From 9c9742830f9986abc13411e56e6f9fb0f9d777e8 Mon Sep 17 00:00:00 2001 From: David Cook Date: Mon, 19 Jan 2026 23:29:01 +0000 Subject: [PATCH] Bug 41662: Prevent CSRF on opac-patron-consent.pl This change prevents CSRF on opac-patron-consent.pl by adding checking of the "op". Test plan: 0. Apply the patch and koha-plack --restart kohadev 1. Set system preference PrivacyPolicyConsent to "permissive" 2. Log into the OPAC and go to this path: /cgi-bin/koha/opac-patron-consent.pl?check_GDPR_PROCESSING=1 3. Note that it doesn't change the consent 4. Go to this path: /cgi-bin/koha/opac-patron-consent.pl?check_GDPR_PROCESSING=0 5. Note that it doesn't change the consent 6. Click the "Yes" radio button and click "Save" 7. Note it changes the consent to Yes 8. Click the "No" radio button and click "Save" 9. Note it changes the consent to No --- opac/opac-patron-consent.pl | 35 +++++++++++++++++++---------------- 1 file changed, 19 insertions(+), 16 deletions(-) diff --git a/opac/opac-patron-consent.pl b/opac/opac-patron-consent.pl index a6cd3421f31..ea26cbc1681 100755 --- a/opac/opac-patron-consent.pl +++ b/opac/opac-patron-consent.pl @@ -48,24 +48,27 @@ foreach my $consent_type ( sort keys %$consent_types ) { push @consents, $patron->consent($consent_type); } -# Handle saves here my $needs_redirect; -foreach my $consent (@consents) { - my $check = $vars->{ "check_" . $consent->type }; - next if !defined($check); # no choice made - $needs_redirect = 1 - if $consent->type eq q/GDPR_PROCESSING/ - && !$check - && C4::Context->preference('PrivacyPolicyConsent') eq 'Enforced'; - next if $consent->given_on && $check || $consent->refused_on && !$check; - # No update if no consent change - $consent->set( - { - given_on => $check ? dt_from_string() : undef, - refused_on => $check ? undef : dt_from_string(), - } - )->store; +# Handle saves here +if ( $op && $op eq 'cud-save' ) { + foreach my $consent (@consents) { + my $check = $vars->{ "check_" . $consent->type }; + next if !defined($check); # no choice made + $needs_redirect = 1 + if $consent->type eq q/GDPR_PROCESSING/ + && !$check + && C4::Context->preference('PrivacyPolicyConsent') eq 'Enforced'; + next if $consent->given_on && $check || $consent->refused_on && !$check; + + # No update if no consent change + $consent->set( + { + given_on => $check ? dt_from_string() : undef, + refused_on => $check ? undef : dt_from_string(), + } + )->store; + } } # If user refused GDPR consent and we enforce GDPR, logout (when saving) -- 2.39.5