From a203812b29c0d133293ad9607d8ea8c6270a112c Mon Sep 17 00:00:00 2001 From: Lucas Gass Date: Tue, 29 Aug 2023 22:16:13 +0000 Subject: [PATCH] Bug 34650: Add CSRF token to edit/delete toolbar links To test: 1. Add a list 2. Go to that list ( virtualshelves/shelves.pl?op=view&shelfnumber=X ) 3. From the toolbar click the 'Edit' dropdown. 4. From the dropdown try either 'Edit list' or 'Delete list'. 5. CSRF error 6. APPLY PATCH 7. Try 2 - 4 again, no more error. --- .../prog/en/includes/virtualshelves-toolbar.inc | 4 ++-- virtualshelves/shelves.pl | 8 ++++++++ 2 files changed, 10 insertions(+), 2 deletions(-) diff --git a/koha-tmpl/intranet-tmpl/prog/en/includes/virtualshelves-toolbar.inc b/koha-tmpl/intranet-tmpl/prog/en/includes/virtualshelves-toolbar.inc index 1bafe9d1c6..525cfc56aa 100644 --- a/koha-tmpl/intranet-tmpl/prog/en/includes/virtualshelves-toolbar.inc +++ b/koha-tmpl/intranet-tmpl/prog/en/includes/virtualshelves-toolbar.inc @@ -16,8 +16,8 @@
[% END %] diff --git a/virtualshelves/shelves.pl b/virtualshelves/shelves.pl index 33564f8333..67b382a548 100755 --- a/virtualshelves/shelves.pl +++ b/virtualshelves/shelves.pl @@ -39,6 +39,7 @@ use Koha::ItemTypes; use Koha::CsvProfiles; use Koha::Patrons; use Koha::Virtualshelves; +use Koha::Token; use constant ANYONE => 2; use constant STAFF => 3; @@ -385,6 +386,12 @@ if ( $op eq 'view' ) { # this check only serves for button display } +my $csrf_token = Koha::Token->new->generate_csrf( + { + session_id => scalar $query->cookie('CGISESSID'), + } +); + $template->param( op => $op, referer => $referer, @@ -394,6 +401,7 @@ $template->param( print => scalar $query->param('print') || 0, csv_profiles => [ Koha::CsvProfiles->search({ type => 'marc', used_for => 'export_records' })->as_list ], allow_transfer => $allow_transfer, + csrf_token => $csrf_token, ); output_html_with_http_headers $query, $cookie, $template->output; -- 2.30.2