View | Details | Raw Unified | Return to bug 34478
Collapse All | Expand All

(-)a/Koha/REST/V1/OAuth/Client.pm (-4 lines)
Lines 97-106 sub login { Link Here
97
            return $c->redirect_to( $uri . "?auth_error=$error" );
97
            return $c->redirect_to( $uri . "?auth_error=$error" );
98
        }
98
        }
99
    }
99
    }
100
    else {
101
        # initial request, generate CSRF token
102
        $state = Koha::Token->new->generate_csrf( { session_id => $c->req->cookie('CGISESSID')->value } );
103
    }
104
100
105
    return $c->oauth2->get_token_p( $provider => { ( !$is_callback ? ( state => $state ) : () ), redirect_uri => $redirect_url . $provider . "/" . $interface } )->then(
101
    return $c->oauth2->get_token_p( $provider => { ( !$is_callback ? ( state => $state ) : () ), redirect_uri => $redirect_url . $provider . "/" . $interface } )->then(
106
        sub {
102
        sub {
(-)a/authorities/authorities-home.pl (-5 lines)
Lines 113-123 if ( $op eq "do_search" ) { Link Here
113
    }
113
    }
114
114
115
    $template->param( search_query => $search_query ) if C4::Context->preference('DumpSearchQueryTemplate');
115
    $template->param( search_query => $search_query ) if C4::Context->preference('DumpSearchQueryTemplate');
116
    $template->param(
117
        csrf_token => Koha::Token->new->generate_csrf({
118
            session_id => scalar $query->cookie('CGISESSID'),
119
        }),
120
    );
121
116
122
    # search history
117
    # search history
123
    if (C4::Context->preference('EnableSearchHistory')) {
118
    if (C4::Context->preference('EnableSearchHistory')) {
(-)a/authorities/detail.pl (-1 lines)
Lines 230-236 $template->param( Link Here
230
    authtypetext    => $type ? $type->authtypetext: "",
230
    authtypetext    => $type ? $type->authtypetext: "",
231
    authtypecode    => $authtypecode,
231
    authtypecode    => $authtypecode,
232
    authority_types => $authority_types,
232
    authority_types => $authority_types,
233
    csrf_token      => Koha::Token->new->generate_csrf({ session_id => scalar $query->cookie('CGISESSID') }),
234
    servers => $servers,
233
    servers => $servers,
235
);
234
);
236
235
(-)a/basket/sendbasket.pl (-3 lines)
Lines 124-132 else { Link Here
124
        url            => "/cgi-bin/koha/basket/sendbasket.pl",
124
        url            => "/cgi-bin/koha/basket/sendbasket.pl",
125
        suggestion     => C4::Context->preference("suggestion"),
125
        suggestion     => C4::Context->preference("suggestion"),
126
        virtualshelves => C4::Context->preference("virtualshelves"),
126
        virtualshelves => C4::Context->preference("virtualshelves"),
127
        csrf_token     => Koha::Token->new->generate_csrf(
128
            { session_id => scalar $query->cookie('CGISESSID'), }
129
        ),
130
    );
127
    );
131
    output_html_with_http_headers $query, $cookie, $template->output;
128
    output_html_with_http_headers $query, $cookie, $template->output;
132
}
129
}
(-)a/circ/circulation.pl (-5 lines)
Lines 634-642 $template->param( Link Here
634
    logged_in_user            => $logged_in_user,
634
    logged_in_user            => $logged_in_user,
635
);
635
);
636
636
637
# Generate CSRF token for upload and delete image buttons
638
$template->param(
639
    csrf_token => Koha::Token->new->generate_csrf({ session_id => $query->cookie('CGISESSID'),}),
640
);
641
642
output_html_with_http_headers $query, $cookie, $template->output;
637
output_html_with_http_headers $query, $cookie, $template->output;
(-)a/ill/ill-requests.pl (-3 lines)
Lines 89-97 if ( $backends_available ) { Link Here
89
        $template->param(
89
        $template->param(
90
            notices    => $notices,
90
            notices    => $notices,
91
            request    => $request,
91
            request    => $request,
92
            csrf_token => Koha::Token->new->generate_csrf({
93
                session_id => scalar $cgi->cookie('CGISESSID'),
94
            }),
95
            ( $params->{tran_error} ?
