From 30b443c9a1eeda658544b0d7a7079aa2a32d8dec Mon Sep 17 00:00:00 2001
From: Jonathan Druart <jonathan.druart@bugs.koha-community.org>
Date: Fri, 4 Aug 2023 11:15:54 +0200
Subject: [PATCH] Bug 34478: Remove generate_csrf from pl

We do not longer need to generate_csrf from pl files

TODO - members/boraccount.tt and sco/sco-main.tt needs to be adjusted
---
 Koha/REST/V1/OAuth/Client.pm    | 4 ----
 authorities/authorities-home.pl | 5 -----
 authorities/detail.pl           | 1 -
 basket/sendbasket.pl            | 3 ---
 circ/circulation.pl             | 5 -----
 ill/ill-requests.pl             | 3 ---
 members/apikeys.pl              | 1 -
 members/boraccount.pl           | 5 -----
 members/deletemem.pl            | 1 -
 members/mancredit.pl            | 3 ---
 members/maninvoice.pl           | 3 ---
 members/member-flags.pl         | 2 --
 members/member-password.pl      | 1 -
 members/memberentry.pl          | 5 -----
 members/moremember.pl           | 5 -----
 members/paycollect.pl           | 2 --
 members/two_factor_auth.pl      | 3 ---
 opac/opac-memberentry.pl        | 9 ---------
 opac/opac-messaging.pl          | 5 -----
 opac/opac-sendbasket.pl         | 2 --
 opac/opac-user.pl               | 3 ---
 opac/sco/sco-main.pl            | 1 -
 tools/import_borrowers.pl       | 7 -------
 tools/picture-upload.pl         | 5 -----
 24 files changed, 84 deletions(-)

diff --git a/Koha/REST/V1/OAuth/Client.pm b/Koha/REST/V1/OAuth/Client.pm
index b6f66b022c0..fdae9e69978 100644
--- a/Koha/REST/V1/OAuth/Client.pm
+++ b/Koha/REST/V1/OAuth/Client.pm
@@ -97,10 +97,6 @@ sub login {
             return $c->redirect_to( $uri . "?auth_error=$error" );
         }
     }
-    else {
-        # initial request, generate CSRF token
-        $state = Koha::Token->new->generate_csrf( { session_id => $c->req->cookie('CGISESSID')->value } );
-    }
 
     return $c->oauth2->get_token_p( $provider => { ( !$is_callback ? ( state => $state ) : () ), redirect_uri => $redirect_url . $provider . "/" . $interface } )->then(
         sub {
diff --git a/authorities/authorities-home.pl b/authorities/authorities-home.pl
index e4f9bc471d4..c867069acff 100755
--- a/authorities/authorities-home.pl
+++ b/authorities/authorities-home.pl
@@ -110,11 +110,6 @@ if ( $op eq "do_search" ) {
     );
 
     $template->param( search_query => $search_query ) if C4::Context->preference('DumpSearchQueryTemplate');
-    $template->param(
-        csrf_token => Koha::Token->new->generate_csrf({
-            session_id => scalar $query->cookie('CGISESSID'),
-        }),
-    );
 
     # search history
     if (C4::Context->preference('EnableSearchHistory')) {
diff --git a/authorities/detail.pl b/authorities/detail.pl
index a95460958b3..8915781dbd5 100755
--- a/authorities/detail.pl
+++ b/authorities/detail.pl
@@ -230,7 +230,6 @@ $template->param(
     authtypetext    => $type ? $type->authtypetext: "",
     authtypecode    => $authtypecode,
     authority_types => $authority_types,
-    csrf_token      => Koha::Token->new->generate_csrf({ session_id => scalar $query->cookie('CGISESSID') }),
     servers => $servers,
 );
 
diff --git a/basket/sendbasket.pl b/basket/sendbasket.pl
index 3d5438fb427..6a54479691b 100755
--- a/basket/sendbasket.pl
+++ b/basket/sendbasket.pl
@@ -124,9 +124,6 @@ else {
         url            => "/cgi-bin/koha/basket/sendbasket.pl",
         suggestion     => C4::Context->preference("suggestion"),
         virtualshelves => C4::Context->preference("virtualshelves"),
-        csrf_token     => Koha::Token->new->generate_csrf(
-            { session_id => scalar $query->cookie('CGISESSID'), }
-        ),
     );
     output_html_with_http_headers $query, $cookie, $template->output;
 }
diff --git a/circ/circulation.pl b/circ/circulation.pl
index 9b925e29ad2..c9f1033bb36 100755
--- a/circ/circulation.pl
+++ b/circ/circulation.pl
@@ -634,9 +634,4 @@ $template->param(
     logged_in_user            => $logged_in_user,
 );
 
