From 80b3dfe128ce4b5c846797b9e992efb9d46453a1 Mon Sep 17 00:00:00 2001 From: Jonathan Druart Date: Fri, 4 Aug 2023 10:44:55 +0200 Subject: [PATCH] Bug 34478: Script to catch GET forms and its output that have been modified to show the state of the progres (search for "TO BE CONTINUED") "stateless" => "get" can still be used for this form "modified" => "get" replaced with "post" and there is an "op" parameter "???" or "TODO" => needs more attention --- csrf_get.pl | 56 +++++++++++++++++++ csrf_get.txt | 150 +++++++++++++++++++++++++++++++++++++++++++++++++++ 2 files changed, 206 insertions(+) create mode 100644 csrf_get.pl create mode 100644 csrf_get.txt diff --git a/csrf_get.pl b/csrf_get.pl new file mode 100644 index 00000000000..da46786991b --- /dev/null +++ b/csrf_get.pl @@ -0,0 +1,56 @@ +#!/usr/bin/perl + +use Modern::Perl; +use File::Find; +use File::Slurp; +use Data::Dumper; + +my @themes; + +# OPAC themes +my $opac_dir = 'koha-tmpl/opac-tmpl'; +opendir ( my $dh, $opac_dir ) or die "can't opendir $opac_dir: $!"; +for my $theme ( grep { not /^\.|lib|js|xslt/ } readdir($dh) ) { + push @themes, "$opac_dir/$theme/en"; +} +close $dh; + +# STAFF themes +my $staff_dir = 'koha-tmpl/intranet-tmpl'; +opendir ( $dh, $staff_dir ) or die "can't opendir $staff_dir: $!"; +for my $theme ( grep { not /^\.|lib|js/ } readdir($dh) ) { + push @themes, "$staff_dir/$theme/en"; +} +close $dh; + +my @files; +sub wanted { + my $name = $File::Find::name; + push @files, $name + if $name =~ m[\.(tt|inc)$] and -f $name; +} + +find({ wanted => \&wanted, no_chdir => 1 }, @themes ); + +my @errors; +for my $file ( @files ) { + my @e = get_forms($file); + push @errors, { file => $file, errors => \@e } if @e; +} + +say sprintf("%s:%s", $_->{file}, join(',', @{$_->{errors}})) for @errors; + +sub get_forms { + my ( $file ) = @_; + + my @lines = read_file($file); + my @errors; + return @errors unless grep { $_ =~ m| stateless +koha-tmpl/opac-tmpl/bootstrap/en/modules/opac-suggestions.tt:338 +=> stateless +koha-tmpl/opac-tmpl/bootstrap/en/modules/opac-recall.tt:68 +=> modified, there is 'op' +koha-tmpl/opac-tmpl/bootstrap/en/modules/opac-readingrecord.tt:63 +=> stateless +koha-tmpl/opac-tmpl/bootstrap/en/modules/opac-advsearch.tt:12 +=> stateless +koha-tmpl/opac-tmpl/bootstrap/en/modules/opac-holdshistory.tt:79 +=> stateless +koha-tmpl/opac-tmpl/bootstrap/en/modules/opac-basket.tt:85 +=> stateless +281 +=> stateless +349 +=> ??? Are we emptying the cart here ??? +koha-tmpl/opac-tmpl/bootstrap/en/modules/opac-tags.tt:87 +=> stateless +koha-tmpl/opac-tmpl/bootstrap/en/modules/opac-results.tt:158 +=> stateless +543 +=> ??? Not clear ??? +koha-tmpl/opac-tmpl/bootstrap/en/modules/opac-authorities-home.tt:38 +=> modified, there is 'op' +koha-tmpl/opac-tmpl/bootstrap/en/modules/opac-shelves.tt:251 +=> modified, there is 'op' +549 +=> modified, there is 'op' +766 +=> modified, there is 'op' +781 +=> modified, there is 'op' +koha-tmpl/opac-tmpl/bootstrap/en/includes/opac-detail-sidebar.inc:121 +=> modified, there is 'op' +koha-tmpl/opac-tmpl/bootstrap/en/includes/masthead.inc:172 +=> stateless +koha-tmpl/opac-tmpl/bootstrap/en/includes/opac-topissues.inc:6 +=> stateless +koha-tmpl/intranet-tmpl/prog/en/modules/pos/pay.tt:40 +=> modified, there is 'op' +169 +=> TODO there no 'op' here +koha-tmpl/intranet-tmpl/prog/en/modules/pos/register.tt: +41 +=> modified, there is 'op' +172 +=> stateless +koha-tmpl/intranet-tmpl/prog/en/modules/pos/registers.tt:38 +=> modified, there is 'op' +koha-tmpl/intranet-tmpl/prog/en/modules/patroncards/edit-profile.tt:49 +=> modified, there is 'op' +koha-tmpl/intranet-tmpl/prog/en/modules/patroncards/edit-layout.tt:46 +=> modified, there is 'op' +koha-tmpl/intranet-tmpl/prog/en/modules/patroncards/edit-template.tt:49 +=> modified, there is 'op' +koha-tmpl/intranet-tmpl/prog/en/modules/virtualshelves/shelves.tt:539 +=> TODO! Confusing code here! +koha-tmpl/intranet-tmpl/prog/en/modules/virtualshelves/tables/shelves_results.tt:41 +=> stateless +koha-tmpl/intranet-tmpl/prog/en/modules/admin/biblio_framework.tt:133 +=> stateless +143 +=> stateless +186 +=> stateless +256 +=> stateless +koha-tmpl/intranet-tmpl/prog/en/modules/admin/cities.tt:159 +=> stateless + +.TO BE CONTINUED. + +koha-tmpl/intranet-tmpl/prog/en/modules/admin/matching-rules.tt:426 +koha-tmpl/intranet-tmpl/prog/en/modules/admin/marc_subfields_structure.tt:423 +koha-tmpl/intranet-tmpl/prog/en/modules/admin/edi_ean_accounts.tt:146 +koha-tmpl/intranet-tmpl/prog/en/modules/admin/aqbudgets.tt:422,435 +koha-tmpl/intranet-tmpl/prog/en/modules/admin/authtypes.tt:151,207 +koha-tmpl/intranet-tmpl/prog/en/modules/admin/edi_accounts.tt:286 +koha-tmpl/intranet-tmpl/prog/en/modules/admin/auth_tag_structure.tt:195 +koha-tmpl/intranet-tmpl/prog/en/modules/admin/item_circulation_alerts.tt:71 +koha-tmpl/intranet-tmpl/prog/en/modules/admin/aqcontract.tt:154 +koha-tmpl/intranet-tmpl/prog/en/modules/admin/auth_subfields_structure.tt:293,361 +koha-tmpl/intranet-tmpl/prog/en/modules/admin/branch_transfer_limits.tt:33 +koha-tmpl/intranet-tmpl/prog/en/modules/admin/branches.tt:296 +koha-tmpl/intranet-tmpl/prog/en/modules/admin/patron-attr-types.tt:252 +koha-tmpl/intranet-tmpl/prog/en/modules/admin/authorised_values.tt:230,294 +koha-tmpl/intranet-tmpl/prog/en/modules/admin/smart-rules.tt:80 +koha-tmpl/intranet-tmpl/prog/en/modules/admin/desks.tt:156 +koha-tmpl/intranet-tmpl/prog/en/modules/admin/marctagstructure.tt:193 +koha-tmpl/intranet-tmpl/prog/en/modules/admin/marc-overlay-rules.tt:67 +=> stateless +koha-tmpl/intranet-tmpl/prog/en/modules/authorities/authorities.tt:393,397 +koha-tmpl/intranet-tmpl/prog/en/modules/cataloguing/addbiblio.tt:840,845,850 +koha-tmpl/intranet-tmpl/prog/en/modules/cataloguing/z3950_search.tt:258 +koha-tmpl/intranet-tmpl/prog/en/modules/cataloguing/moveitem.tt:47,91 +koha-tmpl/intranet-tmpl/prog/en/modules/cataloguing/z3950_auth_search.tt:152,182 +koha-tmpl/intranet-tmpl/prog/en/modules/cataloguing/value_builder/unimarc_field_686a.tt:14 +koha-tmpl/intranet-tmpl/prog/en/modules/cataloguing/value_builder/cn_browser.tt:20 +koha-tmpl/intranet-tmpl/prog/en/modules/suggestion/suggestion.tt:1001 +koha-tmpl/intranet-tmpl/prog/en/modules/members/paycollect.tt:16 +koha-tmpl/intranet-tmpl/prog/en/modules/members/routing-lists.tt:41 +koha-tmpl/intranet-tmpl/prog/en/modules/members/boraccount.tt:58,212,267,325 +koha-tmpl/intranet-tmpl/prog/en/modules/members/readingrec.tt:50 +koha-tmpl/intranet-tmpl/prog/en/modules/acqui/vendor_issues.tt:140 +koha-tmpl/intranet-tmpl/prog/en/modules/acqui/transferorder.tt:24 +koha-tmpl/intranet-tmpl/prog/en/modules/acqui/basket.tt:128,146,154,835,860 +koha-tmpl/intranet-tmpl/prog/en/modules/acqui/basketgroup.tt:363,365,403,404,405,406,409 +koha-tmpl/intranet-tmpl/prog/en/modules/acqui/parcel.tt:150,323 +koha-tmpl/intranet-tmpl/prog/en/modules/acqui/edi_ean.tt:31 +koha-tmpl/intranet-tmpl/prog/en/modules/acqui/parcels.tt:60,140,199 +koha-tmpl/intranet-tmpl/prog/en/modules/acqui/lateorders.tt:234 +koha-tmpl/intranet-tmpl/prog/en/modules/acqui/invoices.tt:304 +koha-tmpl/intranet-tmpl/prog/en/modules/catalogue/advsearch.tt:45 +koha-tmpl/intranet-tmpl/prog/en/modules/catalogue/detail.tt:1083 +koha-tmpl/intranet-tmpl/prog/en/modules/catalogue/itemsearch.tt:173 +koha-tmpl/intranet-tmpl/prog/en/modules/catalogue/results.tt:377,414,438,759,765 +koha-tmpl/intranet-tmpl/prog/en/modules/serials/subscription-frequencies.tt:122,128 +koha-tmpl/intranet-tmpl/prog/en/modules/serials/subscription-numberpatterns.tt:263,269 +koha-tmpl/intranet-tmpl/prog/en/modules/serials/checkexpiration.tt:33 +koha-tmpl/intranet-tmpl/prog/en/modules/serials/subscription-detail.tt:70 +koha-tmpl/intranet-tmpl/prog/en/modules/serials/subscription-bib-search.tt:13 +koha-tmpl/intranet-tmpl/prog/en/modules/circ/circulation.tt:360,370,375 +koha-tmpl/intranet-tmpl/prog/en/modules/circ/renew.tt:172 +koha-tmpl/intranet-tmpl/prog/en/modules/reports/reports-home.tt:28 +koha-tmpl/intranet-tmpl/prog/en/modules/reports/guided_reports_start.tt:410,415,420,968,1001,1405 +koha-tmpl/intranet-tmpl/prog/en/modules/tools/modborrowers.tt:138 +koha-tmpl/intranet-tmpl/prog/en/modules/tools/csv-profiles.tt:272 +koha-tmpl/intranet-tmpl/prog/en/modules/tools/letter.tt:132,502 +koha-tmpl/intranet-tmpl/prog/en/modules/tools/quotes.tt:93 +koha-tmpl/intranet-tmpl/prog/en/modules/tools/cleanborrowers.tt:65 +koha-tmpl/intranet-tmpl/prog/en/modules/tools/additional-contents.tt:137 +koha-tmpl/intranet-tmpl/prog/en/modules/labels/label-edit-layout.tt:63 +koha-tmpl/intranet-tmpl/prog/en/modules/labels/label-edit-template.tt:46 +koha-tmpl/intranet-tmpl/prog/en/modules/labels/label-edit-profile.tt:47 +koha-tmpl/intranet-tmpl/prog/en/modules/ill/ill-requests.tt:51 +koha-tmpl/intranet-tmpl/prog/en/modules/basket/basket.tt:71,261,339 +koha-tmpl/intranet-tmpl/prog/en/includes/cat-toolbar.inc:223 +koha-tmpl/intranet-tmpl/prog/en/includes/erm-search.inc:6,18,30,42 +koha-tmpl/intranet-tmpl/prog/en/includes/auth-finder-search.inc:8 +koha-tmpl/intranet-tmpl/prog/en/includes/serials-advsearch.inc:3 +koha-tmpl/intranet-tmpl/prog/en/includes/acquisitions-add-to-basket.inc:6 +koha-tmpl/intranet-tmpl/prog/en/includes/authorities-search.inc:76,103,130,155 +koha-tmpl/intranet-tmpl/prog/en/includes/suggestions-add-search.inc:7 +koha-tmpl/intranet-tmpl/prog/en/includes/serials-search.inc:6 +koha-tmpl/intranet-tmpl/prog/en/includes/catalogue-search-box.inc:10 +koha-tmpl/intranet-tmpl/prog/en/includes/subscriptions-search.inc:3 +koha-tmpl/intranet-tmpl/prog/en/includes/serials-toolbar.inc:106,152 +koha-tmpl/intranet-tmpl/prog/en/includes/mana/mana-subscription-search-result.inc:78 -- 2.25.1