@@ -, +, @@ token is wrong - authorities-home.pl * Delete an authority record * hit /cgi-bin/koha/authorities/authorities-home.pl?op=delete - basket/sendbasket.pl * Send a basket to someone * hit /cgi-bin/koha/basket/sendbasket.pl?email_add=1 - members/apikeys.pl * Generate and delete an API key for a patron * hit /cgi-bin/koha/members/apikeys.pl?patron_id=51&op=delete - members/deletemem.pl * Delete a patron * hit /cgi-bin/koha/members/deletemem.pl?member=42&op=delete_confirmed - members/mancredit.pl * Add a manual credit * hit /cgi-bin/koha/members/mancredit.pl?borrowernumber=51&add=1 - members/maninvoice.pl * Add a manual invoice * hit /cgi-bin/koha/members/maninvoice.pl?borrowernumber=51&add=1 - members/member-flags.pl * Change permissions for a patron * hit /cgi-bin/koha/members/member-flags.pl?member=51&newflags=1 - members/member-password.pl * Change the password for a patron (from the staff interface) * hit /cgi-bin/koha/members/member-password.pl?member=51&newpassword=aA1 - members/memberentry.pl * Edit some patron's info * hit /cgi-bin/koha/members/memberentry.pl?borrowernumber=51&op=save - members/paycollect.pl * Pay an individual fine * hit something like /cgi-bin/koha/members/paycollect.pl?borrowernumber=51&pay_individual=1&accounttype=L&amount=1.00&amountoutstanding=1.00&accountlines_id=157&paid=1 You may need to edit some values - tools/import_borrowers.pl * Import some patrons * hit /cgi-bin/koha/tools/import_borrowers.pl?uploadborrowers=1 - tools/picture-upload.pl * Upload an image for a patron * You will need to edit the html content hit Home › Tools › Upload patron images then locate the csrf_token input and modify its value - Opac is not done as blocking_errors.inc does not exist for this - ill/ill-requests.pl --- authorities/authorities-home.pl | 9 +++++---- basket/sendbasket.pl | 9 +++++---- .../prog/en/includes/blocking_errors.inc | 2 ++ .../prog/en/modules/basket/sendbasketform.tt | 1 + .../prog/en/modules/tools/import_borrowers.tt | 1 + .../prog/en/modules/tools/picture-upload.tt | 1 + members/apikeys.pl | 10 +++++----- members/deletemem.pl | 2 +- members/mancredit.pl | 2 +- members/maninvoice.pl | 20 ++++++++++---------- members/member-flags.pl | 2 +- members/member-password.pl | 2 +- members/memberentry.pl | 2 +- members/paycollect.pl | 2 +- tools/import_borrowers.pl | 2 +- tools/picture-upload.pl | 4 ++-- 16 files changed, 39 insertions(+), 32 deletions(-) --- a/authorities/authorities-home.pl +++ a/authorities/authorities-home.pl @@ -61,10 +61,11 @@ if ( $op eq "delete" ) { } ); - die "Wrong CSRF token" unless Koha::Token->new->check_csrf({ - session_id => scalar $query->cookie('CGISESSID'), - token => scalar $query->param('csrf_token'), - }); + output_and_exit( $query, $cookie, $template, 'wrong_csrf_token' ) + unless Koha::Token->new->check_csrf({ + session_id => scalar $query->cookie('CGISESSID'), + token => scalar $query->param('csrf_token'), + }); DelAuthority({ authid => $authid }); --- a/basket/sendbasket.pl +++ a/basket/sendbasket.pl @@ -50,10 +50,11 @@ my $email_add = $query->param('email_add'); my $dbh = C4::Context->dbh; if ( $email_add ) { - die "Wrong CSRF token" unless Koha::Token->new->check_csrf({ - session_id => scalar $query->cookie('CGISESSID'), - token => scalar $query->param('csrf_token'), - }); + output_and_exit( $query, $cookie, $template, 'wrong_csrf_token' ) + unless Koha::Token->new->check_csrf({ + session_id => scalar $query->cookie('CGISESSID'), + token => scalar $query->param('csrf_token'), + }); my $email = Koha::Email->new(); my %mail = $email->create_message_headers({ to => $email_add }); my $comment = $query->param('comment'); --- a/koha-tmpl/intranet-tmpl/prog/en/includes/blocking_errors.inc +++ a/koha-tmpl/intranet-tmpl/prog/en/includes/blocking_errors.inc @@ -11,6 +11,8 @@
This subscription does not exist.