92
            ( $params->{tran_error} ?
96
                ( tran_error => $params->{tran_error} ) : () ),
93
                ( tran_error => $params->{tran_error} ) : () ),
97
            ( $params->{tran_success} ?
94
            ( $params->{tran_success} ?
(-)a/members/apikeys.pl (-1 lines)
Lines 123-129 if ($op) { Link Here
123
123
124
$template->param(
124
$template->param(
125
    api_keys   => Koha::ApiKeys->search({ patron_id => $patron_id }),
125
    api_keys   => Koha::ApiKeys->search({ patron_id => $patron_id }),
126
    csrf_token => Koha::Token->new->generate_csrf({ session_id => scalar $cgi->cookie('CGISESSID') }),
127
    patron     => $patron
126
    patron     => $patron
128
);
127
);
129
128
(-)a/members/boraccount.pl (-5 lines)
Lines 244-253 foreach my $renew_result(@renew_results) { Link Here
244
    };
244
    };
245
}
245
}
246
246
247
my $csrf_token = Koha::Token->new->generate_csrf({
248
    session_id => scalar $input->cookie('CGISESSID'),
249
});
250
251
$template->param(
247
$template->param(
252
    patron              => $patron,
248
    patron              => $patron,
253
    finesview           => 1,
249
    finesview           => 1,
Lines 258-264 $template->param( Link Here
258
    change_given        => $change_given,
254
    change_given        => $change_given,
259
    renew_results       => $renew_results_display,
255
    renew_results       => $renew_results_display,
260
    receipt_sent        => $receipt_sent,
256
    receipt_sent        => $receipt_sent,
261
    csrf_token          => $csrf_token,
262
);
257
);
263
258
264
output_html_with_http_headers $input, $cookie, $template->output;
259
output_html_with_http_headers $input, $cookie, $template->output;
(-)a/members/deletemem.pl (-1 lines)
Lines 114-120 $template->param( Link Here
114
if ( $op eq 'delete_confirm' or $countissues > 0 or $debits or $is_guarantor ) {
114
if ( $op eq 'delete_confirm' or $countissues > 0 or $debits or $is_guarantor ) {
115
    $template->param(
115
    $template->param(
116
        op         => 'delete_confirm',
116
        op         => 'delete_confirm',
117
        csrf_token => Koha::Token->new->generate_csrf({ session_id => scalar $input->cookie('CGISESSID') }),
118
    );
117
    );
119
118
120
} elsif ( $op eq 'delete_confirmed' ) {
119
} elsif ( $op eq 'delete_confirmed' ) {
(-)a/members/mancredit.pl (-3 lines)
Lines 141-149 else { Link Here
141
        patron       => $patron,
141
        patron       => $patron,
142
        credit_types => \@credit_types,
142
        credit_types => \@credit_types,
143
        finesview    => 1,
143
        finesview    => 1,
144
        csrf_token   => Koha::Token->new->generate_csrf(
145
            { session_id => scalar $input->cookie('CGISESSID') }
146
        ),
147
        available_additional_fields => [ Koha::AdditionalFields->search({ tablename => 'accountlines:credit' })->as_list ],
144
        available_additional_fields => [ Koha::AdditionalFields->search({ tablename => 'accountlines:credit' })->as_list ],
148
    );
145
    );
149
    output_html_with_http_headers $input, $cookie, $template->output;
146
    output_html_with_http_headers $input, $cookie, $template->output;
(-)a/members/maninvoice.pl (-3 lines)
