From 3ca7824403ef4db10568b5fa0dd82237e63a1c6a Mon Sep 17 00:00:00 2001 From: Amit Gupta Date: Wed, 29 May 2019 22:46:18 +0530 Subject: [PATCH] Bug 22990: Add CSRF protection to basketheader.pl Test plan 1. Create vendor 2. Create basket using the form
3. You can able to create the basket. 4. Apply the patch. 5. Create basket using the form 6. Now you can get error "The form submission failed (Wrong CSRF token). Try to come back, refresh the page, then try again." Signed-off-by: Martin Renvoize Signed-off-by: David Cook Bug 22990: Add CSRF protection to Koha pages Signed-off-by: David Cook --- acqui/basketheader.pl | 3 +++ koha-tmpl/intranet-tmpl/prog/en/modules/acqui/basketheader.tt | 3 ++- members/setstatus.pl | 1 - 3 files changed, 5 insertions(+), 2 deletions(-) diff --git a/acqui/basketheader.pl b/acqui/basketheader.pl index 90168f0d84..5e98c4e4eb 100755 --- a/acqui/basketheader.pl +++ b/acqui/basketheader.pl @@ -141,6 +141,9 @@ if ( $op eq 'add_form' ) { #End Edit } elsif ( $op eq 'add_validate' ) { #we are confirming the changes, save the basket +#we are checking CSRF Token. + output_and_exit_if_error($input, $cookie, $template, { check => 'csrf_token' }); + if ( $is_an_edit ) { ModBasketHeader( $basketno, diff --git a/koha-tmpl/intranet-tmpl/prog/en/modules/acqui/basketheader.tt b/koha-tmpl/intranet-tmpl/prog/en/modules/acqui/basketheader.tt index 01d7742b14..eb731797d7 100644 --- a/koha-tmpl/intranet-tmpl/prog/en/modules/acqui/basketheader.tt +++ b/koha-tmpl/intranet-tmpl/prog/en/modules/acqui/basketheader.tt @@ -53,13 +53,14 @@
- + [% INCLUDE 'blocking_errors.inc' %] [% IF ( add_form ) %] [% IF ( basketno ) %]

Edit basket [% basketname | html %]

[% ELSE %]

Add a basket to [% booksellername | html %]

[% END %]
+ [% INCLUDE 'csrf-token.inc' %]
    diff --git a/members/setstatus.pl b/members/setstatus.pl index 6809030aaf..592a869e71 100755 --- a/members/setstatus.pl +++ b/members/setstatus.pl @@ -61,7 +61,6 @@ if ( $logged_in_user->can_see_patron_infos($patron) ) { token => scalar $input->param('csrf_token'), } ); - $dateexpiry = $patron->renew_account; } else { my $sth = $dbh->prepare("UPDATE borrowers SET debarred = ?, debarredcomment = '' WHERE borrowernumber = ?"); -- 2.20.1