View | Details | Raw Unified | Return to bug 34478
Collapse All | Expand All

(-)a/Koha/REST/V1/OAuth/Client.pm (-4 lines)
Lines 97-106 sub login { Link Here
97
            return $c->redirect_to( $uri . "?auth_error=$error" );
97
            return $c->redirect_to( $uri . "?auth_error=$error" );
98
        }
98
        }
99
    }
99
    }
100
    else {
101
        # initial request, generate CSRF token
102
        $state = Koha::Token->new->generate_csrf( { session_id => $c->req->cookie('CGISESSID')->value } );
103
    }
104
100
105
    return $c->oauth2->get_token_p( $provider => { ( !$is_callback ? ( state => $state ) : () ), redirect_uri => $redirect_url . $provider . "/" . $interface } )->then(
101
    return $c->oauth2->get_token_p( $provider => { ( !$is_callback ? ( state => $state ) : () ), redirect_uri => $redirect_url . $provider . "/" . $interface } )->then(
106
        sub {
102
        sub {
(-)a/authorities/authorities-home.pl (-5 lines)
Lines 110-120 if ( $op eq "do_search" ) { Link Here
110
    );
110
    );
111
111
112
    $template->param( search_query => $search_query ) if C4::Context->preference('DumpSearchQueryTemplate');
112
    $template->param( search_query => $search_query ) if C4::Context->preference('DumpSearchQueryTemplate');
113
    $template->param(
114
        csrf_token => Koha::Token->new->generate_csrf({
115
            session_id => scalar $query->cookie('CGISESSID'),
116
        }),
117
    );
118
113
119
    # search history
114
    # search history
120
    if (C4::Context->preference('EnableSearchHistory')) {
115
    if (C4::Context->preference('EnableSearchHistory')) {
(-)a/authorities/detail.pl (-1 lines)
Lines 230-236 $template->param( Link Here
230
    authtypetext    => $type ? $type->authtypetext: "",
230
    authtypetext    => $type ? $type->authtypetext: "",
231
    authtypecode    => $authtypecode,
231
    authtypecode    => $authtypecode,
232
    authority_types => $authority_types,
232
    authority_types => $authority_types,
233
    csrf_token      => Koha::Token->new->generate_csrf({ session_id => scalar $query->cookie('CGISESSID') }),
234
    servers => $servers,
233
    servers => $servers,
235
);
234
);
236
235
(-)a/basket/sendbasket.pl (-3 lines)
Lines 124-132 else { Link Here
124
        url            => "/cgi-bin/koha/basket/sendbasket.pl",
124
        url            => "/cgi-bin/koha/basket/sendbasket.pl",
125
        suggestion     => C4::Context->preference("suggestion"),
125
        suggestion     => C4::Context->preference("suggestion"),
126
        virtualshelves => C4::Context->preference("virtualshelves"),
126
        virtualshelves => C4::Context->preference("virtualshelves"),
127
        csrf_token     => Koha::Token->new->generate_csrf(
128
            { session_id => scalar $query->cookie('CGISESSID'), }
129
        ),
130
    );
127
    );
131
    output_html_with_http_headers $query, $cookie, $template->output;
128
    output_html_with_http_headers $query, $cookie, $template->output;
132
}
129
}
(-)a/circ/circulation.pl (-5 lines)
Lines 634-642 $template->param( Link Here
634
    logged_in_user            => $logged_in_user,
634
    logged_in_user            => $logged_in_user,
635
);
635
);
636
636
637
# Generate CSRF token for upload and delete image buttons
638
$template->param(
639
    csrf_token => Koha::Token->new->generate_csrf({ session_id => $query->cookie('CGISESSID'),}),
640
);
641
642
output_html_with_http_headers $query, $cookie, $template->output;
637
output_html_with_http_headers $query, $cookie, $template->output;
(-)a/ill/ill-requests.pl (-3 lines)
Lines 88-96 if ( $backends_available ) { Link Here
88
        $template->param(
88
        $template->param(
89
            notices    => $notices,
89
            notices    => $notices,
90
            request    => $request,
90
            request    => $request,
91
            csrf_token => Koha::Token->new->generate_csrf({
92
                session_id => scalar $cgi->cookie('CGISESSID'),
93
            }),
94
            ( $params->{tran_error} ?