-# Generate CSRF token for upload and delete image buttons
-$template->param(
-    csrf_token => Koha::Token->new->generate_csrf({ session_id => $query->cookie('CGISESSID'),}),
-);
-
 output_html_with_http_headers $query, $cookie, $template->output;
diff --git a/ill/ill-requests.pl b/ill/ill-requests.pl
index fc7da417107..fbdcb386168 100755
--- a/ill/ill-requests.pl
+++ b/ill/ill-requests.pl
@@ -88,9 +88,6 @@ if ( $backends_available ) {
         $template->param(
             notices    => $notices,
             request    => $request,
-            csrf_token => Koha::Token->new->generate_csrf({
-                session_id => scalar $cgi->cookie('CGISESSID'),
-            }),
             ( $params->{tran_error} ?
                 ( tran_error => $params->{tran_error} ) : () ),
             ( $params->{tran_success} ?
diff --git a/members/apikeys.pl b/members/apikeys.pl
index 5f1cd271caf..883c1948862 100755
--- a/members/apikeys.pl
+++ b/members/apikeys.pl
@@ -123,7 +123,6 @@ if ($op) {
 
 $template->param(
     api_keys   => Koha::ApiKeys->search({ patron_id => $patron_id }),
-    csrf_token => Koha::Token->new->generate_csrf({ session_id => scalar $cgi->cookie('CGISESSID') }),
     patron     => $patron
 );
 
diff --git a/members/boraccount.pl b/members/boraccount.pl
index 72725b57f15..9d40d02dfa2 100755
--- a/members/boraccount.pl
+++ b/members/boraccount.pl
@@ -244,10 +244,6 @@ foreach my $renew_result(@renew_results) {
     };
 }
 
-my $csrf_token = Koha::Token->new->generate_csrf({
-    session_id => scalar $input->cookie('CGISESSID'),
-});
-
 $template->param(
     patron              => $patron,
     finesview           => 1,
@@ -258,7 +254,6 @@ $template->param(
     change_given        => $change_given,
     renew_results       => $renew_results_display,
     receipt_sent        => $receipt_sent,
-    csrf_token          => $csrf_token,
 );
 
 output_html_with_http_headers $input, $cookie, $template->output;
diff --git a/members/deletemem.pl b/members/deletemem.pl
index 31d930cc007..aedc5a6a4a0 100755
--- a/members/deletemem.pl
+++ b/members/deletemem.pl
@@ -114,7 +114,6 @@ $template->param(
 if ( $op eq 'delete_confirm' or $countissues > 0 or $debits or $is_guarantor ) {
     $template->param(
         op         => 'delete_confirm',
-        csrf_token => Koha::Token->new->generate_csrf({ session_id => scalar $input->cookie('CGISESSID') }),
     );
 
 } elsif ( $op eq 'delete_confirmed' ) {
diff --git a/members/mancredit.pl b/members/mancredit.pl
index e77c82defc9..bd422863fbc 100755
--- a/members/mancredit.pl
+++ b/members/mancredit.pl
@@ -141,9 +141,6 @@ else {
         patron       => $patron,
         credit_types => \@credit_types,
         finesview    => 1,
-        csrf_token   => Koha::Token->new->generate_csrf(
-            { session_id => scalar $input->cookie('CGISESSID') }
-        ),
         available_additional_fields => [ Koha::AdditionalFields->search({ tablename => 'accountlines:credit' })->as_list ],
     );
     output_html_with_http_headers $input, $cookie, $template->output;
diff --git a/members/maninvoice.pl b/members/maninvoice.pl
index 01464cf3a44..e622c553fa8 100755
--- a/members/maninvoice.pl
+++ b/members/maninvoice.pl
@@ -227,9 +227,6 @@ my $debit_types = Koha::Account::DebitTypes->search_with_library_limits(
 
