From 5ee2bef42f7f2e5e8661191c1d3a49215678f025 Mon Sep 17 00:00:00 2001 From: Kyle M Hall Date: Thu, 27 Jul 2023 07:45:57 -0400 Subject: [PATCH] Bug 30524: (QA follow-up) Only generate CSRF token if it will be used --- C4/Auth.pm | 1 - Koha/Template/Plugin/Koha.pm | 26 +++++++++++++++++++ .../prog/en/includes/csrf-token.inc | 4 ++- .../prog/en/modules/intranet-main.tt | 1 + 4 files changed, 30 insertions(+), 2 deletions(-) diff --git a/C4/Auth.pm b/C4/Auth.pm index 3e4cf15195..cf21e3bdc4 100644 --- a/C4/Auth.pm +++ b/C4/Auth.pm @@ -308,7 +308,6 @@ sub get_template_and_user { $template->param( loggedinusernumber => $borrowernumber ); # FIXME Should be replaced with logged_in_user.borrowernumber $template->param( logged_in_user => $patron ); $template->param( sessionID => $sessionID ); - $template->param( csrf_token => Koha::Token->new->generate_csrf({ session_id => scalar $sessionID })); if ( $in->{'type'} eq 'opac' ) { require Koha::Virtualshelves; diff --git a/Koha/Template/Plugin/Koha.pm b/Koha/Template/Plugin/Koha.pm index 5e7a303f70..176818377e 100644 --- a/Koha/Template/Plugin/Koha.pm +++ b/Koha/Template/Plugin/Koha.pm @@ -48,8 +48,22 @@ is necessary. =head2 Class Methods +=head3 new + +This new method allows us to store the context which gives us +access to the template vars already set. In particular this gives +us access to the template vars set by C4::Auth::get_template_and_user + =cut +sub new { + my ( $class, $context ) = @_; + bless { + _CONTEXT => $context, + }, $class; +} + + sub Preference { my ( $self, $pref ) = @_; return C4::Context->preference( $pref ); @@ -84,4 +98,16 @@ sub Version { }; } +=head3 GenerateCSRF + +Generate a new CSRF token. + +=cut + +sub GenerateCSRF { + my ( $self ) = @_; + my $session_id = $self->{_CONTEXT}->stash->{sessionID}; + return Koha::Token->new->generate_csrf({ session_id => scalar $session_id }); +} + 1; diff --git a/koha-tmpl/intranet-tmpl/prog/en/includes/csrf-token.inc b/koha-tmpl/intranet-tmpl/prog/en/includes/csrf-token.inc index 703d4eb036..bfc221faf4 100644 --- a/koha-tmpl/intranet-tmpl/prog/en/includes/csrf-token.inc +++ b/koha-tmpl/intranet-tmpl/prog/en/includes/csrf-token.inc @@ -1 +1,3 @@ - +[%- USE Koha %] +[%- USE raw %] + diff --git a/koha-tmpl/intranet-tmpl/prog/en/modules/intranet-main.tt b/koha-tmpl/intranet-tmpl/prog/en/modules/intranet-main.tt index 1b4dfe93dd..520673a016 100644 --- a/koha-tmpl/intranet-tmpl/prog/en/modules/intranet-main.tt +++ b/koha-tmpl/intranet-tmpl/prog/en/modules/intranet-main.tt @@ -10,6 +10,7 @@ [% INCLUDE 'doc-head-close.inc' %] +[% Koha.GenerateCSRF %] [% WRAPPER 'header.inc' %] [% INCLUDE 'home-search.inc' %] -- 2.30.2