Lines 227-235 my $debit_types = Koha::Account::DebitTypes->search_with_library_limits( Link Here
227
227
228
$template->param(
228
$template->param(
229
  debit_types => $debit_types,
229
  debit_types => $debit_types,
230
  csrf_token  => Koha::Token->new->generate_csrf(
231
      { session_id => scalar $input->cookie('CGISESSID') }
232
  ),
233
  patron    => $patron,
230
  patron    => $patron,
234
  finesview => 1,
231
  finesview => 1,
235
  available_additional_fields => [ Koha::AdditionalFields->search({ tablename => 'accountlines:debit' })->as_list ],
232
  available_additional_fields => [ Koha::AdditionalFields->search({ tablename => 'accountlines:debit' })->as_list ],
(-)a/members/member-flags.pl (-2 lines)
Lines 181-188 if ($input->param('newflags')) { Link Here
181
$template->param(
181
$template->param(
182
    patron         => $patron,
182
    patron         => $patron,
183
    loop           => \@loop,
183
    loop           => \@loop,
184
    csrf_token =>
185
        Koha::Token->new->generate_csrf( { session_id => scalar $input->cookie('CGISESSID'), } ),
186
    disable_superlibrarian_privs => C4::Context->preference('ProtectSuperlibrarianPrivileges') ? !C4::Context->IsSuperLibrarian : 0,
184
    disable_superlibrarian_privs => C4::Context->preference('ProtectSuperlibrarianPrivileges') ? !C4::Context->IsSuperLibrarian : 0,
187
);
185
);
188
186
(-)a/members/member-password.pl (-1 lines)
Lines 97-103 if ( $newpassword and not @errors) { Link Here
97
$template->param(
97
$template->param(
98
    patron      => $patron,
98
    patron      => $patron,
99
    destination => $destination,
99
    destination => $destination,
100
    csrf_token  => Koha::Token->new->generate_csrf({ session_id => scalar $input->cookie('CGISESSID'), }),
101
);
100
);
102
101
103
if ( scalar(@errors) ) {
102
if ( scalar(@errors) ) {
(-)a/members/memberentry.pl (-5 lines)
Lines 772-782 $template->param( Link Here
772
  CanUpdatePasswordExpiration => $CanUpdatePasswordExpiration,
772
  CanUpdatePasswordExpiration => $CanUpdatePasswordExpiration,
773
  );
773
  );
774
774
775
# Generate CSRF token
776
$template->param( csrf_token =>
777
      Koha::Token->new->generate_csrf( { session_id => scalar $input->cookie('CGISESSID'), } ),
778
);
779
780
# HouseboundModule data
775
# HouseboundModule data
781
$template->param(
776
$template->param(
782
    housebound_role  => Koha::Patron::HouseboundRoles->find($borrowernumber),
777
    housebound_role  => Koha::Patron::HouseboundRoles->find($borrowernumber),
(-)a/members/moremember.pl (-5 lines)
Lines 128-138 if ( !$patron->is_valid_age ) { Link Here
128
    $template->param( age_high => $patron->category->upperagelimit );
128
    $template->param( age_high => $patron->category->upperagelimit );
129
}
129
}
130
130
131
# Generate CSRF token for upload and delete image buttons
132
$template->param(
133
    csrf_token => Koha::Token->new->generate_csrf({ session_id => $input->cookie('CGISESSID'),}),
134
);
135
136
if (C4::Context->preference('ExtendedPatronAttributes')) {
131
if (C4::Context->preference('ExtendedPatronAttributes')) {
137
    my @attributes = $patron->extended_attributes->as_list; # FIXME Must be improved!
132
    my @attributes = $patron->extended_attributes->as_list; # FIXME Must be improved!
