From 21ef447d3226997b70b29b1e8c82008b8e86bef2 Mon Sep 17 00:00:00 2001
From: Jonathan Druart <jonathan.druart@bugs.koha-community.org>
Date: Fri, 4 Aug 2023 10:45:07 +0200
Subject: [PATCH] Bug 34478: Add a script to add missing csrf to post forms -
 csrf_add_missing_csrf

---
 csrf_add_missing_csrf.pl | 71 ++++++++++++++++++++++++++++++++++++++++
 1 file changed, 71 insertions(+)
 create mode 100644 csrf_add_missing_csrf.pl

diff --git a/csrf_add_missing_csrf.pl b/csrf_add_missing_csrf.pl
new file mode 100644
index 00000000000..28d142f848b
--- /dev/null
+++ b/csrf_add_missing_csrf.pl
@@ -0,0 +1,71 @@
+#!/usr/bin/perl
+
+use Modern::Perl;
+use File::Find;
+use File::Slurp;
+use Data::Dumper;
+
+my @themes;
+
+# OPAC themes
+my $opac_dir  = 'koha-tmpl/opac-tmpl';
+opendir ( my $dh, $opac_dir ) or die "can't opendir $opac_dir: $!";
+for my $theme ( grep { not /^\.|lib|js|xslt/ } readdir($dh) ) {
+    push @themes, "$opac_dir/$theme/en";
+}
+close $dh;
+
+# STAFF themes
+my $staff_dir = 'koha-tmpl/intranet-tmpl';
+opendir ( $dh, $staff_dir ) or die "can't opendir $staff_dir: $!";
+for my $theme ( grep { not /^\.|lib|js/ } readdir($dh) ) {
+    push @themes, "$staff_dir/$theme/en";
+}
+close $dh;
+
+my @files;
+sub wanted {
+    my $name = $File::Find::name;
+    push @files, $name
+        if $name =~ m[\.(tt|inc)$] and -f $name;
+}
+
+find({ wanted => \&wanted, no_chdir => 1 }, @themes );
+
+my @errors;
+for my $file ( @files ) {
+    add_csrf_token($file);
+}
+
+sub add_csrf_token {
+    my ( $file ) = @_;
+
+    my $csrf_include = "[% INCLUDE 'csrf-token.inc' %]\n";
+    my @lines = read_file($file);
+    my @new_lines = @lines;
+    return unless grep { $_ =~ m|<form| } @lines;
+    my ( $in_form, $closed_form, $line_open_form, $has_csrf_token );
+    my ( $line_number, $number_replaced_forms ) = (0, 0);
+    my $spacing = q{};
+    for my $line (@lines) {
+        $line_number++;
+        if ( $line =~ m{^(\s*)<form.*method=('|")post('|")}i ) {
+            $spacing = $1 . "    ";
+            $in_form = 1;
+            $line_open_form = $line_number;
+        }
+        if ( $in_form && $line =~ m{name="csrf_token"}) {
+            $has_csrf_token = 1;
+        }
+        if ( $in_form && $line =~ m{</form} ) {
+            $closed_form = 0;
+            unless ( $has_csrf_token ) {
+                splice @new_lines, $line_open_form + $number_replaced_forms, 0, $spacing . $csrf_include;
+                $number_replaced_forms++;
+            }
+            $in_form = 0;
+            $has_csrf_token = 0;
+        }
+    }
+    write_file($file, @new_lines);
+}
-- 
2.25.1