91
            ( $params->{tran_error} ?
95
                ( tran_error => $params->{tran_error} ) : () ),
92
                ( tran_error => $params->{tran_error} ) : () ),
96
            ( $params->{tran_success} ?
93
            ( $params->{tran_success} ?
(-)a/members/apikeys.pl (-1 lines)
Lines 123-129 if ($op) { Link Here
123
123
124
$template->param(
124
$template->param(
125
    api_keys   => Koha::ApiKeys->search({ patron_id => $patron_id }),
125
    api_keys   => Koha::ApiKeys->search({ patron_id => $patron_id }),
126
    csrf_token => Koha::Token->new->generate_csrf({ session_id => scalar $cgi->cookie('CGISESSID') }),
127
    patron     => $patron
126
    patron     => $patron
128
);
127
);
129
128
(-)a/members/boraccount.pl (-5 lines)
Lines 244-253 foreach my $renew_result(@renew_results) { Link Here
244
    };
244
    };
245
}
245
}
246
246
247
my $csrf_token = Koha::Token->new->generate_csrf({
248
    session_id => scalar $input->cookie('CGISESSID'),
249
});
250
251
$template->param(
247
$template->param(
252
    patron              => $patron,
248
    patron              => $patron,
253
    finesview           => 1,
249
    finesview           => 1,
Lines 258-264 $template->param( Link Here
258
    change_given        => $change_given,
254
    change_given        => $change_given,
259
    renew_results       => $renew_results_display,
255
    renew_results       => $renew_results_display,
260
    receipt_sent        => $receipt_sent,
256
    receipt_sent        => $receipt_sent,
261
    csrf_token          => $csrf_token,
262
);
257
);
263
258
264
output_html_with_http_headers $input, $cookie, $template->output;
259
output_html_with_http_headers $input, $cookie, $template->output;
(-)a/members/deletemem.pl (-1 lines)
Lines 114-120 $template->param( Link Here
114
if ( $op eq 'delete_confirm' or $countissues > 0 or $debits or $is_guarantor ) {
114
if ( $op eq 'delete_confirm' or $countissues > 0 or $debits or $is_guarantor ) {
115
    $template->param(
115
    $template->param(
116
        op         => 'delete_confirm',
116
        op         => 'delete_confirm',
117
        csrf_token => Koha::Token->new->generate_csrf({ session_id => scalar $input->cookie('CGISESSID') }),
118
    );
117
    );
119
118
120
} elsif ( $op eq 'delete_confirmed' ) {
119
} elsif ( $op eq 'delete_confirmed' ) {
(-)a/members/mancredit.pl (-3 lines)
Lines 141-149 else { Link Here
141
        patron       => $patron,
141
        patron       => $patron,
142
        credit_types => \@credit_types,
142
        credit_types => \@credit_types,
143
        finesview    => 1,
143
        finesview    => 1,
144
        csrf_token   => Koha::Token->new->generate_csrf(
145
            { session_id => scalar $input->cookie('CGISESSID') }
146
        ),
147
        available_additional_fields => [ Koha::AdditionalFields->search({ tablename => 'accountlines:credit' })->as_list ],
144
        available_additional_fields => [ Koha::AdditionalFields->search({ tablename => 'accountlines:credit' })->as_list ],
148
    );
145
    );
149
    output_html_with_http_headers $input, $cookie, $template->output;
146
    output_html_with_http_headers $input, $cookie, $template->output;
(-)a/members/maninvoice.pl (-3 lines)