138
    my @classes = uniq( map {$_->type->class} @attributes );
133
    my @classes = uniq( map {$_->type->class} @attributes );
(-)a/members/paycollect.pl (-2 lines)
Lines 282-289 $template->param( Link Here
282
    borrowernumber => $borrowernumber,    # some templates require global
282
    borrowernumber => $borrowernumber,    # some templates require global
283
    patron         => $patron,
283
    patron         => $patron,
284
    total          => $total_due,
284
    total          => $total_due,
285
286
    csrf_token => Koha::Token->new->generate_csrf( { session_id => scalar $input->cookie('CGISESSID') } ),
287
    available_additional_fields => [ Koha::AdditionalFields->search({ tablename => 'accountlines:credit' })->as_list ],
285
    available_additional_fields => [ Koha::AdditionalFields->search({ tablename => 'accountlines:credit' })->as_list ],
288
);
286
);
289
287
(-)a/members/two_factor_auth.pl (-3 lines)
Lines 84-92 else { Link Here
84
}
84
}
85
85
86
$template->param(
86
$template->param(
87
    csrf_token => Koha::Token->new->generate_csrf(
88
        { session_id => scalar $cgi->cookie('CGISESSID') }
89
    ),
90
    patron => $logged_in_user,
87
    patron => $logged_in_user,
91
    op     => $op,
88
    op     => $op,
92
);
89
);
(-)a/opac/opac-memberentry.pl (-9 lines)
Lines 331-339 elsif ( $action eq 'update' ) { Link Here
331
            empty_mandatory_fields => \@empty_mandatory_fields,
331
            empty_mandatory_fields => \@empty_mandatory_fields,
332
            invalid_form_fields    => $invalidformfields,
332
            invalid_form_fields    => $invalidformfields,
333
            borrower               => \%borrower,
333
            borrower               => \%borrower,
334
            csrf_token             => Koha::Token->new->generate_csrf({
335
                session_id => scalar $cgi->cookie('CGISESSID'),
336
            }),
337
        );
334
        );
338
        $template->param( patron_attribute_classes => GeneratePatronAttributesForm( $borrowernumber, $attributes ) );
335
        $template->param( patron_attribute_classes => GeneratePatronAttributesForm( $borrowernumber, $attributes ) );
339
336
Lines 379-387 elsif ( $action eq 'update' ) { Link Here
379
                nochanges => 1,
376
                nochanges => 1,
380
                borrower => $patron->unblessed,
377
                borrower => $patron->unblessed,
381
                patron_attribute_classes => GeneratePatronAttributesForm( $borrowernumber, $attributes ),
378
                patron_attribute_classes => GeneratePatronAttributesForm( $borrowernumber, $attributes ),
382
                csrf_token => Koha::Token->new->generate_csrf({
383
                    session_id => scalar $cgi->cookie('CGISESSID'),
384
                }),
385
            );
379
            );
386
        }
380
        }
387
    }
381
    }
Lines 393-401 elsif ( $action eq 'edit' ) { #Display logged in borrower's data Link Here
393
    $template->param(
387
    $template->param(
394
        borrower  => $borrower,
388
        borrower  => $borrower,
395
        hidden => GetHiddenFields( $mandatory, 'edit' ),
389
        hidden => GetHiddenFields( $mandatory, 'edit' ),
396
        csrf_token => Koha::Token->new->generate_csrf({
397
            session_id => scalar $cgi->cookie('CGISESSID'),
398
        }),
399
    );
390
    );
400
391
401
    if (C4::Context->preference('OPACpatronimages')) {
392
    if (C4::Context->preference('OPACpatronimages')) {
(-)a/opac/opac-messaging.pl (-5 lines)
Lines 92-102 if( $opac_messaging && C4::Context->preference("SMSSendDriver") eq 'Email' ) { Link Here
92
}
92
}
93
93
94
my $new_session_id = $query->cookie('CGISESSID');
94
my $new_session_id = $query->cookie('CGISESSID');
95
$template->param(
96
    csrf_token => Koha::Token->new->generate_csrf({
97
            session_id => $new_session_id,
