Attachment 145346 Details for Bug 31492 – Bug 31492: Set CSRF token in circulation.pl

[patch] Bug 31492: Set CSRF token in circulation.pl

Bug-31492-Set-CSRF-token-in-circulationpl.patch (text/plain), 1.39 KB, created by David Nind on 2023-01-17 00:48:17 UTC

(hide)

Description:

Filename:

MIME Type:

Creator: David Nind

Created: 2023-01-17 00:48:17 UTC

Size: 1.39 KB

patch

obsolete

>From 52afd217d8bac71bf67e5fe206ff55fa962452b5 Mon Sep 17 00:00:00 2001
>From: Lucas Gass <lucas@bywatersolutions.com>
>Date: Fri, 13 Jan 2023 19:01:55 +0000
>Subject: [PATCH] Bug 31492: Set CSRF token in circulation.pl
>
>To test:
>* Turn on patronimages system preferences
>* Go to any patron account
>* Hover over the 'dummy image' for the Add button
>* Browse and select an image for upload
>* Saving results in the following error:
>
>The form submission failed (Wrong CSRF token). Try to come back, refresh the page, then try again.
>
>Apply patch and try again. You shouldn't need to try twice, it should work on the first attempt now.
>
>Signed-off-by: David Nind <david@davidnind.com>
>---
> circ/circulation.pl | 6 ++++++
> 1 file changed, 6 insertions(+)
>
>diff --git a/circ/circulation.pl b/circ/circulation.pl
>index b7270bfe56..4bbc92b534 100755
>--- a/circ/circulation.pl
>+++ b/circ/circulation.pl
>@@ -54,6 +54,7 @@ use Koha::Items;
> use Koha::SearchEngine;
> use Koha::SearchEngine::Search;
> use Koha::Patron::Modifications;
>+use Koha::Token;
> 
> use List::MoreUtils qw( uniq );
> 
>@@ -636,4 +637,9 @@ $template->param(
>     logged_in_user            => $logged_in_user,
> );
> 
>+# Generate CSRF token for upload and delete image buttons
>+$template->param(
>+    csrf_token => Koha::Token->new->generate_csrf({ session_id => $query->cookie('CGISESSID'),}),
>+);
>+
> output_html_with_http_headers $query, $cookie, $template->output;
>-- 
>2.30.2

Actions: View | Diff | Splinter Review

Attachments on bug 31492: 145303 | 145346 | 145347