Lines 227-235 my $debit_types = Koha::Account::DebitTypes->search_with_library_limits( Link Here
227
227
228
$template->param(
228
$template->param(
229
  debit_types => $debit_types,
229
  debit_types => $debit_types,
230
  csrf_token  => Koha::Token->new->generate_csrf(
231
      { session_id => scalar $input->cookie('CGISESSID') }
232
  ),
233
  patron    => $patron,
230
  patron    => $patron,
234
  finesview => 1,
231
  finesview => 1,
235
  available_additional_fields => [ Koha::AdditionalFields->search({ tablename => 'accountlines:debit' })->as_list ],
232
  available_additional_fields => [ Koha::AdditionalFields->search({ tablename => 'accountlines:debit' })->as_list ],
(-)a/members/member-flags.pl (-2 lines)
Lines 181-188 if ($input->param('newflags')) { Link Here
181
$template->param(
181
$template->param(
182
    patron         => $patron,
182
    patron         => $patron,
183
    loop           => \@loop,
183
    loop           => \@loop,
184
    csrf_token =>
185
        Koha::Token->new->generate_csrf( { session_id => scalar $input->cookie('CGISESSID'), } ),
186
    disable_superlibrarian_privs => C4::Context->preference('ProtectSuperlibrarianPrivileges') ? !C4::Context->IsSuperLibrarian : 0,
184
    disable_superlibrarian_privs => C4::Context->preference('ProtectSuperlibrarianPrivileges') ? !C4::Context->IsSuperLibrarian : 0,
187
);
185
);
188
186
(-)a/members/member-password.pl (-1 lines)
Lines 97-103 if ( $newpassword and not @errors) { Link Here
97
$template->param(
97
$template->param(
98
    patron      => $patron,
98
    patron      => $patron,
99
    destination => $destination,
99
    destination => $destination,
100
    csrf_token  => Koha::Token->new->generate_csrf({ session_id => scalar $input->cookie('CGISESSID'), }),
101
);
100
);
102
101
103
if ( scalar(@errors) ) {
102
if ( scalar(@errors) ) {
(-)a/members/memberentry.pl (-5 lines)
Lines 768-778 $template->param( Link Here
768
  CanUpdatePasswordExpiration => $CanUpdatePasswordExpiration,
768
  CanUpdatePasswordExpiration => $CanUpdatePasswordExpiration,
769
  );
769
  );
770
770
771
# Generate CSRF token
772
$template->param( csrf_token =>
773
      Koha::Token->new->generate_csrf( { session_id => scalar $input->cookie('CGISESSID'), } ),
774
);
775
776
# HouseboundModule data
771
# HouseboundModule data
777
$template->param(
772
$template->param(
778
    housebound_role  => Koha::Patron::HouseboundRoles->find($borrowernumber),
773
    housebound_role  => Koha::Patron::HouseboundRoles->find($borrowernumber),
(-)a/members/moremember.pl (-5 lines)
Lines 128-138 if ( !$patron->is_valid_age ) { Link Here
128
    $template->param( age_high => $patron->category->upperagelimit );
128
    $template->param( age_high => $patron->category->upperagelimit );
129
}
129
}
130
130
131
# Generate CSRF token for upload and delete image buttons
132
$template->param(
133
    csrf_token => Koha::Token->new->generate_csrf({ session_id => $input->cookie('CGISESSID'),}),
134
);
135
136
if (C4::Context->preference('ExtendedPatronAttributes')) {
131
if (C4::Context->preference('ExtendedPatronAttributes')) {
137
    my @attributes = $patron->extended_attributes->as_list; # FIXME Must be improved!
132
    my @attributes = $patron->extended_attributes->as_list; # FIXME Must be improved!
