Summary: | Add CSRF protection to Content Management pages | ||
---|---|---|---|
Product: | Koha | Reporter: | David Cook <dcook> |
Component: | Tools | Assignee: | David Cook <dcook> |
Status: | RESOLVED FIXED | QA Contact: | Marcel de Rooy <m.de.rooy> |
Severity: | critical | ||
Priority: | P5 - low | CC: | 1joynelson, dcook, didier.gautheron, fridolin.somers, jonathan.druart, laurent.ducos, lucas, m.de.rooy, matt.blenkinsop, nick, tomascohen |
Version: | unspecified | ||
Hardware: | All | ||
OS: | All | ||
See Also: | https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=34348 | ||
Change sponsored?: | --- | Patch complexity: | Trivial patch |
Documentation contact: | Documentation submission: | ||
Text to go in the release notes: | Version(s) released in: |
23.11.00,23.05.02,22.11.08
|
|
Circulation function: | |||
Bug Depends on: | 30524 | ||
Bug Blocks: | 35019, 35752 | ||
Attachments: |
Bug 34368: Add CSRF token to Content Management pages
Bug 34368: Add CSRF token to Content Management pages Bug 34368: Add CSRF token to Content Management pages Bug 34368: [22.05.x] Add CSRF token to Content Management pages |
Description
David Cook
2023-07-25 04:57:57 UTC
Created attachment 153859 [details] [review] Bug 34368: Add CSRF token to Content Management pages This change adds a CSRF token to the Content Management pages at additional-contents.pl. Test plan: 0. Apply patch 1. koha-plack --restart kohadev 2. Try to add "News", "HTML customizations", and "Pages". 3. Try to delete these new content entries 4. Note that you were successful in your endeavours Created attachment 153860 [details] [review] Bug 34368: Add CSRF token to Content Management pages This change adds a CSRF token to the Content Management pages at additional-contents.pl. Test plan: 0. Apply patch 1. koha-plack --restart kohadev 2. Try to add "News", "HTML customizations", and "Pages". 3. Try to delete these new content entries 4. Note that you were successful in your endeavours JD amended patch: remove empty line removal (no need to create unecessary conflicts) Signed-off-by: Jonathan Druart <jonathan.druart@bugs.koha-community.org> Created attachment 153866 [details] [review] Bug 34368: Add CSRF token to Content Management pages This change adds a CSRF token to the Content Management pages at additional-contents.pl. Test plan: 0. Apply patch 1. koha-plack --restart kohadev 2. Try to add "News", "HTML customizations", and "Pages". 3. Try to delete these new content entries 4. Note that you were successful in your endeavours JD amended patch: remove empty line removal (no need to create unecessary conflicts) Signed-off-by: Jonathan Druart <jonathan.druart@bugs.koha-community.org> Signed-off-by: Marcel de Rooy <m.de.rooy@rijksmuseum.nl> Pushed to master for 23.11. Nice work everyone, thanks! Created attachment 154043 [details] [review] Bug 34368: [22.05.x] Add CSRF token to Content Management pages Pushed to 23.05.x for 23.05.02 Looks like this one didn't get fully backported to all supported versions? (In reply to David Cook from comment #9) > Looks like this one didn't get fully backported to all supported versions? 22.11 maybe is the only one missing after 23.11 is released? Hi David, This was included in the security release back in July for 22.11 - I just never got round to updating the bug! Just checked the branch and it is definitely included (In reply to Matt Blenkinsop from comment #11) > Hi David, > > This was included in the security release back in July for 22.11 - I just > never got round to updating the bug! Just checked the branch and it is > definitely included Thanks for following up, Matt. Appreciated! Shall we update "Version(s) released in"? Is that field usually updated manually or automatically? Good spot, normally that is done automatically but not for a security release |