From 602cc0a478b8cbe73e6b947acd1c4f4bf273ea96 Mon Sep 17 00:00:00 2001
From: Marcel de Rooy <m.de.rooy@rijksmuseum.nl>
Date: Tue, 7 Feb 2017 09:09:33 +0100
Subject: [PATCH] Bug 18019: Add CSRF protection to authorities-home.pl
 (op==delete)
Content-Type: text/plain; charset=utf-8

Without this patch, it is possible to delete authority records with URL
manipulation.
Like: /cgi-bin/koha/authorities/authorities-home.pl?op=delete&authid=[XXX]

Test plan:
[1] Go to Authorities. Search for some authorities (without links).
[2] Delete an authority. Should work.
[3] Construct an URL like above to delete another authority. Should fail.
    Under Plack this results in an internal server error, the log tells
    you: Wrong CSRF token.

Signed-off-by: Marcel de Rooy <m.de.rooy@rijksmuseum.nl>
---
 authorities/authorities-home.pl                         | 17 +++++++++++++++++
 .../prog/en/modules/authorities/searchresultlist.tt     |  3 ++-
 2 files changed, 19 insertions(+), 1 deletion(-)

diff --git a/authorities/authorities-home.pl b/authorities/authorities-home.pl
index 6e0a8fe..06aebb2 100755
--- a/authorities/authorities-home.pl
+++ b/authorities/authorities-home.pl
@@ -21,6 +21,8 @@ use strict;
 use warnings;
 
 use CGI qw ( -utf8 );
+use Digest::MD5 qw(md5_base64);
+use Encode qw( encode );
 use URI::Escape;
 use C4::Auth;
 
@@ -36,6 +38,7 @@ use C4::Search::History;
 use Koha::Authority::Types;
 use Koha::SearchEngine::Search;
 use Koha::SearchEngine::QueryBuilder;
+use Koha::Token;
 
 my $query = new CGI;
 my $dbh   = C4::Context->dbh;
@@ -58,6 +61,13 @@ if ( $op eq "delete" ) {
             debug           => 1,
         }
     );
+
+    die "Wrong CSRF token" unless Koha::Token->new->check_csrf({
+        id     => Encode::encode( 'UTF-8', $loggedinuser ),
+        secret => md5_base64( Encode::encode( 'UTF-8', C4::Context->config('pass') ) ),
+        token  => scalar $query->param('csrf_token'),
+    });
+
     &DelAuthority( $authid, 1 );
 
     if ( $query->param('operator') ) {
@@ -111,6 +121,13 @@ if ( $op eq "do_search" ) {
         }
     );
 
+    $template->param(
+        csrf_token => Koha::Token->new->generate_csrf({
+            id => Encode::encode( 'UTF-8', $loggedinuser ),
+            secret => md5_base64( Encode::encode( 'UTF-8', C4::Context->config('pass') ) ),
+        }),
+    );
+
     # search history
     if (C4::Context->preference('EnableSearchHistory')) {
         if ( $startfrom == 1) {
diff --git a/koha-tmpl/intranet-tmpl/prog/en/modules/authorities/searchresultlist.tt b/koha-tmpl/intranet-tmpl/prog/en/modules/authorities/searchresultlist.tt
index 563c44e..76e4589 100644
--- a/koha-tmpl/intranet-tmpl/prog/en/modules/authorities/searchresultlist.tt
+++ b/koha-tmpl/intranet-tmpl/prog/en/modules/authorities/searchresultlist.tt
@@ -19,7 +19,8 @@ function confirm_deletion(id) {
           + "&orderby=[% orderby %]"
           + "&value=[% value |url %]"
           + "&startfrom=[% startfrom %]"
-          + "&resultsperpage=[% resultsperpage %]";
+          + "&resultsperpage=[% resultsperpage %]"
+          + "&csrf_token=[% csrf_token %]";
     }
 }
 
-- 
2.1.4