From 4eb9cd35908b307db953037d63f50b4605e68552 Mon Sep 17 00:00:00 2001
From: Jonathan Druart <jonathan.druart@bugs.koha-community.org>
Date: Fri, 4 Aug 2023 10:56:50 +0200
Subject: [PATCH] Bug 34478: Replace csrf_token input with include file

perl -p -i -n -e 's#<input type="hidden" name="csrf_token" value="\[% csrf_token \| html %]" />#[% INCLUDE '\''csrf-token.inc'\'' %]#g' **/*.tt **/*.inc

This should have actually been done at the same time as
  "Bug 30524: (QA follow-up) Only generate CSRF token if it will be used"
---
 koha-tmpl/intranet-tmpl/prog/en/includes/circ-menu.inc      | 2 +-
 .../intranet-tmpl/prog/en/modules/basket/sendbasketform.tt  | 2 +-
 koha-tmpl/intranet-tmpl/prog/en/modules/members/apikeys.tt  | 6 +++---
 .../intranet-tmpl/prog/en/modules/members/deletemem.tt      | 2 +-
 .../intranet-tmpl/prog/en/modules/members/mancredit.tt      | 2 +-
 .../intranet-tmpl/prog/en/modules/members/maninvoice.tt     | 2 +-
 .../intranet-tmpl/prog/en/modules/members/member-flags.tt   | 2 +-
 .../prog/en/modules/members/member-password.tt              | 2 +-
 .../intranet-tmpl/prog/en/modules/members/memberentrygen.tt | 2 +-
 .../intranet-tmpl/prog/en/modules/members/paycollect.tt     | 6 +++---
 .../prog/en/modules/members/two_factor_auth.tt              | 2 +-
 .../intranet-tmpl/prog/en/modules/tools/import_borrowers.tt | 2 +-
 .../intranet-tmpl/prog/en/modules/tools/picture-upload.tt   | 2 +-
 .../opac-tmpl/bootstrap/en/modules/opac-memberentry.tt      | 2 +-
 koha-tmpl/opac-tmpl/bootstrap/en/modules/opac-messaging.tt  | 2 +-
 .../opac-tmpl/bootstrap/en/modules/opac-sendbasketform.tt   | 2 +-
 koha-tmpl/opac-tmpl/bootstrap/en/modules/opac-user.tt       | 2 +-
 17 files changed, 21 insertions(+), 21 deletions(-)

diff --git a/koha-tmpl/intranet-tmpl/prog/en/includes/circ-menu.inc b/koha-tmpl/intranet-tmpl/prog/en/includes/circ-menu.inc
index 3ed1cc52826..3ee86d767f3 100644
--- a/koha-tmpl/intranet-tmpl/prog/en/includes/circ-menu.inc
+++ b/koha-tmpl/intranet-tmpl/prog/en/includes/circ-menu.inc
@@ -255,7 +255,7 @@
                         </div>
                         <input type="hidden" name="uploadfilename" value="patron-photo.jpg" />
                         <textarea id="uploadfiletext" name="uploadfiletext" style="display:none;"></textarea>
-                        <input type="hidden" name="csrf_token" value="[% csrf_token | html %]" />
+                        [% INCLUDE 'csrf-token.inc' %]
                         <input type="hidden" name="filetype" value="image" />
                         <input type="hidden" name="cardnumber" value="[% patron.cardnumber | html %]" />
                         <input type="hidden" name="borrowernumber" value="[% patron.borrowernumber | html %]" />
diff --git a/koha-tmpl/intranet-tmpl/prog/en/modules/basket/sendbasketform.tt b/koha-tmpl/intranet-tmpl/prog/en/modules/basket/sendbasketform.tt
index 108aa1ea927..6d449fb77bc 100644
--- a/koha-tmpl/intranet-tmpl/prog/en/modules/basket/sendbasketform.tt
+++ b/koha-tmpl/intranet-tmpl/prog/en/modules/basket/sendbasketform.tt
@@ -33,7 +33,7 @@
     </fieldset>
     <fieldset class="action"> <input type="submit" class="btn btn-primary" value="Send" /> <a class="cancel close" href="#">Cancel</a> </fieldset>
     <input type="hidden" name="bib_list" value="[% bib_list | html %]" />
-    <input type="hidden" name="csrf_token" value="[% csrf_token | html %]" />
+    [% INCLUDE 'csrf-token.inc' %]
 </form>
 
