From 409a66fbcac02471d5b2cd4b87cbdd08420eb0f0 Mon Sep 17 00:00:00 2001
From: Jonathan Druart <jonathan.druart@bugs.koha-community.org>
Date: Wed, 29 May 2019 16:43:59 -0500
Subject: [PATCH] Bug 22990: Code cleaning

- Remove indentation level
- Remove csrf_token params (can be picked from GGI->param directly)
- Fix the $cookie param's value

Signed-off-by: Martin Renvoize <martin.renvoize@ptfs-europe.com>
---
 C4/Output.pm          | 43 ++++++++++++++++++++++---------------------
 acqui/basketheader.pl |  3 ++-
 2 files changed, 24 insertions(+), 22 deletions(-)

diff --git a/C4/Output.pm b/C4/Output.pm
index a6a64a2153..5bf853a579 100644
--- a/C4/Output.pm
+++ b/C4/Output.pm
@@ -323,32 +323,33 @@ Others will be added here depending on the needs (for instance biblio does not e
 sub output_and_exit_if_error {
     my ( $query, $cookie, $template, $params ) = @_;
     my $error;
-    if ($params->{module} eq 'CSRF_TOKEN_CHECK') {
-        my $csrfcheck = Koha::Token->new->check_csrf( {
-            session_id => scalar $cookie,
-            token  => scalar $params->{csrf_token},
-        });
-        unless ($csrfcheck) {
-            $error = 'wrong_csrf_token';
-        }
-
-    } else {
-        if ( $params and exists $params->{module} ) {
-            if ( $params->{module} eq 'members' ) {
-                my $logged_in_user = $params->{logged_in_user};
-                my $current_patron = $params->{current_patron};
-                if ( not $current_patron ) {
-                    $error = 'unknown_patron';
-                }
-                elsif( not $logged_in_user->can_see_patron_infos( $current_patron ) ) {
-                    $error = 'cannot_see_patron_infos';
-                }
+    if ( $params and exists $params->{module} ) {
+        if ( $params->{module} eq 'members' ) {
+            my $logged_in_user = $params->{logged_in_user};
+            my $current_patron = $params->{current_patron};
+            if ( not $current_patron ) {
+                $error = 'unknown_patron';
+            }
+            elsif ( not $logged_in_user->can_see_patron_infos($current_patron) )
+            {
+                $error = 'cannot_see_patron_infos';
             }
-        } elsif ( $params->{module} eq 'cataloguing' ) {
+        }
+        elsif ( $params->{module} eq 'cataloguing' ) {
             # We are testing the record to avoid additem to fetch the Koha::Biblio
             # But in the long term we will want to get a biblio in parameter
             $error = 'unknown_biblio' unless $params->{record};
         }
+        elsif ( $params->{module} eq 'CSRF_TOKEN_CHECK' ) {
+            $error = 'wrong_csrf_token'
+              unless Koha::Token->new->check_csrf(
+                {
+                    session_id => scalar $query->cookie('CGISESSID'),
+                    token      => scalar $query->param('csrf_token'),
+                }
+              );
+            }
+        }
     }
     output_and_exit( $query, $cookie, $template, $error ) if $error;
     return;
diff --git a/acqui/basketheader.pl b/acqui/basketheader.pl
index 5d3883702b..dbfba52292 100755
--- a/acqui/basketheader.pl
+++ b/acqui/basketheader.pl
@@ -142,7 +142,8 @@ if ( $op eq 'add_form' ) {
 } elsif ( $op eq 'add_validate' ) {
 #we are confirming the changes, save the basket
 #we are checking CSRF Token. Module CSRF_TOKEN_CHECK indicate for CSRF token checking,
-    output_and_exit_if_error( $input, $input->cookie('CGISESSID'), $template, { module => 'CSRF_TOKEN_CHECK', csrf_token => $input->param('csrf_token') } );
+    output_and_exit_if_error($input, $cookie, $template, { module => 'CSRF_TOKEN_CHECK' });
+
     if ( $is_an_edit ) {
         ModBasketHeader(
             $basketno,
-- 
2.20.1