View | Details | Raw Unified | Return to bug 17109
Collapse All | Expand All

(-)a/basket/sendbasket.pl (-3 / +22 lines)
Lines 20-35 use Modern::Perl; Link Here
20
use CGI qw ( -utf8 );
20
use CGI qw ( -utf8 );
21
use Encode qw(encode);
21
use Encode qw(encode);
22
use Carp;
22
use Carp;
23
23
use Digest::MD5 qw(md5_base64);
24
use Mail::Sendmail;
24
use Mail::Sendmail;
25
use MIME::QuotedPrint;
25
use MIME::QuotedPrint;
26
use MIME::Base64;
26
use MIME::Base64;
27
27
use C4::Biblio;
28
use C4::Biblio;
28
use C4::Items;
29
use C4::Items;
29
use C4::Auth;
30
use C4::Auth;
30
use C4::Output;
31
use C4::Output;
31
use C4::Templates ();
32
use C4::Templates ();
32
use Koha::Email;
33
use Koha::Email;
34
use Koha::Token;
33
35
34
my $query = new CGI;
36
my $query = new CGI;
35
37
Lines 43-54 my ( $template, $borrowernumber, $cookie ) = get_template_and_user ( Link Here
43
    }
45
    }
44
);
46
);
45
47
46
my $bib_list     = $query->param('bib_list');
48
my $bib_list     = $query->param('bib_list') || '';
47
my $email_add    = $query->param('email_add');
49
my $email_add    = $query->param('email_add');
48
50
49
my $dbh          = C4::Context->dbh;
51
my $dbh          = C4::Context->dbh;
50
52
53
my $csrf_err;
51
if ( $email_add ) {
54
if ( $email_add ) {
55
    $csrf_err = 1 unless Koha::Token->new->check_csrf({
56
        id     => C4::Context->userenv->{id},
57
        secret => md5_base64( C4::Context->config('pass') ),
58
        token  => scalar $query->param('csrf_token'),
59
    });
60
}
61
62
if( $csrf_err ) {
63
    $template->param( csrf_error => 1, email_add => 1 );
64
    output_html_with_http_headers $query, $cookie, $template->output;
65
} elsif ( $email_add ) {
52
    my $email = Koha::Email->new();
66
    my $email = Koha::Email->new();
53
    my %mail = $email->create_message_headers({ to => $email_add });
67
    my %mail = $email->create_message_headers({ to => $email_add });
54
    my $comment    = $query->param('comment');
68
    my $comment    = $query->param('comment');
Lines 165-175 END_OF_BODY Link Here
165
    output_html_with_http_headers $query, $cookie, $template->output;
179
    output_html_with_http_headers $query, $cookie, $template->output;
166
}
180
}
167
else {
181
else {
168
    $template->param( bib_list => $bib_list );
169
    $template->param(
182
    $template->param(
183
        bib_list       => $bib_list,
170
        url            => "/cgi-bin/koha/basket/sendbasket.pl",
184
        url            => "/cgi-bin/koha/basket/sendbasket.pl",
171
        suggestion     => C4::Context->preference("suggestion"),
185
        suggestion     => C4::Context->preference("suggestion"),
172
        virtualshelves => C4::Context->preference("virtualshelves"),
186
        virtualshelves => C4::Context->preference("virtualshelves"),
187
        csrf_token     => Koha::Token->new->generate_csrf(
188
            {   id     => C4::Context->userenv->{id},
189
                secret => md5_base64( C4::Context->config('pass') ),
190
            }
191
        ),
173
    );
192
    );
174
    output_html_with_http_headers $query, $cookie, $template->output;
193
    output_html_with_http_headers $query, $cookie, $template->output;
175
}
194
}
(-)a/koha-tmpl/intranet-tmpl/prog/en/modules/basket/sendbasketform.tt (-4 / +9 lines)
Lines 10-15 Link Here
10
        <p>The cart was sent to: [% email_add |html %]</p>
10
        <p>The cart was sent to: [% email_add |html %]</p>
11
		<p><a class="focus close" href="#">Close window</a></p>
11
		<p><a class="focus close" href="#">Close window</a></p>
12
	[% END %]
12
	[% END %]
13
    [% IF csrf_error %]
14
        <p>No valid CSRF token!</p>
15
        <p><a class="focus close" href="#">Close window</a></p>
16
    [% END %]
13
	[% IF ( error ) %]
17
	[% IF ( error ) %]
14
	<p>Problem sending the cart...</p>
18
	<p>Problem sending the cart...</p>
15
	[% END %]
19
	[% END %]
Lines 28-37 Link Here
28
            <label for="comment">Comment:</label>
32
            <label for="comment">Comment:</label>
29
            <textarea id="comment" name="comment" rows="4" cols="40"></textarea>
33
            <textarea id="comment" name="comment" rows="4" cols="40"></textarea>
30
    </li>
34
    </li>
31
    <li>
35
    </ol>
32
        <input type="hidden" name="bib_list" value="[% bib_list %]" />
36
    </fieldset>
33
    </li></ol></fieldset>
37
    <fieldset class="action"> <input type="submit" value="Send" /> <a class="cancel close" href="#">Cancel</a> </fieldset>
34
       <fieldset class="action"> <input type="submit" value="Send" /> <a class="cancel close" href="#">Cancel</a> </fieldset>
38
    <input type="hidden" name="bib_list" value="[% bib_list %]" />
39
    <input type="hidden" name="csrf_token" value="[% csrf_token %]" />
35
</form>
40
</form>
36
41
37
[% END %]</div>
42
[% END %]</div>
(-)a/koha-tmpl/opac-tmpl/bootstrap/en/modules/opac-sendbasketform.tt (+5 lines)
Lines 19-24 Link Here
19
                                <p><a class="focus close" href="#">Close window</a></p>
19
