@@ -, +, @@ token is wrong - authorities-home.pl * Delete an authority record * hit /cgi-bin/koha/authorities/authorities-home.pl?op=delete - basket/sendbasket.pl * Send a basket to someone * hit /cgi-bin/koha/basket/sendbasket.pl?email_add=1 - members/apikeys.pl * Generate and delete an API key for a patron * hit /cgi-bin/koha/members/apikeys.pl?patron_id=51&op=delete - members/deletemem.pl * Delete a patron * hit /cgi-bin/koha/members/deletemem.pl?member=42&op=delete_confirmed - members/mancredit.pl * Add a manual credit * hit /cgi-bin/koha/members/mancredit.pl?borrowernumber=51&add=1 - members/maninvoice.pl * Add a manual invoice * hit /cgi-bin/koha/members/maninvoice.pl?borrowernumber=51&add=1 - members/member-flags.pl * Change permissions for a patron * hit /cgi-bin/koha/members/member-flags.pl?member=51&newflags=1 - members/member-password.pl * Change the password for a patron (from the staff interface) * hit /cgi-bin/koha/members/member-password.pl?member=51&newpassword=aA1 - members/memberentry.pl * Edit some patron's info * hit /cgi-bin/koha/members/memberentry.pl?borrowernumber=51&op=save - members/paycollect.pl * Pay an individual fine * hit something like /cgi-bin/koha/members/paycollect.pl?borrowernumber=51&pay_individual=1&accounttype=L&amount=1.00&amountoutstanding=1.00&accountlines_id=157&paid=1 You may need to edit some values - tools/import_borrowers.pl * Import some patrons * hit /cgi-bin/koha/tools/import_borrowers.pl?uploadborrowers=1 - tools/picture-upload.pl * Upload an image for a patron * You will need to edit the html content hit Home › Tools › Upload patron images then locate the csrf_token input and modify its value - Opac is not done as blocking_errors.inc does not exist for this - ill/ill-requests.pl --- authorities/authorities-home.pl | 9 +++++---- basket/sendbasket.pl | 9 +++++---- .../prog/en/includes/blocking_errors.inc | 2 ++ .../prog/en/modules/basket/sendbasketform.tt | 1 + .../prog/en/modules/tools/import_borrowers.tt | 1 + .../prog/en/modules/tools/picture-upload.tt | 1 + members/apikeys.pl | 10 +++++----- members/deletemem.pl | 2 +- members/mancredit.pl | 2 +- members/maninvoice.pl | 20 ++++++++++---------- members/member-flags.pl | 2 +- members/member-password.pl | 2 +- members/memberentry.pl | 2 +- members/paycollect.pl | 2 +- tools/import_borrowers.pl | 2 +- tools/picture-upload.pl | 4 ++-- 16 files changed, 39 insertions(+), 32 deletions(-) --- a/authorities/authorities-home.pl +++ a/authorities/authorities-home.pl @@ -61,10 +61,11 @@ if ( $op eq "delete" ) { } ); - die "Wrong CSRF token" unless Koha::Token->new->check_csrf({ - session_id => scalar $query->cookie('CGISESSID'), - token => scalar $query->param('csrf_token'), - }); + output_and_exit( $query, $cookie, $template, 'wrong_csrf_token' ) + unless Koha::Token->new->check_csrf({ + session_id => scalar $query->cookie('CGISESSID'), + token => scalar $query->param('csrf_token'), + }); DelAuthority({ authid => $authid }); --- a/basket/sendbasket.pl +++ a/basket/sendbasket.pl @@ -50,10 +50,11 @@ my $email_add = $query->param('email_add'); my $dbh = C4::Context->dbh; if ( $email_add ) { - die "Wrong CSRF token" unless Koha::Token->new->check_csrf({ - session_id => scalar $query->cookie('CGISESSID'), - token => scalar $query->param('csrf_token'), - }); + output_and_exit( $query, $cookie, $template, 'wrong_csrf_token' ) + unless Koha::Token->new->check_csrf({ + session_id => scalar $query->cookie('CGISESSID'), + token => scalar $query->param('csrf_token'), + }); my $email = Koha::Email->new(); my %mail = $email->create_message_headers({ to => $email_add }); my $comment = $query->param('comment'); --- a/koha-tmpl/intranet-tmpl/prog/en/includes/blocking_errors.inc +++ a/koha-tmpl/intranet-tmpl/prog/en/includes/blocking_errors.inc @@ -11,6 +11,8 @@
[% CASE 'unknown_basket' %] + [% CASE 'wrong_csrf_token' %] + [% CASE %][% blocking_error | html %] [% END %] --- a/koha-tmpl/intranet-tmpl/prog/en/modules/basket/sendbasketform.tt +++ a/koha-tmpl/intranet-tmpl/prog/en/modules/basket/sendbasketform.tt @@ -16,6 +16,7 @@ [% ELSE %] +[% INCLUDE 'blocking_errors.inc' %]