View | Details | Raw Unified | Return to bug 24673
Collapse All | Expand All

(-)a/koha-tmpl/opac-tmpl/bootstrap/en/modules/opac-messaging.tt (+1 lines)
Lines 29-34 Link Here
29
                        <div class="alert alert-success"><h4>Settings updated</h4></div>
29
                        <div class="alert alert-success"><h4>Settings updated</h4></div>
30
                    [% END %]
30
                    [% END %]
31
                    <form action="/cgi-bin/koha/opac-messaging.pl" method="get" name="opacmessaging">
31
                    <form action="/cgi-bin/koha/opac-messaging.pl" method="get" name="opacmessaging">
32
                        <input type="hidden" name="csrf_token" value="[% csrf_token | html %]" />
32
                        <input type="hidden" name="modify" value="yes" />
33
                        <input type="hidden" name="modify" value="yes" />
33
34
34
                            <table class="table table-bordered table-condensed table-striped">
35
                            <table class="table table-bordered table-condensed table-striped">
(-)a/opac/opac-messaging.pl (-1 / +13 lines)
Lines 31-36 use C4::Members::Messaging; Link Here
31
use C4::Form::MessagingPreferences;
31
use C4::Form::MessagingPreferences;
32
use Koha::Patrons;
32
use Koha::Patrons;
33
use Koha::SMS::Providers;
33
use Koha::SMS::Providers;
34
use Koha::Token;
34
35
35
my $query = CGI->new();
36
my $query = CGI->new();
36
37
Lines 55-60 my $patron = Koha::Patrons->find( $borrowernumber ); # FIXME and if borrowernumb Link Here
55
my $messaging_options = C4::Members::Messaging::GetMessagingOptions();
56
my $messaging_options = C4::Members::Messaging::GetMessagingOptions();
56
57
57
if ( defined $query->param('modify') && $query->param('modify') eq 'yes' ) {
58
if ( defined $query->param('modify') && $query->param('modify') eq 'yes' ) {
59
    die "Wrong CSRF token" unless Koha::Token->new->check_csrf({
60
        session_id => scalar $query->cookie('CGISESSID'),
61
        token  => scalar $query->param('csrf_token'),
62
    });
63
58
    my $sms = $query->param('SMSnumber');
64
    my $sms = $query->param('SMSnumber');
59
    my $sms_provider_id = $query->param('sms_provider_id');
65
    my $sms_provider_id = $query->param('sms_provider_id');
60
    if ( defined $sms && ( $patron->smsalertnumber // '' ) ne $sms
66
    if ( defined $sms && ( $patron->smsalertnumber // '' ) ne $sms
Lines 81-84 if ( C4::Context->preference("SMSSendDriver") eq 'Email' ) { Link Here
81
    $template->param( sms_providers => \@providers, sms_provider_id => $patron->sms_provider_id );
87
    $template->param( sms_providers => \@providers, sms_provider_id => $patron->sms_provider_id );
82
}
88
}
83
89
90
my $new_session_id = $cookie->value;
91
$template->param(
92
    csrf_token => Koha::Token->new->generate_csrf({
93
            session_id => $new_session_id,
94
        }),
95
);
96
84
output_html_with_http_headers $query, $cookie, $template->output, undef, { force_no_caching => 1 };
97
output_html_with_http_headers $query, $cookie, $template->output, undef, { force_no_caching => 1 };
85
- 

Return to bug 24673