                                <p><a class="focus close" href="#">Close window</a></p>
20
                            [% END %]
20
                            [% END %]
21
21
22
                            [% IF csrf_error %]
23
                                <p>No valid CSRF token!</p>
24
                                <p><a class="focus close" href="#">Close window</a></p>
25
                            [% END %]
22
                            [% IF ( error ) %]
26
                            [% IF ( error ) %]
23
                                <div class="alert">
27
                                <div class="alert">
24
                                    <p>There was an error sending the cart.</p>
28
                                    <p>There was an error sending the cart.</p>
Lines 34-39 Link Here
34
                                    <label for="comment">Comment:</label>
38
                                    <label for="comment">Comment:</label>
35
                                    <textarea id="comment" name="comment" rows="4" cols="40"></textarea>
39
                                    <textarea id="comment" name="comment" rows="4" cols="40"></textarea>
36
                                    <input type="hidden" name="bib_list" value="[% bib_list %]" />
40
                                    <input type="hidden" name="bib_list" value="[% bib_list %]" />
41
                                    <input type="hidden" name="csrf_token" value="[% csrf_token %]" />
37
                                </fieldset>
42
                                </fieldset>
38
                                <fieldset class="action">
43
                                <fieldset class="action">
39
                                    <input type="submit" class="btn" value="Send" />
44
                                    <input type="submit" class="btn" value="Send" />
(-)a/opac/opac-sendbasket.pl (-4 / +22 lines)
Lines 22-31 use Modern::Perl; Link Here
22
use CGI qw ( -utf8 );
22
use CGI qw ( -utf8 );
23
use Encode qw(encode);
23
use Encode qw(encode);
24
use Carp;
24
use Carp;
25
25
use Digest::MD5 qw(md5_base64);
26
use Mail::Sendmail;
26
use Mail::Sendmail;
27
use MIME::QuotedPrint;
27
use MIME::QuotedPrint;
28
use MIME::Base64;
28
use MIME::Base64;
29
29
use C4::Biblio;
30
use C4::Biblio;
30
use C4::Items;
31
use C4::Items;
31
use C4::Auth;
32
use C4::Auth;
Lines 33-38 use C4::Output; Link Here
33
use C4::Members;
34
use C4::Members;
34
use C4::Templates ();
35
use C4::Templates ();
35
use Koha::Email;
36
use Koha::Email;
37
use Koha::Token;
36
38
37
my $query = new CGI;
39
my $query = new CGI;
38
40
Lines 45-56 my ( $template, $borrowernumber, $cookie ) = get_template_and_user ( Link Here
45
    }
47
    }
46
);
48
);
47
49
48
my $bib_list     = $query->param('bib_list');
50
my $bib_list     = $query->param('bib_list') || '';
49
my $email_add    = $query->param('email_add');
51
my $email_add    = $query->param('email_add');
50
52
51
my $dbh          = C4::Context->dbh;
53
my $dbh          = C4::Context->dbh;
52
54
55
my $csrf_err;
53
if ( $email_add ) {
56
if ( $email_add ) {
57
    $csrf_err = 1 unless Koha::Token->new->check_csrf({
58
        id     => C4::Context->userenv->{id},
59
        secret => md5_base64( C4::Context->config('pass') ),
60
        token  => scalar $query->param('csrf_token'),
61
    });
62
}
63
64
if( $csrf_err ) {
65
    $template->param( csrf_error => 1, email_add => 1 );
66
    output_html_with_http_headers $query, $cookie, $template->output;
67
} elsif ( $email_add ) {
54
    my $email = Koha::Email->new();
68
    my $email = Koha::Email->new();
55
    my $user = GetMember(borrowernumber => $borrowernumber);
69
    my $user = GetMember(borrowernumber => $borrowernumber);
56
    my $user_email = GetFirstValidEmailAddress($borrowernumber)
70
    my $user_email = GetFirstValidEmailAddress($borrowernumber)
Lines 185-195 END_OF_BODY Link Here
185
    output_html_with_http_headers $query, $cookie, $template->output;
199
    output_html_with_http_headers $query, $cookie, $template->output;
186
}
200
}
187
else {
201
else {
188
    $template->param( bib_list => $bib_list );
189
    $template->param(
202
    $template->param(
203
        bib_list       => $bib_list,
190
        url            => "/cgi-bin/koha/opac-sendbasket.pl",
204
        url            => "/cgi-bin/koha/opac-sendbasket.pl",
191
        suggestion     => C4::Context->preference("suggestion"),
205
        suggestion     => C4::Context->preference("suggestion"),
192
        virtualshelves => C4::Context->preference("virtualshelves"),
206
        virtualshelves => C4::Context->preference("virtualshelves"),
207
        csrf_token     => Koha::Token->new->generate_csrf(
208
            {   id     => C4::Context->userenv->{id},
209
                secret => md5_base64( C4::Context->config('pass') ),
210
            }
211
        ),
193
    );
212
    );
194
    output_html_with_http_headers $query, $cookie, $template->output;
213
    output_html_with_http_headers $query, $cookie, $template->output;
195
}
214
}
196
- 

Return to bug 17109