From c6969ca3790a0ab14eb6a9d0da1a760e72e977a4 Mon Sep 17 00:00:00 2001 From: Amit Gupta Date: Mon, 27 May 2019 04:36:05 +0000 Subject: [PATCH] Bug 22990 - Add CSRF protection to basketheader.pl Test plan 1. Create vendor 2. Create basket using the form
3. You can able to create the basket. 4. Apply the patch 5. Now you can get error "The form submission failed (Wrong CSRF token). Try to come back, refresh the page, then try again." --- C4/Auth.pm | 2 ++ C4/Output.pm | 36 ++++++++++++++-------- acqui/basketheader.pl | 3 ++ .../intranet-tmpl/prog/en/includes/csrf-token.inc | 1 + .../prog/en/modules/acqui/basketheader.tt | 2 ++ 5 files changed, 31 insertions(+), 13 deletions(-) create mode 100644 koha-tmpl/intranet-tmpl/prog/en/includes/csrf-token.inc diff --git a/C4/Auth.pm b/C4/Auth.pm index d79ce46..4493716 100644 --- a/C4/Auth.pm +++ b/C4/Auth.pm @@ -45,6 +45,7 @@ use List::MoreUtils qw/ any /; use Encode qw( encode is_utf8); use C4::Auth_with_shibboleth; use Net::CIDR; +use Koha::Token; # use utf8; use vars qw(@ISA @EXPORT @EXPORT_OK %EXPORT_TAGS $debug $ldap $cas $caslogout); @@ -272,6 +273,7 @@ sub get_template_and_user { $template->param( loggedinusernumber => $borrowernumber ); # FIXME Should be replaced with logged_in_user.borrowernumber $template->param( logged_in_user => $patron ); $template->param( sessionID => $sessionID ); + $template->param( csrf_token => Koha::Token->new->generate_csrf({ session_id => scalar $sessionID })); if ( $in->{'type'} eq 'opac' ) { require Koha::Virtualshelves; diff --git a/C4/Output.pm b/C4/Output.pm index e8a86cc..fbeb646 100644 --- a/C4/Output.pm +++ b/C4/Output.pm @@ -33,6 +33,7 @@ use Scalar::Util qw( looks_like_number ); use C4::Context; use C4::Templates; +use Koha::Token; use vars qw(@ISA @EXPORT @EXPORT_OK %EXPORT_TAGS); @@ -328,21 +329,30 @@ Others will be added here depending on the needs (for instance biblio does not e sub output_and_exit_if_error { my ( $query, $cookie, $template, $params ) = @_; my $error; - if ( $params and exists $params->{module} ) { - if ( $params->{module} eq 'members' ) { - my $logged_in_user = $params->{logged_in_user}; - my $current_patron = $params->{current_patron}; - if ( not $current_patron ) { - $error = 'unknown_patron'; - } - elsif( not $logged_in_user->can_see_patron_infos( $current_patron ) ) { - $error = 'cannot_see_patron_infos'; + if ($params->{module} eq 1) { + $error = 'wrong_csrf_token'; + output_and_exit( $query, $cookie, $template, $error ) + unless Koha::Token->new->check_csrf( { + session_id => scalar $cookie, + token => scalar $params->{csrf_token}, + }); + } else { + if ( $params and exists $params->{module} ) { + if ( $params->{module} eq 'members' ) { + my $logged_in_user = $params->{logged_in_user}; + my $current_patron = $params->{current_patron}; + if ( not $current_patron ) { + $error = 'unknown_patron'; + } + elsif( not $logged_in_user->can_see_patron_infos( $current_patron ) ) { + $error = 'cannot_see_patron_infos'; + } } - } - } + } - output_and_exit( $query, $cookie, $template, $error ) if $error; - return; + output_and_exit( $query, $cookie, $template, $error ) if $error; + return; + } } =item output_and_exit diff --git a/acqui/basketheader.pl b/acqui/basketheader.pl index 202f6b9..f4e9055 100755 --- a/acqui/basketheader.pl +++ b/acqui/basketheader.pl @@ -142,6 +142,9 @@ if ( $op eq 'add_form' ) { #End Edit } elsif ( $op eq 'add_validate' ) { #we are confirming the changes, save the basket + #we are checking CSRF Token. Module 1 indicate for CSRF, + output_and_exit_if_error( $input, $input->cookie('CGISESSID'), $template, { module => 1, csrf_token => $input->param('csrf_token') } ); + if ( $is_an_edit ) { ModBasketHeader( $basketno, diff --git a/koha-tmpl/intranet-tmpl/prog/en/includes/csrf-token.inc b/koha-tmpl/intranet-tmpl/prog/en/includes/csrf-token.inc new file mode 100644 index 0000000..703d4eb --- /dev/null +++ b/koha-tmpl/intranet-tmpl/prog/en/includes/csrf-token.inc @@ -0,0 +1 @@ + diff --git a/koha-tmpl/intranet-tmpl/prog/en/modules/acqui/basketheader.tt b/koha-tmpl/intranet-tmpl/prog/en/modules/acqui/basketheader.tt index f6a89c7..6ed377c 100644 --- a/koha-tmpl/intranet-tmpl/prog/en/modules/acqui/basketheader.tt +++ b/koha-tmpl/intranet-tmpl/prog/en/modules/acqui/basketheader.tt @@ -17,6 +17,7 @@ [% INCLUDE 'header.inc' %] [% INCLUDE 'acquisitions-search.inc' %] +[% INCLUDE 'blocking_errors.inc' %]