 [% END %]</div>
diff --git a/koha-tmpl/intranet-tmpl/prog/en/modules/members/apikeys.tt b/koha-tmpl/intranet-tmpl/prog/en/modules/members/apikeys.tt
index 1471572aa22..cc1934b574f 100644
--- a/koha-tmpl/intranet-tmpl/prog/en/modules/members/apikeys.tt
+++ b/koha-tmpl/intranet-tmpl/prog/en/modules/members/apikeys.tt
@@ -62,7 +62,7 @@
 
                 <form id="add-api-key" action="/cgi-bin/koha/members/apikeys.pl" method="post" style="display:none">
                     <input type="hidden" name="patron_id" value="[% patron.id | html %]" />
-                    <input type="hidden" name="csrf_token" value="[% csrf_token | html %]" />
+                    [% INCLUDE 'csrf-token.inc' %]
                     <input type="hidden" name="op" value="generate" />
                     <fieldset class="brief">
                         <legend>Generate new client id/secret pair</legend>
@@ -101,14 +101,14 @@
                                             <form action="/cgi-bin/koha/members/apikeys.pl" method="post">
                                                 <input type="hidden" name="patron_id" value="[% patron.id | html %]" />
                                                 <input type="hidden" name="key" value="[% key.id | html %]" />
-                                                <input type="hidden" name="csrf_token" value="[% csrf_token | html %]" />
+                                                [% INCLUDE 'csrf-token.inc' %]
                                                 <input type="hidden" name="op" value="delete" />
                                                 <button class="btn btn-default btn-xs delete" type="submit"><i class="fa fa-trash-can"></i> Delete</button>
                                             </form>
                                             <form action="/cgi-bin/koha/members/apikeys.pl" method="post">
                                                 <input type="hidden" name="patron_id" value="[% patron.id | html %]" />
                                                 <input type="hidden" name="key" value="[% key.id | html %]" />
-                                                <input type="hidden" name="csrf_token" value="[% csrf_token | html %]" />
+                                                [% INCLUDE 'csrf-token.inc' %]
                                                 [% IF key.active %]
                                                     <input type="hidden" name="op" value="revoke" />
                                                     <button class="btn btn-default btn-xs" type="submit"><i class="fa fa-times"></i> Revoke</button>
diff --git a/koha-tmpl/intranet-tmpl/prog/en/modules/members/deletemem.tt b/koha-tmpl/intranet-tmpl/prog/en/modules/members/deletemem.tt
index db5ab432619..db3c0d3f40c 100644
--- a/koha-tmpl/intranet-tmpl/prog/en/modules/members/deletemem.tt
+++ b/koha-tmpl/intranet-tmpl/prog/en/modules/members/deletemem.tt
@@ -71,7 +71,7 @@
             <h1>Are you sure you want to delete the patron [% patron.firstname | html %] [% patron.surname | html %]?</h1>
             <p>This cannot be undone.</p>
             <form action="/cgi-bin/koha/members/deletemem.pl">
-                <input type="hidden" name="csrf_token" value="[% csrf_token | html %]" />
+                [% INCLUDE 'csrf-token.inc' %]
                 <input type="hidden" name="member" value="[% patron.borrowernumber | html %]"/>
                 <input type="hidden" name="op" value="delete_confirmed" />
                 <button type="submit" class="approve"><i class="fa fa-fw fa-check"></i> Yes, delete</button>
diff --git a/koha-tmpl/intranet-tmpl/prog/en/modules/members/mancredit.tt b/koha-tmpl/intranet-tmpl/prog/en/modules/members/mancredit.tt
index 7493987d219..2871a6d999d 100644
--- a/koha-tmpl/intranet-tmpl/prog/en/modules/members/mancredit.tt
+++ b/koha-tmpl/intranet-tmpl/prog/en/modules/members/mancredit.tt
@@ -66,7 +66,7 @@
                     <div role="tabpanel" class="tab-pane active">
                         <form action="/cgi-bin/koha/members/mancredit.pl" method="post" id="mancredit">
                             <input type="hidden" name="borrowernumber" id="borrowernumber" value="[% patron.borrowernumber | html %]" />
-                            <input type="hidden" name="csrf_token" value="[% csrf_token | html %]" />
+                            [% INCLUDE 'csrf-token.inc' %]
 
