From 99bd8fe9aac12404f85fb5bb6cf37d5f16b06b1e Mon Sep 17 00:00:00 2001 From: David Cook Date: Mon, 19 Jan 2026 23:29:01 +0000 Subject: [PATCH] Bug 41662: Prevent CSRF on opac-patron-consent.pl Content-Type: text/plain; charset=utf-8 This change prevents CSRF on opac-patron-consent.pl by adding checking of the "op". Test plan: 0. Apply the patch and koha-plack --restart kohadev 1. Set system preference PrivacyPolicyConsent to "permissive" 2. Log into the OPAC and go to this path: /cgi-bin/koha/opac-patron-consent.pl?check_GDPR_PROCESSING=1 3. Note that it doesn't change the consent 4. Go to this path: /cgi-bin/koha/opac-patron-consent.pl?check_GDPR_PROCESSING=0 5. Note that it doesn't change the consent 6. Click the "Yes" radio button and click "Save" 7. Note it changes the consent to Yes 8. Click the "No" radio button and click "Save" 9. Note it changes the consent to No Signed-off-by: Marcel de Rooy --- opac/opac-patron-consent.pl | 35 +++++++++++++++++++---------------- 1 file changed, 19 insertions(+), 16 deletions(-) diff --git a/opac/opac-patron-consent.pl b/opac/opac-patron-consent.pl index a6cd3421f3..ea26cbc168 100755 --- a/opac/opac-patron-consent.pl +++ b/opac/opac-patron-consent.pl @@ -48,24 +48,27 @@ foreach my $consent_type ( sort keys %$consent_types ) { push @consents, $patron->consent($consent_type); } -# Handle saves here my $needs_redirect; -foreach my $consent (@consents) { - my $check = $vars->{ "check_" . $consent->type }; - next if !defined($check); # no choice made - $needs_redirect = 1 - if $consent->type eq q/GDPR_PROCESSING/ - && !$check - && C4::Context->preference('PrivacyPolicyConsent') eq 'Enforced'; - next if $consent->given_on && $check || $consent->refused_on && !$check; - # No update if no consent change - $consent->set( - { - given_on => $check ? dt_from_string() : undef, - refused_on => $check ? undef : dt_from_string(), - } - )->store; +# Handle saves here +if ( $op && $op eq 'cud-save' ) { + foreach my $consent (@consents) { + my $check = $vars->{ "check_" . $consent->type }; + next if !defined($check); # no choice made + $needs_redirect = 1 + if $consent->type eq q/GDPR_PROCESSING/ + && !$check + && C4::Context->preference('PrivacyPolicyConsent') eq 'Enforced'; + next if $consent->given_on && $check || $consent->refused_on && !$check; + + # No update if no consent change + $consent->set( + { + given_on => $check ? dt_from_string() : undef, + refused_on => $check ? undef : dt_from_string(), + } + )->store; + } } # If user refused GDPR consent and we enforce GDPR, logout (when saving) -- 2.39.5