98
        }),
99
);
100
95
101
if ( C4::Context->preference('TranslateNotices') ) {
96
if ( C4::Context->preference('TranslateNotices') ) {
102
    my $translated_languages = C4::Languages::getTranslatedLanguages( 'opac', C4::Context->preference('template') );
97
    my $translated_languages = C4::Languages::getTranslatedLanguages( 'opac', C4::Context->preference('template') );
(-)a/opac/opac-sendbasket.pl (-2 lines)
Lines 126-133 else { Link Here
126
        url            => "/cgi-bin/koha/opac-sendbasket.pl",
126
        url            => "/cgi-bin/koha/opac-sendbasket.pl",
127
        suggestion     => C4::Context->preference("suggestion"),
127
        suggestion     => C4::Context->preference("suggestion"),
128
        virtualshelves => C4::Context->preference("virtualshelves"),
128
        virtualshelves => C4::Context->preference("virtualshelves"),
129
        csrf_token =>
130
          Koha::Token->new->generate_csrf( { session_id => $new_session_id, } ),
131
    );
129
    );
132
    output_html_with_http_headers $query, $cookie, $template->output, undef,
130
    output_html_with_http_headers $query, $cookie, $template->output, undef,
133
      { force_no_caching => 1 };
131
      { force_no_caching => 1 };
(-)a/opac/opac-user.pl (-3 lines)
Lines 181-189 $template->param( Link Here
181
                    surname           => $borr->{surname},
181
                    surname           => $borr->{surname},
182
                    RENEW_ERROR       => $renew_error,
182
                    RENEW_ERROR       => $renew_error,
183
                    borrower          => $borr,
183
                    borrower          => $borr,
184
                    csrf_token             => Koha::Token->new->generate_csrf({
185
                        session_id => scalar $query->cookie('CGISESSID'),
186
                    }),
187
                );
184
                );
188
185
189
#get issued items ....
186
#get issued items ....
(-)a/opac/sco/sco-main.pl (-1 lines)
Lines 363-369 if ( $patron) { Link Here
363
        my $patron_image = $patron->image;
363
        my $patron_image = $patron->image;
364
        $template->param(
364
        $template->param(
365
            display_patron_image => 1,
365
            display_patron_image => 1,
366
            csrf_token           => Koha::Token->new->generate_csrf( { session_id => scalar $query->cookie('CGISESSID') . $patron->cardnumber, id => $patron->userid } ),
367
        ) if $patron_image;
366
        ) if $patron_image;
368
    }
367
    }
369
} else {
368
} else {
(-)a/tools/import_borrowers.pl (-7 lines)
Lines 176-188 else { Link Here
176
        }
176
        }
177
        $template->param( matchpoints => \@matchpoints );
177
        $template->param( matchpoints => \@matchpoints );
178
    }
178
    }
179
180
    $template->param(
181
        csrf_token => Koha::Token->new->generate_csrf(
182
            { session_id => scalar $input->cookie('CGISESSID'), }
183
        ),
184
    );
185
186
}
179
}
187
180
188
output_html_with_http_headers $input, $cookie, $template->output;
181
output_html_with_http_headers $input, $cookie, $template->output;
(-)a/tools/picture-upload.pl (-6 lines)
Lines 209-219 if ( $borrowernumber && !%errors && !$template->param('ERRORS') ) { Link Here
209
        "/cgi-bin/koha/members/moremember.pl?borrowernumber=$borrowernumber");
209
        "/cgi-bin/koha/members/moremember.pl?borrowernumber=$borrowernumber");
210
}
210
}
211
else {
211
else {
212
    $template->param(
213
        csrf_token => Koha::Token->new->generate_csrf({
214
            session_id => scalar $input->cookie('CGISESSID'),
215
        }),
216
    );
217
    output_html_with_http_headers $input, $cookie, $template->output;
212
    output_html_with_http_headers $input, $cookie, $template->output;
218
}
213
}
219
214
220
- 

Return to bug 34478