From 26c3d0b5ba746d9d89ba4b7ce32d78b75ae836e1 Mon Sep 17 00:00:00 2001
From: Martin Renvoize <martin.renvoize@ptfs-europe.com>
Date: Tue, 15 Jun 2021 16:15:14 +0100
Subject: [PATCH] Bug 22990: Add CSRF protection to add_message

---
 circ/add_message.pl                                          | 1 +
 koha-tmpl/intranet-tmpl/prog/en/includes/members-toolbar.inc | 1 +
 2 files changed, 2 insertions(+)

diff --git a/circ/add_message.pl b/circ/add_message.pl
index ee90af3522..2018c4fece 100755
--- a/circ/add_message.pl
+++ b/circ/add_message.pl
@@ -34,6 +34,7 @@ my ( $template, $loggedinuser, $cookie ) = get_template_and_user(
         flagsrequired   => { borrowers => 'edit_borrowers' },
     }
 );
+output_and_exit_if_error($input, $cookie, $template, { check => 'csrf_token' });
 
 my $borrowernumber   = $input->param('borrowernumber');
 my $branchcode       = $input->param('branchcode');
diff --git a/koha-tmpl/intranet-tmpl/prog/en/includes/members-toolbar.inc b/koha-tmpl/intranet-tmpl/prog/en/includes/members-toolbar.inc
index 44d6f800a6..a61ce19fba 100644
--- a/koha-tmpl/intranet-tmpl/prog/en/includes/members-toolbar.inc
+++ b/koha-tmpl/intranet-tmpl/prog/en/includes/members-toolbar.inc
@@ -93,6 +93,7 @@
     <div class="modal-dialog">
         <div class="modal-content">
             <form method="post" action="/cgi-bin/koha/circ/add_message.pl" id="message_form" name="message_f">
+                [% INCLUDE 'csrf-token.inc' %]
                 <div class="modal-header">
                     <h3>Leave a message</h3>
                 </div>
-- 
2.20.1