From 27f074a9a37a3b8dabccb218e98f41965daccce5 Mon Sep 17 00:00:00 2001 From: David Cook Date: Tue, 25 Jul 2023 05:18:00 +0000 Subject: [PATCH] Bug 34368: Add CSRF token to Content Management pages This change adds a CSRF token to the Content Management pages at additional-contents.pl. Test plan: 0. Apply patch 1. koha-plack --restart kohadev 2. Try to add "News", "HTML customizations", and "Pages". 3. Try to delete these new content entries 4. Note that you were successful in your endeavours --- .../prog/en/modules/tools/additional-contents.tt | 2 ++ tools/additional-contents.pl | 5 +++-- 2 files changed, 5 insertions(+), 2 deletions(-) diff --git a/koha-tmpl/intranet-tmpl/prog/en/modules/tools/additional-contents.tt b/koha-tmpl/intranet-tmpl/prog/en/modules/tools/additional-contents.tt index 84cda9311d..650ee9de53 100644 --- a/koha-tmpl/intranet-tmpl/prog/en/modules/tools/additional-contents.tt +++ b/koha-tmpl/intranet-tmpl/prog/en/modules/tools/additional-contents.tt @@ -201,6 +201,7 @@
+ [% INCLUDE 'csrf-token.inc' %] @@ -454,6 +455,7 @@
+ [% INCLUDE 'csrf-token.inc' %] diff --git a/tools/additional-contents.pl b/tools/additional-contents.pl index 46f358f9d7..deff10d382 100755 --- a/tools/additional-contents.pl +++ b/tools/additional-contents.pl @@ -28,7 +28,7 @@ use C4::Auth qw(get_template_and_user); use C4::Koha; use C4::Context; use C4::Log qw( logaction ); -use C4::Output qw(output_html_with_http_headers); +use C4::Output qw(output_html_with_http_headers output_and_exit_if_error); use C4::Languages qw(getTranslatedLanguages); use Koha::DateUtils qw( dt_from_string output_pref ); @@ -62,7 +62,6 @@ my ( $template, $borrowernumber, $cookie ) = get_template_and_user( my @messages; if ( $op eq 'add_form' ) { - my $additional_content = Koha::AdditionalContents->find($id); my $translated_contents; if ( $additional_content ) { @@ -84,6 +83,7 @@ if ( $op eq 'add_form' ) { ); } elsif ( $op eq 'add_validate' ) { + output_and_exit_if_error($cgi, $cookie, $template, { check => 'csrf_token' }); my $location = $cgi->param('location'); my $code = $cgi->param('code'); my $branchcode = $cgi->param('branchcode') || undef; @@ -199,6 +199,7 @@ elsif ( $op eq 'add_validate' ) { } } elsif ( $op eq 'delete_confirmed' ) { + output_and_exit_if_error($cgi, $cookie, $template, { check => 'csrf_token' }); my @ids = $cgi->multi_param('ids'); my $deleted = eval { -- 2.30.2