View | Details | Raw Unified | Return to bug 21993
Collapse All | Expand All

(-)a/authorities/authorities-home.pl (-4 / +5 lines)
Lines 61-70 if ( $op eq "delete" ) { Link Here
61
        }
61
        }
62
    );
62
    );
63
63
64
    die "Wrong CSRF token" unless Koha::Token->new->check_csrf({
64
    output_and_exit( $query, $cookie, $template, 'wrong_csrf_token' )
65
        session_id => scalar $query->cookie('CGISESSID'),
65
        unless Koha::Token->new->check_csrf({
66
        token  => scalar $query->param('csrf_token'),
66
            session_id => scalar $query->cookie('CGISESSID'),
67
    });
67
            token  => scalar $query->param('csrf_token'),
68
        });
68
69
69
    DelAuthority({ authid => $authid });
70
    DelAuthority({ authid => $authid });
70
71
(-)a/basket/sendbasket.pl (-4 / +5 lines)
Lines 50-59 my $email_add = $query->param('email_add'); Link Here
50
my $dbh          = C4::Context->dbh;
50
my $dbh          = C4::Context->dbh;
51
51
52
if ( $email_add ) {
52
if ( $email_add ) {
53
    die "Wrong CSRF token" unless Koha::Token->new->check_csrf({
53
    output_and_exit( $query, $cookie, $template, 'wrong_csrf_token' )
54
        session_id => scalar $query->cookie('CGISESSID'),
54
        unless Koha::Token->new->check_csrf({
55
        token  => scalar $query->param('csrf_token'),
55
            session_id => scalar $query->cookie('CGISESSID'),
56
    });
56
            token  => scalar $query->param('csrf_token'),
57
        });
57
    my $email = Koha::Email->new();
58
    my $email = Koha::Email->new();
58
    my %mail = $email->create_message_headers({ to => $email_add });
59
    my %mail = $email->create_message_headers({ to => $email_add });
59
    my $comment    = $query->param('comment');
60
    my $comment    = $query->param('comment');
(-)a/koha-tmpl/intranet-tmpl/prog/en/includes/blocking_errors.inc (+2 lines)
Lines 11-16 Link Here
11
        <div class="dialog message">This subscription does not exist.</div>
11
        <div class="dialog message">This subscription does not exist.</div>
12
    [% CASE 'unknown_basket' %]
12
    [% CASE 'unknown_basket' %]
13
        <div class="dialog message">This basket does not exist.</div>
13
        <div class="dialog message">This basket does not exist.</div>
14
    [% CASE 'wrong_csrf_token' %]
15
        <div class="dialog message">The form submission failed (Wrong CSRF token). Try to come back, refresh the page, then try again.</div>
14
    [% CASE %][% blocking_error | html %]
16
    [% CASE %][% blocking_error | html %]
15
    [% END %]
17
    [% END %]
16
18
(-)a/koha-tmpl/intranet-tmpl/prog/en/modules/basket/sendbasketform.tt (+1 lines)
Lines 16-21 Link Here
16
	
16
	
17
[% ELSE %]
17
[% ELSE %]
18
18
19
[% INCLUDE 'blocking_errors.inc' %]
19
<form action="/cgi-bin/koha/basket/sendbasket.pl" method="post">
20
<form action="/cgi-bin/koha/basket/sendbasket.pl" method="post">
20
21
21
<fieldset class="rows"> 
22
<fieldset class="rows"> 
(-)a/koha-tmpl/intranet-tmpl/prog/en/modules/tools/import_borrowers.tt (+1 lines)
Lines 20-25 Link Here
20
20
21
<div id="breadcrumbs"><a href="/cgi-bin/koha/mainpage.pl">Home</a> &rsaquo; <a href="/cgi-bin/koha/tools/tools-home.pl">Tools</a> &rsaquo; <a href="/cgi-bin/koha/tools/import_borrowers.pl">Import patrons</a>[% IF ( uploadborrowers ) %] &rsaquo; Results[% END %]</div>
21
<div id="breadcrumbs"><a href="/cgi-bin/koha/mainpage.pl">Home</a> &rsaquo; <a href="/cgi-bin/koha/tools/tools-home.pl">Tools</a> &rsaquo; <a href="/cgi-bin/koha/tools/import_borrowers.pl">Import patrons</a>[% IF ( uploadborrowers ) %] &rsaquo; Results[% END %]</div>
22
22
23
[% INCLUDE 'blocking_errors.inc' %]
23