 $template->param(
   debit_types => $debit_types,
-  csrf_token  => Koha::Token->new->generate_csrf(
-      { session_id => scalar $input->cookie('CGISESSID') }
-  ),
   patron    => $patron,
   finesview => 1,
   available_additional_fields => [ Koha::AdditionalFields->search({ tablename => 'accountlines:debit' })->as_list ],
diff --git a/members/member-flags.pl b/members/member-flags.pl
index 900a176ad51..3aa500b1c0d 100755
--- a/members/member-flags.pl
+++ b/members/member-flags.pl
@@ -181,8 +181,6 @@ if ($input->param('newflags')) {
 $template->param(
     patron         => $patron,
     loop           => \@loop,
-    csrf_token =>
-        Koha::Token->new->generate_csrf( { session_id => scalar $input->cookie('CGISESSID'), } ),
     disable_superlibrarian_privs => C4::Context->preference('ProtectSuperlibrarianPrivileges') ? !C4::Context->IsSuperLibrarian : 0,
 );
 
diff --git a/members/member-password.pl b/members/member-password.pl
index d44f29d0f77..9b6ebd23b6a 100755
--- a/members/member-password.pl
+++ b/members/member-password.pl
@@ -97,7 +97,6 @@ if ( $newpassword and not @errors) {
 $template->param(
     patron      => $patron,
     destination => $destination,
-    csrf_token  => Koha::Token->new->generate_csrf({ session_id => scalar $input->cookie('CGISESSID'), }),
 );
 
 if ( scalar(@errors) ) {
diff --git a/members/memberentry.pl b/members/memberentry.pl
index 64d9aa2aa7b..01d55e1003e 100755
--- a/members/memberentry.pl
+++ b/members/memberentry.pl
@@ -768,11 +768,6 @@ $template->param(
   CanUpdatePasswordExpiration => $CanUpdatePasswordExpiration,
   );
 
-# Generate CSRF token
-$template->param( csrf_token =>
-      Koha::Token->new->generate_csrf( { session_id => scalar $input->cookie('CGISESSID'), } ),
-);
-
 # HouseboundModule data
 $template->param(
     housebound_role  => Koha::Patron::HouseboundRoles->find($borrowernumber),
diff --git a/members/moremember.pl b/members/moremember.pl
index 5813c8d87f8..3eea151796c 100755
--- a/members/moremember.pl
+++ b/members/moremember.pl
@@ -128,11 +128,6 @@ if ( !$patron->is_valid_age ) {
     $template->param( age_high => $patron->category->upperagelimit );
 }
 
-# Generate CSRF token for upload and delete image buttons
-$template->param(
-    csrf_token => Koha::Token->new->generate_csrf({ session_id => $input->cookie('CGISESSID'),}),
-);
-
 if (C4::Context->preference('ExtendedPatronAttributes')) {
     my @attributes = $patron->extended_attributes->as_list; # FIXME Must be improved!
     my @classes = uniq( map {$_->type->class} @attributes );
diff --git a/members/paycollect.pl b/members/paycollect.pl
index b189107f25b..e90358ddd6c 100755
--- a/members/paycollect.pl
+++ b/members/paycollect.pl
@@ -282,8 +282,6 @@ $template->param(
     borrowernumber => $borrowernumber,    # some templates require global
     patron         => $patron,
     total          => $total_due,
-
-    csrf_token => Koha::Token->new->generate_csrf( { session_id => scalar $input->cookie('CGISESSID') } ),
     available_additional_fields => [ Koha::AdditionalFields->search({ tablename => 'accountlines:credit' })->as_list ],
 );
 
diff --git a/members/two_factor_auth.pl b/members/two_factor_auth.pl
index 81220c4b274..5a1e28860d1 100755
--- a/members/two_factor_auth.pl
+++ b/members/two_factor_auth.pl
@@ -84,9 +84,6 @@ else {
 }
 
 $template->param(
-    csrf_token => Koha::Token->new->generate_csrf(
-        { session_id => scalar $cgi->cookie('CGISESSID') }
-    ),
     patron => $logged_in_user,
     op     => $op,
 );
diff --git a/opac/opac-memberentry.pl b/opac/opac-memberentry.pl
index d18e5f542b6..c5fd48e112c 100755
--- a/opac/opac-memberentry.pl
+++ b/opac/opac-memberentry.pl
@@ -323,9 +323,6 @@ elsif ( $action eq 'update' ) {
             empty_mandatory_fields => \@empty_mandatory_fields,
             invalid_form_fields    => $invalidformfields,
             borrower               => \%borrower,
-            csrf_token             => Koha::Token->new->generate_csrf({
-                session_id => scalar $cgi->cookie('CGISESSID'),
-            }),
         );
         $template->param( patron_attribute_classes => GeneratePatronAttributesForm( $borrowernumber, $attributes ) );
 
