View | Details | Raw Unified | Return to bug 18019
Collapse All | Expand All

(-)a/authorities/authorities-home.pl (+17 lines)
Lines 21-26 use strict; Link Here
21
use warnings;
21
use warnings;
22
22
23
use CGI qw ( -utf8 );
23
use CGI qw ( -utf8 );
24
use Digest::MD5 qw(md5_base64);
25
use Encode qw( encode );
24
use URI::Escape;
26
use URI::Escape;
25
use C4::Auth;
27
use C4::Auth;
26
28
Lines 36-41 use C4::Search::History; Link Here
36
use Koha::Authority::Types;
38
use Koha::Authority::Types;
37
use Koha::SearchEngine::Search;
39
use Koha::SearchEngine::Search;
38
use Koha::SearchEngine::QueryBuilder;
40
use Koha::SearchEngine::QueryBuilder;
41
use Koha::Token;
39
42
40
my $query = new CGI;
43
my $query = new CGI;
41
my $dbh   = C4::Context->dbh;
44
my $dbh   = C4::Context->dbh;
Lines 58-63 if ( $op eq "delete" ) { Link Here
58
            debug           => 1,
61
            debug           => 1,
59
        }
62
        }
60
    );
63
    );
64
65
    die "Wrong CSRF token" unless Koha::Token->new->check_csrf({
66
        id     => Encode::encode( 'UTF-8', $loggedinuser ),
67
        secret => md5_base64( Encode::encode( 'UTF-8', C4::Context->config('pass') ) ),
68
        token  => scalar $query->param('csrf_token'),
69
    });
70
61
    &DelAuthority( $authid, 1 );
71
    &DelAuthority( $authid, 1 );
62
72
63
    if ( $query->param('operator') ) {
73
    if ( $query->param('operator') ) {
Lines 111-116 if ( $op eq "do_search" ) { Link Here
111
        }
121
        }
112
    );
122
    );
113
123
124
    $template->param(
125
        csrf_token => Koha::Token->new->generate_csrf({
126
            id => Encode::encode( 'UTF-8', $loggedinuser ),
127
            secret => md5_base64( Encode::encode( 'UTF-8', C4::Context->config('pass') ) ),
128
        }),
129
    );
130
114
    # search history
131
    # search history
115
    if (C4::Context->preference('EnableSearchHistory')) {
132
    if (C4::Context->preference('EnableSearchHistory')) {
116
        if ( $startfrom == 1) {
133
        if ( $startfrom == 1) {
(-)a/koha-tmpl/intranet-tmpl/prog/en/includes/authorities-search.inc (+4 lines)
Lines 21-26 Link Here
21
    <div id="mainmain_heading" class="residentsearch">
21
    <div id="mainmain_heading" class="residentsearch">
22
    <p class="tip">Enter main heading ($a only):</p>
22
    <p class="tip">Enter main heading ($a only):</p>
23
    <form action="/cgi-bin/koha/authorities/authorities-home.pl" method="get">
23
    <form action="/cgi-bin/koha/authorities/authorities-home.pl" method="get">
24
        <input type="hidden" name="csrf_token" value="[% csrf_token %]" />
24
        <input type="hidden" name="op" value="do_search" />
25
        <input type="hidden" name="op" value="do_search" />
25
        <input type="hidden" name="type" value="intranet" />
26
        <input type="hidden" name="type" value="intranet" />
26
        <select name="authtypecode">
27
        <select name="authtypecode">
Lines 77-82 Link Here
77
    <div id="main_heading" class="residentsearch">
78
    <div id="main_heading" class="residentsearch">
78
    <p class="tip">Enter main heading:</p>
79
    <p class="tip">Enter main heading:</p>
79
    <form action="/cgi-bin/koha/authorities/authorities-home.pl" method="get">
80
    <form action="/cgi-bin/koha/authorities/authorities-home.pl" method="get">
81
        <input type="hidden" name="csrf_token" value="[% csrf_token %]" />
80
        <input type="hidden" name="op" value="do_search" />
82
        <input type="hidden" name="op" value="do_search" />
81
        <input type="hidden" name="type" value="intranet" />
83
        <input type="hidden" name="type" value="intranet" />
82
        <select name="authtypecode">
84
        <select name="authtypecode">
Lines 133-138 Link Here
133
    <div id="matchheading_search" class="residentsearch">
135
    <div id="matchheading_search" class="residentsearch">
134
    <p class="tip">Enter any heading:</p>
136
    <p class="tip">Enter any heading:</p>
135
    <form action="/cgi-bin/koha/authorities/authorities-home.pl" method="get">
137
    <form action="/cgi-bin/koha/authorities/authorities-home.pl" method="get">
138
        <input type="hidden" name="csrf_token" value="[% csrf_token %]" />
136
        <input type="hidden" name="op" value="do_search" />
139
        <input type="hidden" name="op" value="do_search" />
137
        <input type="hidden" name="type" value="intranet" />
140
        <input type="hidden" name="type" value="intranet" />
138
        <select name="authtypecode">
141
        <select name="authtypecode">
Lines 187-192 Link Here
187
    <div id="entire_record" class="residentsearch">
190
    <div id="entire_record" class="residentsearch">
188
    <p class="tip">Enter any authority field:</p>
191
    <p class="tip">Enter any authority field:</p>
189
    <form action="/cgi-bin/koha/authorities/authorities-home.pl" method="get">
192
    <form action="/cgi-bin/koha/authorities/authorities-home.pl" method="get">
193
        <input type="hidden" name="csrf_token" value="[% csrf_token %]" />
190
        <input type="hidden" name="op" value="do_search" />
194
        <input type="hidden" name="op" value="do_search" />
191
        <input type="hidden" name="type" value="intranet" />
195
        <input type="hidden" name="type" value="intranet" />
192
        <select name="authtypecode">
196
        <select name="authtypecode">
(-)a/koha-tmpl/intranet-tmpl/prog/en/modules/authorities/searchresultlist.tt (-2 / +2 lines)
Lines 19-25 function confirm_deletion(id) { Link Here
19
          + "&orderby=[% orderby %]"
19
          + "&orderby=[% orderby %]"
20
          + "&value=[% value |url %]"
20
          + "&value=[% value |url %]"
21
          + "&startfrom=[% startfrom %]"
21
          + "&startfrom=[% startfrom %]"
22
          + "&resultsperpage=[% resultsperpage %]";
22
          + "&resultsperpage=[% resultsperpage %]"
23
          + "&csrf_token=[% csrf_token %]";
23
    }
24
    }
24
}
25
}
25
26
26
- 

Return to bug 18019