From 93066a69606f6c30193d7fa86ffb8a6cd9481841 Mon Sep 17 00:00:00 2001
From: Amit Gupta <amit.gupta@informaticsglobal.com>
Date: Fri, 31 May 2019 08:35:51 +0530
Subject: [PATCH] Bug 22990: Introduce a new param "check" to check csrf token.
Signed-off-by: Martin Renvoize <martin.renvoize@ptfs-europe.com>
---
C4/Output.pm | 17 ++++++++---------
acqui/basketheader.pl | 4 ++--
2 files changed, 10 insertions(+), 11 deletions(-)
diff --git a/C4/Output.pm b/C4/Output.pm
index c4a51e13b7..9f50a043ce 100644
--- a/C4/Output.pm
+++ b/C4/Output.pm
@@ -340,16 +340,15 @@ sub output_and_exit_if_error {
# But in the long term we will want to get a biblio in parameter
$error = 'unknown_biblio' unless $params->{record};
}
- elsif ( $params->{module} eq 'CSRF_TOKEN_CHECK' ) {
- $error = 'wrong_csrf_token'
- unless Koha::Token->new->check_csrf(
- {
- session_id => scalar $query->cookie('CGISESSID'),
- token => scalar $query->param('csrf_token'),
- }
- );
+ }
+ elsif ( $params->{check} eq 'csrf_token' ) {
+ $error = 'wrong_csrf_token'
+ unless Koha::Token->new->check_csrf(
+ {
+ session_id => scalar $query->cookie('CGISESSID'),
+ token => scalar $query->param('csrf_token'),
}
- }
+ );
}
output_and_exit( $query, $cookie, $template, $error ) if $error;
return;
diff --git a/acqui/basketheader.pl b/acqui/basketheader.pl
index f3ab7fd2ae..b1e7117561 100755
--- a/acqui/basketheader.pl
+++ b/acqui/basketheader.pl
@@ -141,8 +141,8 @@ if ( $op eq 'add_form' ) {
#End Edit
} elsif ( $op eq 'add_validate' ) {
#we are confirming the changes, save the basket
-#we are checking CSRF Token. Module CSRF_TOKEN_CHECK indicate for CSRF token checking,
- output_and_exit_if_error($input, $cookie, $template, { module => 'CSRF_TOKEN_CHECK' });
+#we are checking CSRF Token.
+ output_and_exit_if_error($input, $cookie, $template, { check => 'csrf_token' });
if ( $is_an_edit ) {
ModBasketHeader(
--
2.20.1