<div class="main container-fluid">
24
<div class="main container-fluid">
24
    <div class="row">
25
    <div class="row">
25
        <div class="col-sm-10 col-sm-push-2">
26
        <div class="col-sm-10 col-sm-push-2">
(-)a/koha-tmpl/intranet-tmpl/prog/en/modules/tools/picture-upload.tt (+1 lines)
Lines 13-18 Link Here
13
13
14
<div id="breadcrumbs"><a href="/cgi-bin/koha/mainpage.pl">Home</a> &rsaquo; <a href="/cgi-bin/koha/tools/tools-home.pl">Tools</a> &rsaquo; [% IF ( TOTAL ) %]<a href="/cgi-bin/koha/tools/picture-upload.pl">Upload patron images</a> &rsaquo; Results[% ELSE %]Upload patron images[% END %] </div>
14
<div id="breadcrumbs"><a href="/cgi-bin/koha/mainpage.pl">Home</a> &rsaquo; <a href="/cgi-bin/koha/tools/tools-home.pl">Tools</a> &rsaquo; [% IF ( TOTAL ) %]<a href="/cgi-bin/koha/tools/picture-upload.pl">Upload patron images</a> &rsaquo; Results[% ELSE %]Upload patron images[% END %] </div>
15
15
16
[% INCLUDE 'blocking_errors.inc' %]
16
<div class="main container-fluid">
17
<div class="main container-fluid">
17
    <div class="row">
18
    <div class="row">
18
        <div class="col-sm-10 col-sm-push-2">
19
        <div class="col-sm-10 col-sm-push-2">
(-)a/members/apikeys.pl (-5 / +5 lines)
Lines 60-70 if ( $op eq 'generate' or Link Here
60
     $op eq 'revoke' or
60
     $op eq 'revoke' or
61
     $op eq 'activate' ) {
61
     $op eq 'activate' ) {
62
62
63
    die "Wrong CSRF token"
63
    output_and_exit( $cgi, $cookie, $template, 'wrong_csrf_token' )
64
    unless Koha::Token->new->check_csrf({
64
        unless Koha::Token->new->check_csrf({
65
        session_id => scalar $cgi->cookie('CGISESSID'),
65
            session_id => scalar $cgi->cookie('CGISESSID'),
66
        token      => scalar $cgi->param('csrf_token'),
66
            token      => scalar $cgi->param('csrf_token'),
67
    });
67
        });
68
}
68
}
69
69
70
if ($op) {
70
if ($op) {
(-)a/members/deletemem.pl (-1 / +1 lines)
Lines 109-115 if ( $op eq 'delete_confirm' or $countissues > 0 or $charges or $is_guarantor ) Link Here
109
    }
109
    }
110
} elsif ( $op eq 'delete_confirmed' ) {
110
} elsif ( $op eq 'delete_confirmed' ) {
111
111
112
    die "Wrong CSRF token"
112
    output_and_exit( $input, $cookie, $template, 'wrong_csrf_token' )
113
        unless Koha::Token->new->check_csrf( {
113
        unless Koha::Token->new->check_csrf( {
114
            session_id => $input->cookie('CGISESSID'),
114
            session_id => $input->cookie('CGISESSID'),
115
            token  => scalar $input->param('csrf_token'),
115
            token  => scalar $input->param('csrf_token'),
(-)a/members/mancredit.pl (-1 / +1 lines)
Lines 62-68 my $add = $input->param('add'); Link Here
62
62
63
if ($add){
63
if ($add){
64
64
65
    die "Wrong CSRF token"
65
    output_and_exit( $input, $cookie, $template, 'wrong_csrf_token' )
66
        unless Koha::Token->new->check_csrf( {
66
        unless Koha::Token->new->check_csrf( {
67
            session_id => scalar $input->cookie('CGISESSID'),
67
            session_id => scalar $input->cookie('CGISESSID'),
68
            token  => scalar $input->param('csrf_token'),
68
            token  => scalar $input->param('csrf_token'),
(-)a/members/maninvoice.pl (-10 / +10 lines)
Lines 40-45 use Koha::Patron::Categories; Link Here
40
40
41
my $input=new CGI;
41
my $input=new CGI;
42
my $flagsrequired = { borrowers => 'edit_borrowers' };
42
my $flagsrequired = { borrowers => 'edit_borrowers' };
43
my ( $template, $loggedinuser, $cookie ) = get_template_and_user(
44
    {   template_name   => "members/maninvoice.tt",
45
        query           => $input,
46
        type            => "intranet",
47
        authnotrequired => 0,