138
    my @classes = uniq( map {$_->type->class} @attributes );
133
    my @classes = uniq( map {$_->type->class} @attributes );
(-)a/members/paycollect.pl (-2 lines)
Lines 282-289 $template->param( Link Here
282
    borrowernumber => $borrowernumber,    # some templates require global
282
    borrowernumber => $borrowernumber,    # some templates require global
283
    patron         => $patron,
283
    patron         => $patron,
284
    total          => $total_due,
284
    total          => $total_due,
285
286
    csrf_token => Koha::Token->new->generate_csrf( { session_id => scalar $input->cookie('CGISESSID') } ),
287
    available_additional_fields => [ Koha::AdditionalFields->search({ tablename => 'accountlines:credit' })->as_list ],
285
    available_additional_fields => [ Koha::AdditionalFields->search({ tablename => 'accountlines:credit' })->as_list ],
288
);
286
);
289
287
(-)a/members/two_factor_auth.pl (-3 lines)
Lines 84-92 else { Link Here
84
}
84
}
85
85
86
$template->param(
86
$template->param(
87
    csrf_token => Koha::Token->new->generate_csrf(
88
        { session_id => scalar $cgi->cookie('CGISESSID') }
89
    ),
90
    patron => $logged_in_user,
87
    patron => $logged_in_user,
91
    op     => $op,
88
    op     => $op,
92
);
89
);
(-)a/opac/opac-memberentry.pl (-9 lines)
Lines 323-331 elsif ( $action eq 'update' ) { Link Here
323
            empty_mandatory_fields => \@empty_mandatory_fields,
323
            empty_mandatory_fields => \@empty_mandatory_fields,
324
            invalid_form_fields    => $invalidformfields,
324
            invalid_form_fields    => $invalidformfields,
325
            borrower               => \%borrower,
325
            borrower               => \%borrower,
326
            csrf_token             => Koha::Token->new->generate_csrf({
327
                session_id => scalar $cgi->cookie('CGISESSID'),
328
            }),
329
        );
326
        );
330
        $template->param( patron_attribute_classes => GeneratePatronAttributesForm( $borrowernumber, $attributes ) );
327
        $template->param( patron_attribute_classes => GeneratePatronAttributesForm( $borrowernumber, $attributes ) );
331
328
Lines 371-379 elsif ( $action eq 'update' ) { Link Here
371
                nochanges => 1,
368
                nochanges => 1,
372
                borrower => $patron->unblessed,
369
                borrower => $patron->unblessed,
373
                patron_attribute_classes => GeneratePatronAttributesForm( $borrowernumber, $attributes ),
370
                patron_attribute_classes => GeneratePatronAttributesForm( $borrowernumber, $attributes ),
374
                csrf_token => Koha::Token->new->generate_csrf({
375
                    session_id => scalar $cgi->cookie('CGISESSID'),
376
                }),
377
            );
371
            );
378
        }
372
        }
379
    }
373
    }
Lines 385-393 elsif ( $action eq 'edit' ) { #Display logged in borrower's data Link Here
385
    $template->param(
379
    $template->param(
386
        borrower  => $borrower,
380
        borrower  => $borrower,
387
        hidden => GetHiddenFields( $mandatory, 'edit' ),
381
        hidden => GetHiddenFields( $mandatory, 'edit' ),
388
        csrf_token => Koha::Token->new->generate_csrf({
389
            session_id => scalar $cgi->cookie('CGISESSID'),
390
        }),
391
    );
382
    );
392
383
393
    if (C4::Context->preference('OPACpatronimages')) {
384
    if (C4::Context->preference('OPACpatronimages')) {
(-)a/opac/opac-messaging.pl (-5 lines)
Lines 92-102 if( $opac_messaging && C4::Context->preference("SMSSendDriver") eq 'Email' ) { Link Here
92
}
92
}
93
93
94
my $new_session_id = $query->cookie('CGISESSID');
94
my $new_session_id = $query->cookie('CGISESSID');
95
$template->param(
96
    csrf_token => Koha::Token->new->generate_csrf({
97
            session_id => $new_session_id,