                             <fieldset class="rows">
                                 <legend>Manual credit</legend>
diff --git a/koha-tmpl/intranet-tmpl/prog/en/modules/members/maninvoice.tt b/koha-tmpl/intranet-tmpl/prog/en/modules/members/maninvoice.tt
index 8113199b46e..6e7e2e7fa67 100644
--- a/koha-tmpl/intranet-tmpl/prog/en/modules/members/maninvoice.tt
+++ b/koha-tmpl/intranet-tmpl/prog/en/modules/members/maninvoice.tt
@@ -75,7 +75,7 @@
                 [% END %]
                 <form action="/cgi-bin/koha/members/maninvoice.pl" method="post" id="maninvoice">
                     <input type="hidden" name="borrowernumber" id="borrowernumber" value="[% patron.borrowernumber | html %]" />
-                    <input type="hidden" name="csrf_token" value="[% csrf_token | html %]" />
+                    [% INCLUDE 'csrf-token.inc' %]
                     <fieldset class="rows">
                         <legend>Manual invoice</legend>
                         <ol>
diff --git a/koha-tmpl/intranet-tmpl/prog/en/modules/members/member-flags.tt b/koha-tmpl/intranet-tmpl/prog/en/modules/members/member-flags.tt
index e7deafe7613..a578aa46df6 100644
--- a/koha-tmpl/intranet-tmpl/prog/en/modules/members/member-flags.tt
+++ b/koha-tmpl/intranet-tmpl/prog/en/modules/members/member-flags.tt
@@ -40,7 +40,7 @@
 [% INCLUDE 'members-toolbar.inc' %]
 
 <form id="flag_form" method="post" action="/cgi-bin/koha/members/member-flags.pl">
-    <input type="hidden" name="csrf_token" value="[% csrf_token | html %]" />
+    [% INCLUDE 'csrf-token.inc' %]
     <input type="hidden" name="member" id="borrowernumber" value="[% patron.borrowernumber | html %]" />
     <input type="hidden" name="newflags" value="1" />
     <h1>Set permissions for [% INCLUDE 'patron-title.inc' no_html = 1 %]</h1>
diff --git a/koha-tmpl/intranet-tmpl/prog/en/modules/members/member-password.tt b/koha-tmpl/intranet-tmpl/prog/en/modules/members/member-password.tt
index 92020ee74b7..bd4208173f1 100644
--- a/koha-tmpl/intranet-tmpl/prog/en/modules/members/member-password.tt
+++ b/koha-tmpl/intranet-tmpl/prog/en/modules/members/member-password.tt
@@ -105,7 +105,7 @@
     <div class="hint">Koha cannot display existing passwords. Leave the field blank to leave password unchanged.</div>
 </fieldset>
     <fieldset class="action">
-        <input type="hidden" name="csrf_token" value="[% csrf_token | html %]" />
+        [% INCLUDE 'csrf-token.inc' %]
         <input type="submit" class="btn btn-primary" value="Save" />
         <a class="cancel" href="/cgi-bin/koha/members/moremember.pl?borrowernumber=[% patron.borrowernumber | html %]">Cancel</a>
     </fieldset>
diff --git a/koha-tmpl/intranet-tmpl/prog/en/modules/members/memberentrygen.tt b/koha-tmpl/intranet-tmpl/prog/en/modules/members/memberentrygen.tt
index e97a15fdc6c..3f1d2481554 100644
--- a/koha-tmpl/intranet-tmpl/prog/en/modules/members/memberentrygen.tt
+++ b/koha-tmpl/intranet-tmpl/prog/en/modules/members/memberentrygen.tt
@@ -239,7 +239,7 @@ legend:hover {
                             <input type="hidden" name="check_member" value="[% check_member | html %]" />
                             <input type="hidden" name="borrowernumber" value="[% borrowernumber | html UNLESS opduplicate %]" />
                             <input type="hidden" name="nodouble"  value="[% nodouble | html UNLESS opduplicate %]" />
-                            <input type="hidden" name="csrf_token" value="[% csrf_token | html %]" />
+                            [% INCLUDE 'csrf-token.inc' %]
                             [% IF ( step ) %]
                                 <input type="hidden" name="step"  value="[% step | html %]" />
                             [% END %]
diff --git a/koha-tmpl/intranet-tmpl/prog/en/modules/members/paycollect.tt b/koha-tmpl/intranet-tmpl/prog/en/modules/members/paycollect.tt
index 0c67b299ad6..1b4f2bf1c0b 100644
--- a/koha-tmpl/intranet-tmpl/prog/en/modules/members/paycollect.tt
+++ b/koha-tmpl/intranet-tmpl/prog/en/modules/members/paycollect.tt
@@ -135,7 +135,7 @@
     </ul>
 
