $registerid = $input->param('registerid');
 
 if ( $action eq 'void' ) {
+    output_and_exit_if_error($input, $cookie, $template, { check => 'csrf_token' });
     my $payment_id = scalar $input->param('accountlines_id');
     my $payment    = Koha::Account::Lines->find( $payment_id );
     $payment->void(
@@ -82,8 +83,10 @@ if ( $action eq 'void' ) {
 }
 
 if ( $action eq 'payout' ) {
-    my $payment_id       = scalar $input->param('accountlines_id');
-    my $amount           = scalar $input->param('amount');
+    output_and_exit_if_error($input, $cookie, $template, { check => 'csrf_token' });
+    my $payment_id  = scalar $input->param('accountlines_id');
+    my $payment     = Koha::Account::Lines->find($payment_id);
+    my $amount      = scalar $input->param('amount');
     my $payout_type = scalar $input->param('payout_type');
     if ( $payment_id eq "" ) {
         $schema->txn_do(
@@ -120,9 +123,10 @@ if ( $action eq 'payout' ) {
 }
 
 if ( $action eq 'refund' ) {
-    my $charge_id        = scalar $input->param('accountlines_id');
-    my $charge           = Koha::Account::Lines->find($charge_id);
-    my $amount           = scalar $input->param('amount');
+    output_and_exit_if_error($input, $cookie, $template, { check => 'csrf_token' });
+    my $charge_id   = scalar $input->param('accountlines_id');
+    my $charge      = Koha::Account::Lines->find($charge_id);
+    my $amount      = scalar $input->param('amount');
     my $refund_type = scalar $input->param('refund_type');
     $schema->txn_do(
         sub {
@@ -153,6 +157,7 @@ if ( $action eq 'refund' ) {
 }
 
 if ( $action eq 'discount' ) {
+    output_and_exit_if_error($input, $cookie, $template, { check => 'csrf_token' });
     my $charge_id        = scalar $input->param('accountlines_id');
     my $charge           = Koha::Account::Lines->find($charge_id);
     my $amount           = scalar $input->param('amount');
diff --git a/members/pay.pl b/members/pay.pl
index f56e793d55..9b3a3b4072 100755
--- a/members/pay.pl
+++ b/members/pay.pl
@@ -78,19 +78,24 @@ $user ||= q{};
 our $branch = C4::Context->userenv->{'branch'};
 
 if ( $input->param('paycollect') ) {
+    output_and_exit_if_error($input, $cookie, $template, { check => 'csrf_token' });
     print $input->redirect(
         "/cgi-bin/koha/members/paycollect.pl?borrowernumber=$borrowernumber&change_given=$change_given");
 }
 elsif ( $input->param('payselected') ) {
+    output_and_exit_if_error($input, $cookie, $template, { check => 'csrf_token' });
     payselected({ params => \@names });
 }
 elsif ( $input->param('writeoff_selected') ) {
+    output_and_exit_if_error($input, $cookie, $template, { check => 'csrf_token' });
     payselected({ params => \@names, type => 'WRITEOFF' });
 }
 elsif ( $input->param('woall') ) {
+    output_and_exit_if_error($input, $cookie, $template, { check => 'csrf_token' });
     writeoff_all(@names);
 }
 elsif ( $input->param('apply_credits') ) {
+    output_and_exit_if_error($input, $cookie, $template, { check => 'csrf_token' });
     apply_credits({ patron => $patron, cgi => $input });
 }
 elsif ( $input->param('confirm_writeoff') ) {
@@ -130,9 +135,11 @@ elsif ( $input->param('confirm_writeoff') ) {
 
 for (@names) {
     if (/^pay_indiv_(\d+)$/) {
+        output_and_exit_if_error($input, $cookie, $template, { check => 'csrf_token' });
         my $line_no = $1;
         redirect_to_paycollect( 'pay_individual', $line_no );
     } elsif (/^wo_indiv_(\d+)$/) {
+        output_and_exit_if_error($input, $cookie, $template, { check => 'csrf_token' });
         my $line_no = $1;
         redirect_to_paycollect( 'writeoff_individual', $line_no );
     }
diff --git a/members/setstatus.pl b/members/setstatus.pl
index 66ae8b586c..77abd720e0 100755
--- a/members/setstatus.pl
+++ b/members/setstatus.pl
@@ -53,6 +53,7 @@ my $patron         = Koha::Patrons->find( $borrowernumber );
 if ( $logged_in_user->can_see_patron_infos($patron) ) {
     if ( $reregistration eq 'y' ) {
         # re-reregistration function to automatic calcul of date expiry
+        output_and_exit_if_error($input, $cookie, $template, { check => 'csrf_token' });
         $dateexpiry = $patron->renew_account;
     } else {
         my $sth = $dbh->prepare("UPDATE borrowers SET debarred = ?, debarredcomment = '' WHERE borrowernumber = ?");
diff --git a/suggestion/suggestion.pl b/suggestion/suggestion.pl
index 64b4106b2d..d58c3f867e 100755
--- a/suggestion/suggestion.pl
+++ b/suggestion/suggestion.pl
@@ -128,6 +128,7 @@ my $branchfilter = $input->param('branchcode') || C4::Context->userenv->{'branch
 ##
 
 if ( $op =~ /save/i ) {
+    output_and_exit_if_error($input, $cookie, $template, { check => 'csrf_token' });
     my @messages;
     my $biblio = MarcRecordFromNewSuggestion({
             title => $suggestion_only->{title},
@@ -245,7 +246,8 @@ elsif ($op=~/add/) {
     $op ='save';
 }
 elsif ($op=~/edit/) {
-    #Edit suggestion  
+    #Edit suggestion
+    output_and_exit_if_error($input, $cookie, $template, { check => 'csrf_token' });
     $suggestion_ref=&GetSuggestion($$suggestion_ref{'suggestionid'});
     $suggestion_ref->{reasonsloop} = $reasonsloop;
     my $other_reason = 1;
@@ -260,7 +262,7 @@ elsif ($op=~/edit/) {
     $op ='save';
 }  
 elsif ($op eq "update_status" ) {
-
+    output_and_exit_if_error($input, $cookie, $template, { check => 'csrf_token' });
     my $suggestion;
     # set accepted/rejected/managed informations if applicable
     # ie= if the librarian has chosen some action on the suggestions
@@ -297,6 +299,7 @@ elsif ($op eq "update_status" ) {
     }
     redirect_with_params($input);
 }elsif ($op eq "delete" ) {
+    output_and_exit_if_error($input, $cookie, $template, { check => 'csrf_token' });
     foreach my $delete_field (@editsuggestions) {
         &DelSuggestion( $borrowernumber, $delete_field,'intranet' );
     }
-- 
2.20.1