[% CASE 'unknown_basket' %]
This basket does not exist.
+ [% CASE 'wrong_csrf_token' %] +
The form submission failed (Wrong CSRF token). Try to come back, refresh the page, then try again.
[% CASE %][% blocking_error | html %] [% END %] --- a/koha-tmpl/intranet-tmpl/prog/en/modules/basket/sendbasketform.tt +++ a/koha-tmpl/intranet-tmpl/prog/en/modules/basket/sendbasketform.tt @@ -16,6 +16,7 @@ [% ELSE %] +[% INCLUDE 'blocking_errors.inc' %]
--- a/koha-tmpl/intranet-tmpl/prog/en/modules/tools/import_borrowers.tt +++ a/koha-tmpl/intranet-tmpl/prog/en/modules/tools/import_borrowers.tt @@ -20,6 +20,7 @@ +[% INCLUDE 'blocking_errors.inc' %]
--- a/koha-tmpl/intranet-tmpl/prog/en/modules/tools/picture-upload.tt +++ a/koha-tmpl/intranet-tmpl/prog/en/modules/tools/picture-upload.tt @@ -13,6 +13,7 @@ +[% INCLUDE 'blocking_errors.inc' %]
--- a/members/apikeys.pl +++ a/members/apikeys.pl @@ -60,11 +60,11 @@ if ( $op eq 'generate' or $op eq 'revoke' or $op eq 'activate' ) { - die "Wrong CSRF token" - unless Koha::Token->new->check_csrf({ - session_id => scalar $cgi->cookie('CGISESSID'), - token => scalar $cgi->param('csrf_token'), - }); + output_and_exit( $cgi, $cookie, $template, 'wrong_csrf_token' ) + unless Koha::Token->new->check_csrf({ + session_id => scalar $cgi->cookie('CGISESSID'), + token => scalar $cgi->param('csrf_token'), + }); } if ($op) { --- a/members/deletemem.pl +++ a/members/deletemem.pl @@ -109,7 +109,7 @@ if ( $op eq 'delete_confirm' or $countissues > 0 or $charges or $is_guarantor ) } } elsif ( $op eq 'delete_confirmed' ) { - die "Wrong CSRF token" + output_and_exit( $input, $cookie, $template, 'wrong_csrf_token' ) unless Koha::Token->new->check_csrf( { session_id => $input->cookie('CGISESSID'), token => scalar $input->param('csrf_token'), --- a/members/mancredit.pl +++ a/members/mancredit.pl @@ -62,7 +62,7 @@ my $add = $input->param('add'); if ($add){ - die "Wrong CSRF token" + output_and_exit( $input, $cookie, $template, 'wrong_csrf_token' ) unless Koha::Token->new->check_csrf( { session_id => scalar $input->cookie('CGISESSID'), token => scalar $input->param('csrf_token'), --- a/members/maninvoice.pl +++ a/members/maninvoice.pl @@ -40,6 +40,15 @@ use Koha::Patron::Categories; my $input=new CGI; my $flagsrequired = { borrowers => 'edit_borrowers' }; +my ( $template, $loggedinuser, $cookie ) = get_template_and_user( + { template_name => "members/maninvoice.tt", + query => $input, + type => "intranet", + authnotrequired => 0, + flagsrequired => $flagsrequired, + debug => 1, + } +); my $borrowernumber=$input->param('borrowernumber'); @@ -52,7 +61,7 @@ unless ( $patron ) { my $add=$input->param('add'); if ($add){ if ( checkauth( $input, 0, $flagsrequired, 'intranet' ) ) { - die "Wrong CSRF token" + output_and_exit( $input, $cookie, $template, 'wrong_csrf_token' ) unless Koha::Token->new->check_csrf( { session_id => scalar $input->cookie('CGISESSID'), token => scalar $input->param('csrf_token'), @@ -71,15 +80,6 @@ if ($add){ my $note = $input->param('note'); my $error = manualinvoice( $borrowernumber, $itemnum, $desc, $type, $amount, $note ); if ($error) { - my ( $template, $loggedinuser, $cookie ) = get_template_and_user( - { template_name => "members/maninvoice.tt", - query => $input, - type => "intranet", - authnotrequired => 0, - flagsrequired => $flagsrequired, - debug => 1, - } - ); if ( $error =~ /FOREIGN KEY/ && $error =~ /itemnumber/ ) { $template->param( 'ITEMNUMBER' => 1 ); } --- a/members/member-flags.pl +++ a/members/member-flags.pl @@ -52,7 +52,7 @@ $member2{'borrowernumber'}=$member; if ($input->param('newflags')) { - die "Wrong CSRF token" + output_and_exit( $input, $cookie, $template, 'wrong_csrf_token' ) unless Koha::Token->new->check_csrf({ session_id => scalar $input->cookie('CGISESSID'), token => scalar $input->param('csrf_token'), --- a/members/member-password.pl +++ a/members/member-password.pl @@ -72,7 +72,7 @@ if ( $newpassword and not @errors ) { if ( $newpassword and not @errors) { - die "Wrong CSRF token" + output_and_exit( $input, $cookie, $template, 'wrong_csrf_token' ) unless Koha::Token->new->check_csrf({ session_id => scalar $input->cookie('CGISESSID'), token => scalar $input->param('csrf_token'), --- a/members/memberentry.pl +++ a/members/memberentry.pl @@ -306,7 +306,7 @@ $debug and warn join "\t", map {"$_: $newdata{$_}"} qw(dateofbirth dateenrolled my $extended_patron_attributes = (); if ($op eq 'save' || $op eq 'insert'){ - die "Wrong CSRF token" + output_and_exit( $input, $cookie, $template, 'wrong_csrf_token' ) unless Koha::Token->new->check_csrf({ session_id => scalar $input->cookie('CGISESSID'), token => scalar $input->param('csrf_token'), --- a/members/paycollect.pl +++ a/members/paycollect.pl @@ -112,7 +112,7 @@ if ( $total_paid and $total_paid ne '0.00' ) { total_due => $total_due ); } else { - die "Wrong CSRF token" + output_and_exit( $input, $cookie, $template, 'wrong_csrf_token' ) unless Koha::Token->new->check_csrf( { session_id => $input->cookie('CGISESSID'), token => scalar $input->param('csrf_token'), --- a/tools/import_borrowers.pl +++ a/tools/import_borrowers.pl @@ -111,7 +111,7 @@ my $patronlistname = $uploadborrowers . ' (' . $timestamp .')'; $template->param( SCRIPT_NAME => '/cgi-bin/koha/tools/import_borrowers.pl' ); if ( $uploadborrowers && length($uploadborrowers) > 0 ) { - die "Wrong CSRF token" + output_and_exit( $input, $cookie, $template, 'wrong_csrf_token' ) unless Koha::Token->new->check_csrf({ session_id => scalar $input->cookie('CGISESSID'), token => scalar $input->param('csrf_token'), --- a/tools/picture-upload.pl +++ a/tools/picture-upload.pl @@ -83,7 +83,7 @@ our %errors = (); # Case is important in these operational values as the template must use case to be visually pleasing! if ( ( $op eq 'Upload' ) && $uploadfile ) { - die "Wrong CSRF token" + output_and_exit( $input, $cookie, $template, 'wrong_csrf_token' ) unless Koha::Token->new->check_csrf({ session_id => scalar $input->cookie('CGISESSID'), token => scalar $input->param('csrf_token'), @@ -172,7 +172,7 @@ elsif ( ( $op eq 'Upload' ) && !$uploadfile ) { $template->param( filetype => $filetype ); } elsif ( $op eq 'Delete' ) { - die "Wrong CSRF token" + output_and_exit( $input, $cookie, $template, 'wrong_csrf_token' ) unless Koha::Token->new->check_csrf({ session_id => scalar $input->cookie('CGISESSID'), token => scalar $input->param('csrf_token'), --