48
        flagsrequired   => $flagsrequired,
49
        debug           => 1,
50
    }
51
);
43
52
44
my $borrowernumber=$input->param('borrowernumber');
53
my $borrowernumber=$input->param('borrowernumber');
45
54
Lines 52-58 unless ( $patron ) { Link Here
52
my $add=$input->param('add');
61
my $add=$input->param('add');
53
if ($add){
62
if ($add){
54
    if ( checkauth( $input, 0, $flagsrequired, 'intranet' ) ) {
63
    if ( checkauth( $input, 0, $flagsrequired, 'intranet' ) ) {
55
        die "Wrong CSRF token"
64
        output_and_exit( $input, $cookie, $template,  'wrong_csrf_token' )
56
            unless Koha::Token->new->check_csrf( {
65
            unless Koha::Token->new->check_csrf( {
57
                session_id => scalar $input->cookie('CGISESSID'),
66
                session_id => scalar $input->cookie('CGISESSID'),
58
                token => scalar $input->param('csrf_token'),
67
                token => scalar $input->param('csrf_token'),
Lines 71-85 if ($add){ Link Here
71
        my $note    = $input->param('note');
80
        my $note    = $input->param('note');
72
        my $error   = manualinvoice( $borrowernumber, $itemnum, $desc, $type, $amount, $note );
81
        my $error   = manualinvoice( $borrowernumber, $itemnum, $desc, $type, $amount, $note );
73
        if ($error) {
82
        if ($error) {
74
            my ( $template, $loggedinuser, $cookie ) = get_template_and_user(
75
                {   template_name   => "members/maninvoice.tt",
76
                    query           => $input,
77
                    type            => "intranet",
78
                    authnotrequired => 0,
79
                    flagsrequired   => $flagsrequired,
80
                    debug           => 1,
81
                }
82
            );
83
            if ( $error =~ /FOREIGN KEY/ && $error =~ /itemnumber/ ) {
83
            if ( $error =~ /FOREIGN KEY/ && $error =~ /itemnumber/ ) {
84
                $template->param( 'ITEMNUMBER' => 1 );
84
                $template->param( 'ITEMNUMBER' => 1 );
85
            }
85
            }
(-)a/members/member-flags.pl (-1 / +1 lines)
Lines 52-58 $member2{'borrowernumber'}=$member; Link Here
52
52
53
if ($input->param('newflags')) {
53
if ($input->param('newflags')) {
54
54
55
    die "Wrong CSRF token"
55
    output_and_exit( $input, $cookie, $template,  'wrong_csrf_token' )
56
        unless Koha::Token->new->check_csrf({
56
        unless Koha::Token->new->check_csrf({
57
            session_id => scalar $input->cookie('CGISESSID'),
57
            session_id => scalar $input->cookie('CGISESSID'),
58
            token  => scalar $input->param('csrf_token'),
58
            token  => scalar $input->param('csrf_token'),
(-)a/members/member-password.pl (-1 / +1 lines)
Lines 72-78 if ( $newpassword and not @errors ) { Link Here
72
72
73
if ( $newpassword and not @errors) {
73
if ( $newpassword and not @errors) {
74
74
75
    die "Wrong CSRF token"
75
    output_and_exit( $input, $cookie, $template,  'wrong_csrf_token' )
76
        unless Koha::Token->new->check_csrf({
76
        unless Koha::Token->new->check_csrf({
77
            session_id => scalar $input->cookie('CGISESSID'),
77
            session_id => scalar $input->cookie('CGISESSID'),
78
            token  => scalar $input->param('csrf_token'),
78
            token  => scalar $input->param('csrf_token'),
(-)a/members/memberentry.pl (-1 / +1 lines)
Lines 306-312 $debug and warn join "\t", map {"$_: $newdata{$_}"} qw(dateofbirth dateenrolled Link Here
306
my $extended_patron_attributes = ();
306
my $extended_patron_attributes = ();
307
if ($op eq 'save' || $op eq 'insert'){
307
if ($op eq 'save' || $op eq 'insert'){