     <form name="payindivfine" id="payindivfine" method="post" action="/cgi-bin/koha/members/paycollect.pl">
-    <input type="hidden" name="csrf_token" value="[% csrf_token | html %]" />
+    [% INCLUDE 'csrf-token.inc' %]
     <input type="hidden" name="borrowernumber" id="borrowernumber" value="[% patron.borrowernumber | html %]" />
     <input type="hidden" name="pay_individual" id="pay_individual" value="[% pay_individual | html %]" />
     <input type="hidden" name="itemnumber" id="itemnumber" value="[% itemnumber | html %]" />
@@ -231,7 +231,7 @@
     </ul>
 
     <form name="woindivfine" id="woindivfine" action="/cgi-bin/koha/members/pay.pl" method="post" >
-    <input type="hidden" name="csrf_token" value="[% csrf_token | html %]" />
+    [% INCLUDE 'csrf-token.inc' %]
     <fieldset class="rows">
     <legend>Write off an individual charge</legend>
     <input type="hidden" name="borrowernumber" id="borrowernumber" value="[% patron.borrowernumber | html %]" />
@@ -298,7 +298,7 @@
     [% END %]
 
     <form name="payfine" id="payfine" method="post" action="/cgi-bin/koha/members/paycollect.pl">
-    <input type="hidden" name="csrf_token" value="[% csrf_token | html %]" />
+    [% INCLUDE 'csrf-token.inc' %]
     <input type="hidden" name="borrowernumber" id="borrowernumber" value="[% patron.borrowernumber | html %]" />
     <input type="hidden" name="selected_accts" id="selected_accts" value="[% selected_accts | html %]" />
     <input type="hidden" name="total" id="total" value="[% total | html %]" />
diff --git a/koha-tmpl/intranet-tmpl/prog/en/modules/members/two_factor_auth.tt b/koha-tmpl/intranet-tmpl/prog/en/modules/members/two_factor_auth.tt
index 274cafcb5db..56bccadf09c 100644
--- a/koha-tmpl/intranet-tmpl/prog/en/modules/members/two_factor_auth.tt
+++ b/koha-tmpl/intranet-tmpl/prog/en/modules/members/two_factor_auth.tt
@@ -58,7 +58,7 @@
                             <div class="two-factor-status">Status: Enabled</div>
 
                             <form id="two-factor-auth" action="/cgi-bin/koha/members/two_factor_auth.pl" method="post">
-                                <input type="hidden" name="csrf_token" value="[% csrf_token | html %]" />
+                                [% INCLUDE 'csrf-token.inc' %]
                                 <input type="hidden" name="op" value="disable-2FA" />
                                 <input type="submit" value="Disable two-factor authentication" />
                             </form>
diff --git a/koha-tmpl/intranet-tmpl/prog/en/modules/tools/import_borrowers.tt b/koha-tmpl/intranet-tmpl/prog/en/modules/tools/import_borrowers.tt
index 4366ae46556..53050a7e362 100644
--- a/koha-tmpl/intranet-tmpl/prog/en/modules/tools/import_borrowers.tt
+++ b/koha-tmpl/intranet-tmpl/prog/en/modules/tools/import_borrowers.tt
@@ -356,7 +356,7 @@
         </fieldset>
 
