From 22fd79e2626c0eb60595b648531e1d34bd781fd6 Mon Sep 17 00:00:00 2001
From: Martin Renvoize <martin.renvoize@ptfs-europe.com>
Date: Tue, 15 Jun 2021 16:15:14 +0100
Subject: [PATCH] Bug 22990: Add CSRF protection to add_message

---
 circ/add_message.pl                                          | 1 +
 koha-tmpl/intranet-tmpl/prog/en/includes/members-toolbar.inc | 1 +
 2 files changed, 2 insertions(+)

diff --git a/circ/add_message.pl b/circ/add_message.pl
index 455791b919..e5a0873edd 100755
--- a/circ/add_message.pl
+++ b/circ/add_message.pl
@@ -35,6 +35,7 @@ my ( $template, $loggedinuser, $cookie ) = get_template_and_user(
         debug           => 1,
     }
 );
+output_and_exit_if_error($input, $cookie, $template, { check => 'csrf_token' });
 
 my $borrowernumber   = $input->param('borrowernumber');
 my $branchcode       = $input->param('branchcode');
diff --git a/koha-tmpl/intranet-tmpl/prog/en/includes/members-toolbar.inc b/koha-tmpl/intranet-tmpl/prog/en/includes/members-toolbar.inc
index bb9abf4089..613b54b27d 100644
--- a/koha-tmpl/intranet-tmpl/prog/en/includes/members-toolbar.inc
+++ b/koha-tmpl/intranet-tmpl/prog/en/includes/members-toolbar.inc
@@ -93,6 +93,7 @@
     <div class="modal-dialog">
         <div class="modal-content">
             <form method="post" action="/cgi-bin/koha/circ/add_message.pl" id="message_form" name="message_f">
+                [% INCLUDE 'csrf-token.inc' %]
                 <div class="modal-header">
                     <h3>Leave a message</h3>
                 </div>
-- 
2.20.1