From 8d8874b0e5392754fcf6d106108d64bd0357e938 Mon Sep 17 00:00:00 2001
From: Martin Renvoize <martin.renvoize@ptfs-europe.com>
Date: Tue, 15 Jun 2021 16:15:14 +0100
Subject: [PATCH] Bug 22990: Add CSRF protection to add_message

Signed-off-by: David Cook <dcook@prosentient.com.au>

Bug 22990: Fix for shelves table

Signed-off-by: David Cook <dcook@prosentient.com.au>

Bug 22990: Fix template toolkit syntax issues in shelves_results.tt

Bug 22990: Fix for setstatus

Signed-off-by: David Cook <dcook@prosentient.com.au>
---
 circ/add_message.pl                                          | 1 +
 koha-tmpl/intranet-tmpl/prog/en/includes/members-toolbar.inc | 1 +
 2 files changed, 2 insertions(+)

diff --git a/circ/add_message.pl b/circ/add_message.pl
index b28eeb6488..a7f5ac99aa 100755
--- a/circ/add_message.pl
+++ b/circ/add_message.pl
@@ -34,6 +34,7 @@ my ( $template, $loggedinuser, $cookie ) = get_template_and_user(
         flagsrequired   => { borrowers => 'edit_borrowers' },
     }
 );
+output_and_exit_if_error($input, $cookie, $template, { check => 'csrf_token' });
 
 my $borrowernumber   = $input->param('borrowernumber');
 my $branchcode       = $input->param('branchcode');
diff --git a/koha-tmpl/intranet-tmpl/prog/en/includes/members-toolbar.inc b/koha-tmpl/intranet-tmpl/prog/en/includes/members-toolbar.inc
index 311044ad71..f186b6e050 100644
--- a/koha-tmpl/intranet-tmpl/prog/en/includes/members-toolbar.inc
+++ b/koha-tmpl/intranet-tmpl/prog/en/includes/members-toolbar.inc
@@ -112,6 +112,7 @@
     <div class="modal-dialog">
         <div class="modal-content">
             <form method="post" action="/cgi-bin/koha/circ/add_message.pl" id="message_form" name="message_f">
+                [% INCLUDE 'csrf-token.inc' %]
                 <div class="modal-header">
                     <h3>Leave a message</h3>
                 </div>
-- 
2.20.1