From 7115906f2c13a7f0e8d1f24294dfb9421fd0a139 Mon Sep 17 00:00:00 2001 From: Amit Gupta Date: Wed, 29 May 2019 22:46:18 +0530 Subject: [PATCH] Bug 22990: Add CSRF protection to basketheader.pl Test plan 1. Create vendor 2. Create basket using the form
3. You can able to create the basket. 4. Apply the patch. 5. Create basket using the form 6. Now you can get error "The form submission failed (Wrong CSRF token). Try to come back, refresh the page, then try again." Signed-off-by: Martin Renvoize Signed-off-by: David Cook --- acqui/basketheader.pl | 3 +++ koha-tmpl/intranet-tmpl/prog/en/modules/acqui/basketheader.tt | 3 ++- 2 files changed, 5 insertions(+), 1 deletion(-) diff --git a/acqui/basketheader.pl b/acqui/basketheader.pl index e79daa70a7..284963847e 100755 --- a/acqui/basketheader.pl +++ b/acqui/basketheader.pl @@ -141,6 +141,9 @@ if ( $op eq 'add_form' ) { #End Edit } elsif ( $op eq 'add_validate' ) { #we are confirming the changes, save the basket +#we are checking CSRF Token. + output_and_exit_if_error($input, $cookie, $template, { check => 'csrf_token' }); + if ( $is_an_edit ) { ModBasketHeader( $basketno, diff --git a/koha-tmpl/intranet-tmpl/prog/en/modules/acqui/basketheader.tt b/koha-tmpl/intranet-tmpl/prog/en/modules/acqui/basketheader.tt index 4db81b1650..81b2ea70f0 100644 --- a/koha-tmpl/intranet-tmpl/prog/en/modules/acqui/basketheader.tt +++ b/koha-tmpl/intranet-tmpl/prog/en/modules/acqui/basketheader.tt @@ -50,13 +50,14 @@
- + [% INCLUDE 'blocking_errors.inc' %] [% IF ( add_form ) %] [% IF ( basketno ) %]

Edit basket [% basketname | html %]

[% ELSE %]

Add a basket to [% booksellername | html %]

[% END %]
+ [% INCLUDE 'csrf-token.inc' %]
    -- 2.30.2