Lines 20-26
use Modern::Perl;
Link Here
|
20 |
use CGI qw ( -utf8 ); |
20 |
use CGI qw ( -utf8 ); |
21 |
use Digest::MD5 qw( md5_base64 md5_hex ); |
21 |
use Digest::MD5 qw( md5_base64 md5_hex ); |
22 |
use String::Random qw( random_string ); |
22 |
use String::Random qw( random_string ); |
23 |
use WWW::CSRF qw(generate_csrf_token check_csrf_token CSRF_OK); |
|
|
24 |
|
23 |
|
25 |
use C4::Auth; |
24 |
use C4::Auth; |
26 |
use C4::Output; |
25 |
use C4::Output; |
Lines 33-38
use C4::Scrubber;
Link Here
|
33 |
use Email::Valid; |
32 |
use Email::Valid; |
34 |
use Koha::DateUtils; |
33 |
use Koha::DateUtils; |
35 |
use Koha::Patron::Images; |
34 |
use Koha::Patron::Images; |
|
|
35 |
use Koha::Token; |
36 |
|
36 |
|
37 |
my $cgi = new CGI; |
37 |
my $cgi = new CGI; |
38 |
my $dbh = C4::Context->dbh; |
38 |
my $dbh = C4::Context->dbh; |
Lines 182-189
if ( $action eq 'create' ) {
Link Here
|
182 |
elsif ( $action eq 'update' ) { |
182 |
elsif ( $action eq 'update' ) { |
183 |
|
183 |
|
184 |
my $borrower = GetMember( borrowernumber => $borrowernumber ); |
184 |
my $borrower = GetMember( borrowernumber => $borrowernumber ); |
185 |
my $csrf_status = check_csrf_token($borrower->{userid}, md5_base64(C4::Context->config('pass')), scalar $cgi->param('csrf_token')); |
185 |
die "Wrong CSRF token" |
186 |
die "Wrong CSRF token" unless ($csrf_status == CSRF_OK); |
186 |
unless Koha::Token->new->check( |
|
|
187 |
id => $borrower->{userid}, |
188 |
secret => md5_base64( C4::Context->config('pass') ), |
189 |
token => scalar $cgi->param('csrf_token'), |
190 |
); |
187 |
|
191 |
|
188 |
my %borrower = ParseCgiForBorrower($cgi); |
192 |
my %borrower = ParseCgiForBorrower($cgi); |
189 |
|
193 |
|
Lines 197-203
elsif ( $action eq 'update' ) {
Link Here
|
197 |
empty_mandatory_fields => \@empty_mandatory_fields, |
201 |
empty_mandatory_fields => \@empty_mandatory_fields, |
198 |
invalid_form_fields => $invalidformfields, |
202 |
invalid_form_fields => $invalidformfields, |
199 |
borrower => \%borrower, |
203 |
borrower => \%borrower, |
200 |
csrf_token => generate_csrf_token($borrower->{userid}, md5_base64(C4::Context->config('pass'))), |
204 |
csrf_token => Koha::Token->new->generate({ |
|
|
205 |
CSRF => 1, |
206 |
id => $borrower->{userid}, |
207 |
secret => md5_base64( C4::Context->config('pass') ), |
208 |
}), |
201 |
); |
209 |
); |
202 |
|
210 |
|
203 |
$template->param( action => 'edit' ); |
211 |
$template->param( action => 'edit' ); |
Lines 229-235
elsif ( $action eq 'update' ) {
Link Here
|
229 |
action => 'edit', |
237 |
action => 'edit', |
230 |
nochanges => 1, |
238 |
nochanges => 1, |
231 |
borrower => GetMember( borrowernumber => $borrowernumber ), |
239 |
borrower => GetMember( borrowernumber => $borrowernumber ), |
232 |
csrf_token => generate_csrf_token($borrower->{userid}, md5_base64(C4::Context->config('pass'))) |
240 |
csrf_token => Koha::Token->new->generate({ |
|
|
241 |
CSRF => 1, |
242 |
id => $borrower->{userid}, |
243 |
secret => md5_base64( C4::Context->config('pass') ), |
244 |
}), |
233 |
); |
245 |
); |
234 |
} |
246 |
} |
235 |
} |
247 |
} |
Lines 249-255
elsif ( $action eq 'edit' ) { #Display logged in borrower's data
Link Here
|
249 |
borrower => $borrower, |
261 |
borrower => $borrower, |
250 |
guarantor => scalar Koha::Patrons->find($borrowernumber)->guarantor(), |
262 |
guarantor => scalar Koha::Patrons->find($borrowernumber)->guarantor(), |
251 |
hidden => GetHiddenFields( $mandatory, 'modification' ), |
263 |
hidden => GetHiddenFields( $mandatory, 'modification' ), |
252 |
csrf_token => generate_csrf_token($borrower->{userid}, md5_base64(C4::Context->config('pass'))) |
264 |
csrf_token => Koha::Token->new->generate({ |
|
|
265 |
CSRF => 1, |
266 |
id => $borrower->{userid}, |
267 |
secret => md5_base64( C4::Context->config('pass') ), |
268 |
}), |
253 |
); |
269 |
); |
254 |
|
270 |
|
255 |
if (C4::Context->preference('OPACpatronimages')) { |
271 |
if (C4::Context->preference('OPACpatronimages')) { |