From e5af79fd5c0007b63fd7e801aab3a66bfb3399b8 Mon Sep 17 00:00:00 2001 From: Nick Clemens Date: Mon, 18 Mar 2024 17:37:58 +0000 Subject: [PATCH] Bug 36351: Add CSRF tokens to advanced cataloguing editor POST requests The editor uses ajax post requests to SVC api. Becuase these apis are XML based requests, they must be handled in the simplest way, by embedding the token as a header To test: 1 - Browse to Cataloguing->Advanced editor 2 - Fill out needed values and save 3 - 403 error 4 - Apply patch 5 - Reload and try agian, success! 6 - Edit and save again, success! --- .../intranet-tmpl/lib/koha/cateditor/koha-backend.js | 8 ++++++++ 1 file changed, 8 insertions(+) diff --git a/koha-tmpl/intranet-tmpl/lib/koha/cateditor/koha-backend.js b/koha-tmpl/intranet-tmpl/lib/koha/cateditor/koha-backend.js index 5410f775633..f5631b5c742 100644 --- a/koha-tmpl/intranet-tmpl/lib/koha/cateditor/koha-backend.js +++ b/koha-tmpl/intranet-tmpl/lib/koha/cateditor/koha-backend.js @@ -136,10 +136,14 @@ define( [ '/cgi-bin/koha/svc/cataloguing/framework?frameworkcode=&callback=defin record = record.clone(); _removeBiblionumberFields( record ); + let csrf_token = $('meta[name="csrf-token"]').attr('content'); $.ajax( { type: 'POST', url: '/cgi-bin/koha/svc/new_bib?frameworkcode=' + encodeURIComponent(frameworkcode), data: record.toXML(), + headers: { + 'CSRF-TOKEN':csrf_token + }, contentType: 'text/xml' } ).done( function( data ) { var record = _fromXMLStruct( data ); @@ -157,10 +161,14 @@ define( [ '/cgi-bin/koha/svc/cataloguing/framework?frameworkcode=&callback=defin record = record.clone(); _removeBiblionumberFields( record ); + let csrf_token = $('meta[name="csrf-token"]').attr('content'); $.ajax( { type: 'POST', url: '/cgi-bin/koha/svc/bib/' + id + '?frameworkcode=' + encodeURIComponent(frameworkcode), data: record.toXML(), + headers: { + 'CSRF-TOKEN':csrf_token + }, contentType: 'text/xml' } ).done( function( data ) { var record = _fromXMLStruct( data ); -- 2.30.2