98
        }),
99
);
100
95
101
if ( C4::Context->preference('TranslateNotices') ) {
96
if ( C4::Context->preference('TranslateNotices') ) {
102
    my $translated_languages = C4::Languages::getTranslatedLanguages( 'opac', C4::Context->preference('template') );
97
    my $translated_languages = C4::Languages::getTranslatedLanguages( 'opac', C4::Context->preference('template') );
(-)a/opac/opac-sendbasket.pl (-2 lines)
Lines 126-133 else { Link Here
126
        url            => "/cgi-bin/koha/opac-sendbasket.pl",
126
        url            => "/cgi-bin/koha/opac-sendbasket.pl",
127
        suggestion     => C4::Context->preference("suggestion"),
127
        suggestion     => C4::Context->preference("suggestion"),
128
        virtualshelves => C4::Context->preference("virtualshelves"),
128
        virtualshelves => C4::Context->preference("virtualshelves"),
129
        csrf_token =>
130
          Koha::Token->new->generate_csrf( { session_id => $new_session_id, } ),
131
    );
129
    );
132
    output_html_with_http_headers $query, $cookie, $template->output, undef,
130
    output_html_with_http_headers $query, $cookie, $template->output, undef,
133
      { force_no_caching => 1 };
131
      { force_no_caching => 1 };
(-)a/opac/opac-user.pl (-3 lines)
Lines 181-189 $template->param( Link Here
181
                    surname           => $borr->{surname},
181
                    surname           => $borr->{surname},
182
                    RENEW_ERROR       => $renew_error,
182
                    RENEW_ERROR       => $renew_error,
183
                    borrower          => $borr,
183
                    borrower          => $borr,
184
                    csrf_token             => Koha::Token->new->generate_csrf({
185
                        session_id => scalar $query->cookie('CGISESSID'),
186
                    }),
187
                );
184
                );
188
185
189
#get issued items ....
186
#get issued items ....
(-)a/opac/sco/sco-main.pl (-1 lines)
Lines 363-369 if ( $patron) { Link Here
363
        my $patron_image = $patron->image;
363
        my $patron_image = $patron->image;
364
        $template->param(
364
        $template->param(
365
            display_patron_image => 1,
365
            display_patron_image => 1,
366
            csrf_token           => Koha::Token->new->generate_csrf( { session_id => scalar $query->cookie('CGISESSID') . $patron->cardnumber, id => $patron->userid } ),
367
        ) if $patron_image;
366
        ) if $patron_image;
368
    }
367
    }
369
} else {
368
} else {
(-)a/tools/import_borrowers.pl (-7 lines)
Lines 176-188 else { Link Here
176
        }
176
        }
177
        $template->param( matchpoints => \@matchpoints );
177
        $template->param( matchpoints => \@matchpoints );
178
    }
178
    }
179
180
    $template->param(
181
        csrf_token => Koha::Token->new->generate_csrf(
182
            { session_id => scalar $input->cookie('CGISESSID'), }
183
        ),
184
    );
185
186
}
179
}
187
180
188
output_html_with_http_headers $input, $cookie, $template->output;
181
output_html_with_http_headers $input, $cookie, $template->output;
(-)a/tools/picture-upload.pl (-6 lines)
Lines 209-219 if ( $borrowernumber && !%errors && !$template->param('ERRORS') ) { Link Here
209
        "/cgi-bin/koha/members/moremember.pl?borrowernumber=$borrowernumber");
209
        "/cgi-bin/koha/members/moremember.pl?borrowernumber=$borrowernumber");
210
}
210
}
211
else {
211
else {
212
    $template->param(
213
        csrf_token => Koha::Token->new->generate_csrf({
214
            session_id => scalar $input->cookie('CGISESSID'),
215
        }),
216
    );
217
    output_html_with_http_headers $input, $cookie, $template->output;
212
    output_html_with_http_headers $input, $cookie, $template->output;
218
}
213
}
219
214
220
- 

Return to bug 34478