@@ -371,9 +368,6 @@ elsif ( $action eq 'update' ) {
                 nochanges => 1,
                 borrower => $patron->unblessed,
                 patron_attribute_classes => GeneratePatronAttributesForm( $borrowernumber, $attributes ),
-                csrf_token => Koha::Token->new->generate_csrf({
-                    session_id => scalar $cgi->cookie('CGISESSID'),
-                }),
             );
         }
     }
@@ -385,9 +379,6 @@ elsif ( $action eq 'edit' ) {    #Display logged in borrower's data
     $template->param(
         borrower  => $borrower,
         hidden => GetHiddenFields( $mandatory, 'edit' ),
-        csrf_token => Koha::Token->new->generate_csrf({
-            session_id => scalar $cgi->cookie('CGISESSID'),
-        }),
     );
 
     if (C4::Context->preference('OPACpatronimages')) {
diff --git a/opac/opac-messaging.pl b/opac/opac-messaging.pl
index 3fef7eb862f..fd239a76144 100755
--- a/opac/opac-messaging.pl
+++ b/opac/opac-messaging.pl
@@ -92,11 +92,6 @@ if( $opac_messaging && C4::Context->preference("SMSSendDriver") eq 'Email' ) {
 }
 
 my $new_session_id = $query->cookie('CGISESSID');
-$template->param(
-    csrf_token => Koha::Token->new->generate_csrf({
-            session_id => $new_session_id,
-        }),
-);
 
 if ( C4::Context->preference('TranslateNotices') ) {
     my $translated_languages = C4::Languages::getTranslatedLanguages( 'opac', C4::Context->preference('template') );
diff --git a/opac/opac-sendbasket.pl b/opac/opac-sendbasket.pl
index ae0ec81e1c2..caf39811736 100755
--- a/opac/opac-sendbasket.pl
+++ b/opac/opac-sendbasket.pl
@@ -126,8 +126,6 @@ else {
         url            => "/cgi-bin/koha/opac-sendbasket.pl",
         suggestion     => C4::Context->preference("suggestion"),
         virtualshelves => C4::Context->preference("virtualshelves"),
-        csrf_token =>
-          Koha::Token->new->generate_csrf( { session_id => $new_session_id, } ),
     );
     output_html_with_http_headers $query, $cookie, $template->output, undef,
       { force_no_caching => 1 };
diff --git a/opac/opac-user.pl b/opac/opac-user.pl
index f5588c0aa35..5f86bed3d6a 100755
--- a/opac/opac-user.pl
+++ b/opac/opac-user.pl
@@ -181,9 +181,6 @@ $template->param(
                     surname           => $borr->{surname},
                     RENEW_ERROR       => $renew_error,
                     borrower          => $borr,
-                    csrf_token             => Koha::Token->new->generate_csrf({
-                        session_id => scalar $query->cookie('CGISESSID'),
-                    }),
                 );
 
 #get issued items ....
diff --git a/opac/sco/sco-main.pl b/opac/sco/sco-main.pl
index 9f70a415cc4..b945da700f4 100755
--- a/opac/sco/sco-main.pl
+++ b/opac/sco/sco-main.pl
@@ -363,7 +363,6 @@ if ( $patron) {
         my $patron_image = $patron->image;
         $template->param(
             display_patron_image => 1,
-            csrf_token           => Koha::Token->new->generate_csrf( { session_id => scalar $query->cookie('CGISESSID') . $patron->cardnumber, id => $patron->userid } ),
         ) if $patron_image;
     }
 } else {
diff --git a/tools/import_borrowers.pl b/tools/import_borrowers.pl
index a02f14dc40d..ffa452b7957 100755
--- a/tools/import_borrowers.pl
+++ b/tools/import_borrowers.pl
@@ -176,13 +176,6 @@ else {
         }
         $template->param( matchpoints => \@matchpoints );
     }
-
-    $template->param(
-        csrf_token => Koha::Token->new->generate_csrf(
-            { session_id => scalar $input->cookie('CGISESSID'), }
-        ),
-    );
-
 }
 
 output_html_with_http_headers $input, $cookie, $template->output;
diff --git a/tools/picture-upload.pl b/tools/picture-upload.pl
index 1f4c62b5de9..b1d09a6c881 100755
--- a/tools/picture-upload.pl
+++ b/tools/picture-upload.pl
@@ -209,11 +209,6 @@ if ( $borrowernumber && !%errors && !$template->param('ERRORS') ) {
         "/cgi-bin/koha/members/moremember.pl?borrowernumber=$borrowernumber");
 }
 else {
-    $template->param(
-        csrf_token => Koha::Token->new->generate_csrf({
-            session_id => scalar $input->cookie('CGISESSID'),
-        }),
-    );
     output_html_with_http_headers $input, $cookie, $template->output;
 }
 
-- 
2.25.1