         <fieldset class="action">
-            <input type="hidden" name="csrf_token" value="[% csrf_token | html %]" />
+            [% INCLUDE 'csrf-token.inc' %]
             <input type="submit" class="btn btn-primary" value="Import" />
         </fieldset>
     </form>
diff --git a/koha-tmpl/intranet-tmpl/prog/en/modules/tools/picture-upload.tt b/koha-tmpl/intranet-tmpl/prog/en/modules/tools/picture-upload.tt
index 91d7264f02d..96628472123 100644
--- a/koha-tmpl/intranet-tmpl/prog/en/modules/tools/picture-upload.tt
+++ b/koha-tmpl/intranet-tmpl/prog/en/modules/tools/picture-upload.tt
@@ -148,7 +148,7 @@
                         </ol>
 	            </fieldset>
                     <fieldset class="action">
-                        <input type="hidden" name="csrf_token" value="[% csrf_token | html %]" />
+                        [% INCLUDE 'csrf-token.inc' %]
                         <input type="hidden" name="op" value="Upload" />
                         <input type="submit" class="btn btn-primary" value="Upload" />
 						<a href="/cgi-bin/koha/tools/tools-home.pl" class="cancel">Cancel</a>
diff --git a/koha-tmpl/opac-tmpl/bootstrap/en/modules/opac-memberentry.tt b/koha-tmpl/opac-tmpl/bootstrap/en/modules/opac-memberentry.tt
index 2dc0cb9634e..a57bc0c9321 100644
--- a/koha-tmpl/opac-tmpl/bootstrap/en/modules/opac-memberentry.tt
+++ b/koha-tmpl/opac-tmpl/bootstrap/en/modules/opac-memberentry.tt
@@ -1053,7 +1053,7 @@
                                 [% IF OPACPatronDetails %]
                                     <fieldset class="action">
                                         <input type="hidden" name="action" value="update" />
-                                        <input type="hidden" name="csrf_token" value="[% csrf_token | html %]" />
+                                        [% INCLUDE 'csrf-token.inc' %]
                                         <input type="submit" class="btn btn-primary" value="Submit update request" />
                                     </fieldset>
                                 [% END %]
diff --git a/koha-tmpl/opac-tmpl/bootstrap/en/modules/opac-messaging.tt b/koha-tmpl/opac-tmpl/bootstrap/en/modules/opac-messaging.tt
index cf3dd4c555b..07f60d1b3f2 100644
--- a/koha-tmpl/opac-tmpl/bootstrap/en/modules/opac-messaging.tt
+++ b/koha-tmpl/opac-tmpl/bootstrap/en/modules/opac-messaging.tt
@@ -41,7 +41,7 @@
                         <div class="alert alert-success"><p><strong>Settings updated</strong></p></div>
                         [% END %]
                         <form action="/cgi-bin/koha/opac-messaging.pl" method="post" name="opacmessaging">
-                            <input type="hidden" name="csrf_token" value="[% csrf_token | html %]" />
+                            [% INCLUDE 'csrf-token.inc' %]
                             <input type="hidden" name="modify" value="yes" />
 
                             [% IF Koha.Preference( 'EnhancedMessagingPreferencesOPAC' )  %]
diff --git a/koha-tmpl/opac-tmpl/bootstrap/en/modules/opac-sendbasketform.tt b/koha-tmpl/opac-tmpl/bootstrap/en/modules/opac-sendbasketform.tt
index 577f1495036..2f1ef6bbcec 100644
--- a/koha-tmpl/opac-tmpl/bootstrap/en/modules/opac-sendbasketform.tt
+++ b/koha-tmpl/opac-tmpl/bootstrap/en/modules/opac-sendbasketform.tt
@@ -35,7 +35,7 @@
                                     <label for="comment">Comment:</label>
                                     <textarea id="comment" name="comment" rows="4" cols="40" class="form-control"></textarea>
                                     <input type="hidden" name="bib_list" value="[% bib_list | html %]" />
-                                    <input type="hidden" name="csrf_token" value="[% csrf_token | html %]" />
+                                    [% INCLUDE 'csrf-token.inc' %]
                                 </fieldset>
                                 [% IF Koha.Preference('OPACHoldRequests') || Koha.Preference('OpacRenewalAllowed') %]<p id="donotrequestbymail">Please do not use this mail to request or renew books.</p>[% END %]
                                 <fieldset class="action">
diff --git a/koha-tmpl/opac-tmpl/bootstrap/en/modules/opac-user.tt b/koha-tmpl/opac-tmpl/bootstrap/en/modules/opac-user.tt
index 7ce019a54da..e2801bf32a7 100644
--- a/koha-tmpl/opac-tmpl/bootstrap/en/modules/opac-user.tt
+++ b/koha-tmpl/opac-tmpl/bootstrap/en/modules/opac-user.tt
@@ -245,7 +245,7 @@
                                         <input type="radio" id="no-autorenew_checkouts" name="borrower_autorenew_checkouts" value="0" checked="checked" />
                                     </label>
                                 [% END %]
-                        <input type="hidden" name="csrf_token" value="[% csrf_token | html %]" />
+                        [% INCLUDE 'csrf-token.inc' %]
                         <input type="hidden" name="update_arc" value="1" />
                         <input type="submit" value="Update auto-renewal preference" />
                     </form>
-- 
2.25.1