| Summary: | CSRF vulnerability in opac-messaging.pl | ||
|---|---|---|---|
| Product: | Koha | Reporter: | David Cook <dcook> |
| Component: | Authentication | Assignee: | David Cook <dcook> |
| Status: | CLOSED FIXED | QA Contact: | |
| Severity: | major | ||
| Priority: | P5 - low | CC: | 1joynelson, chris, dpavlin, fridolin.somers, hayleypelham, jonathan.druart, lucas, martin.renvoize, nick |
| Version: | Main | ||
| Hardware: | All | ||
| OS: | All | ||
| Change sponsored?: | --- | Patch complexity: | Small patch |
| Documentation contact: | Documentation submission: | ||
| Text to go in the release notes: | Version(s) released in: |
20.05.00, 19.11.04, 19.05.09, 18.11.15,
|
|
| Circulation function: | |||
| Attachments: |
Bug 24673: Add CSRF token support to opac-messaging.pl
Bug 24673: Add CSRF token support to opac-messaging.pl |
||
|
Description
David Cook
2020-02-17 06:32:33 UTC
Created attachment 99066 [details] [review] Bug 24673: Add CSRF token support to opac-messaging.pl This patch adds CSRF token support to opac-messaging.pl, which allows users to manually update their messaging preferences, but prevents bad actors from tricking people into updating their preferences from cross-site requests. Test plan: 0. Set SMSSendDriver global system preference to "Test" if unset 1. Log into the OPAC 2. Navigate to a URL in your browser like the following: http://localhost:8080/cgi-bin/koha/opac-messaging.pl?modify=yes &1=email&digest=1&2-DAYS=5&2=email&digest=2&4=email&SMSnumber=0444444444 3. Observe that the preference and SMS number update 4. Apply the patch 5. Navigate to a URL in your browser like the following: http://localhost:8080/cgi-bin/koha/opac-messaging.pl?modify=yes &1=email&digest=1&2-DAYS=5&2=email&digest=2&4=email&SMSnumber=0444444444 6. Observe that you get an error message of "Wrong CSRF token" instead of the previous behaviour 7. Navigate to a URL in your browser like the following: http://localhost:8080/cgi-bin/koha/opac-messaging.pl 8. Update "Advance notice" to 3 and update "SMS number" to 61111111111 9. Observe that the "Advance notice" and "SMS number" fields update correctly Created attachment 99654 [details] [review] Bug 24673: Add CSRF token support to opac-messaging.pl This patch adds CSRF token support to opac-messaging.pl, which allows users to manually update their messaging preferences, but prevents bad actors from tricking people into updating their preferences from cross-site requests. Test plan: 0. Set SMSSendDriver global system preference to "Test" if unset 1. Log into the OPAC 2. Navigate to a URL in your browser like the following: http://localhost:8080/cgi-bin/koha/opac-messaging.pl?modify=yes &1=email&digest=1&2-DAYS=5&2=email&digest=2&4=email&SMSnumber=0444444444 3. Observe that the preference and SMS number update 4. Apply the patch 5. Navigate to a URL in your browser like the following: http://localhost:8080/cgi-bin/koha/opac-messaging.pl?modify=yes &1=email&digest=1&2-DAYS=5&2=email&digest=2&4=email&SMSnumber=0444444444 6. Observe that you get an error message of "Wrong CSRF token" instead of the previous behaviour 7. Navigate to a URL in your browser like the following: http://localhost:8080/cgi-bin/koha/opac-messaging.pl 8. Update "Advance notice" to 3 and update "SMS number" to 61111111111 9. Observe that the "Advance notice" and "SMS number" fields update correctly Signed-off-by: Jonathan Druart <jonathan.druart@bugs.koha-community.org> Trivial, skipping QA. Pushed to 19.11.04 Backported to 18.11.x for 18.11.15 backported to 19.05.x for 19.05.09 Pushed to master |