From 9ca4246a1f23140ccf06f94fa3f59178680d9902 Mon Sep 17 00:00:00 2001
From: Jonathan Druart <jonathan.druart@bugs.koha-community.org>
Date: Tue, 6 Jun 2017 16:41:37 -0300
Subject: [PATCH] Bug 18740: (bug 16992 follow-up) Add CSRF token to the
template
Bug 16992 is in
commit 9e74db7b51085f62919e34ab4e5ccdf9da2066a1
Bug 18124: Restrict CSRF token to user's session
but template change is missing
Test plan:
Modify a patron from member-password.pl
Without this patch you got
Wrong CSRF token at /home/vagrant/kohaclone/members/member-password.pl line 68.
---
koha-tmpl/intranet-tmpl/prog/en/modules/members/member-password.tt | 6 +++++-
1 file changed, 5 insertions(+), 1 deletion(-)
diff --git a/koha-tmpl/intranet-tmpl/prog/en/modules/members/member-password.tt b/koha-tmpl/intranet-tmpl/prog/en/modules/members/member-password.tt
index 5d55ef5cdb..786125e7d4 100644
--- a/koha-tmpl/intranet-tmpl/prog/en/modules/members/member-password.tt
+++ b/koha-tmpl/intranet-tmpl/prog/en/modules/members/member-password.tt
@@ -114,7 +114,11 @@
</li>
</ol>
</fieldset>
- <fieldset class="action"><input type="submit" value="Save" /> <a class="cancel" href="/cgi-bin/koha/members/moremember.pl?borrowernumber=[% borrowernumber %]">Cancel</a></fieldset>
+ <fieldset class="action">
+ <input type="hidden" name="csrf_token" value="[% csrf_token %]" />
+ <input type="submit" value="Save" />
+ <a class="cancel" href="/cgi-bin/koha/members/moremember.pl?borrowernumber=[% borrowernumber %]">Cancel</a>
+ </fieldset>
</form>[% END %]
</div>
--
2.11.0