308
308
309
    die "Wrong CSRF token"
309
    output_and_exit( $input, $cookie, $template,  'wrong_csrf_token' )
310
        unless Koha::Token->new->check_csrf({
310
        unless Koha::Token->new->check_csrf({
311
            session_id => scalar $input->cookie('CGISESSID'),
311
            session_id => scalar $input->cookie('CGISESSID'),
312
            token  => scalar $input->param('csrf_token'),
312
            token  => scalar $input->param('csrf_token'),
(-)a/members/paycollect.pl (-1 / +1 lines)
Lines 112-118 if ( $total_paid and $total_paid ne '0.00' ) { Link Here
112
            total_due => $total_due
112
            total_due => $total_due
113
        );
113
        );
114
    } else {
114
    } else {
115
        die "Wrong CSRF token"
115
        output_and_exit( $input, $cookie, $template,  'wrong_csrf_token' )
116
            unless Koha::Token->new->check_csrf( {
116
            unless Koha::Token->new->check_csrf( {
117
                session_id => $input->cookie('CGISESSID'),
117
                session_id => $input->cookie('CGISESSID'),
118
                token  => scalar $input->param('csrf_token'),
118
                token  => scalar $input->param('csrf_token'),
(-)a/tools/import_borrowers.pl (-1 / +1 lines)
Lines 111-117 my $patronlistname = $uploadborrowers . ' (' . $timestamp .')'; Link Here
111
$template->param( SCRIPT_NAME => '/cgi-bin/koha/tools/import_borrowers.pl' );
111
$template->param( SCRIPT_NAME => '/cgi-bin/koha/tools/import_borrowers.pl' );
112
112
113
if ( $uploadborrowers && length($uploadborrowers) > 0 ) {
113
if ( $uploadborrowers && length($uploadborrowers) > 0 ) {
114
    die "Wrong CSRF token"
114
    output_and_exit( $input, $cookie, $template, 'wrong_csrf_token' )
115
        unless Koha::Token->new->check_csrf({
115
        unless Koha::Token->new->check_csrf({
116
            session_id => scalar $input->cookie('CGISESSID'),
116
            session_id => scalar $input->cookie('CGISESSID'),
117
            token  => scalar $input->param('csrf_token'),
117
            token  => scalar $input->param('csrf_token'),
(-)a/tools/picture-upload.pl (-3 / +2 lines)
Lines 83-89 our %errors = (); Link Here
83
# Case is important in these operational values as the template must use case to be visually pleasing!
83
# Case is important in these operational values as the template must use case to be visually pleasing!
84
if ( ( $op eq 'Upload' ) && $uploadfile ) {
84
if ( ( $op eq 'Upload' ) && $uploadfile ) {
85
85
86
    die "Wrong CSRF token"
86
    output_and_exit( $input, $cookie, $template, 'wrong_csrf_token' )
87
        unless Koha::Token->new->check_csrf({
87
        unless Koha::Token->new->check_csrf({
88
            session_id => scalar $input->cookie('CGISESSID'),
88
            session_id => scalar $input->cookie('CGISESSID'),
89
            token  => scalar $input->param('csrf_token'),
89
            token  => scalar $input->param('csrf_token'),
Lines 172-178 elsif ( ( $op eq 'Upload' ) && !$uploadfile ) { Link Here
172
    $template->param( filetype   => $filetype );
172
    $template->param( filetype   => $filetype );
173
}
173
}
174
elsif ( $op eq 'Delete' ) {
174
elsif ( $op eq 'Delete' ) {
175
    die "Wrong CSRF token"
175
    output_and_exit( $input, $cookie, $template, 'wrong_csrf_token' )
176
        unless Koha::Token->new->check_csrf({
176
        unless Koha::Token->new->check_csrf({
177
            session_id => scalar $input->cookie('CGISESSID'),
177
            session_id => scalar $input->cookie('CGISESSID'),
178
            token  => scalar $input->param('csrf_token'),
178
            token  => scalar $input->param('csrf_token'),
179
- 

Return to bug 21993