Bug 34368

Summary: Add CSRF protection to Content Management pages
Product: Koha Reporter: David Cook <dcook>
Component: ToolsAssignee: David Cook <dcook>
Status: RESOLVED FIXED QA Contact: Marcel de Rooy <m.de.rooy>
Severity: critical    
Priority: P5 - low CC: 1joynelson, dcook, didier.gautheron, fridolin.somers, jonathan.druart, laurent.ducos, lucas, m.de.rooy, matt.blenkinsop, nick, tomascohen
Version: unspecified   
Hardware: All   
OS: All   
See Also: https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=34348
Change sponsored?: --- Patch complexity: Trivial patch
Documentation contact: Documentation submission:
Text to go in the release notes:
Version(s) released in:
23.11.00,23.05.02,22.11.08
Circulation function:
Bug Depends on: 30524    
Bug Blocks: 35019, 35752    
Attachments: Bug 34368: Add CSRF token to Content Management pages
Bug 34368: Add CSRF token to Content Management pages
Bug 34368: Add CSRF token to Content Management pages
Bug 34368: [22.05.x] Add CSRF token to Content Management pages

Description David Cook 2023-07-25 04:57:57 UTC
The "News", "HTML customizations", and "Pages" need urgent CSRF protection to prevent external XSS injection.
Comment 1 David Cook 2023-07-25 05:19:52 UTC
Created attachment 153859 [details] [review]
Bug 34368: Add CSRF token to Content Management pages

This change adds a CSRF token to the Content Management pages
at additional-contents.pl.

Test plan:
0. Apply patch
1. koha-plack --restart kohadev
2. Try to add "News", "HTML customizations", and "Pages".
3. Try to delete these new content entries
4. Note that you were successful in your endeavours
Comment 4 Jonathan Druart 2023-07-25 06:18:43 UTC
Created attachment 153860 [details] [review]
Bug 34368: Add CSRF token to Content Management pages

This change adds a CSRF token to the Content Management pages
at additional-contents.pl.

Test plan:
0. Apply patch
1. koha-plack --restart kohadev
2. Try to add "News", "HTML customizations", and "Pages".
3. Try to delete these new content entries
4. Note that you were successful in your endeavours

JD amended patch: remove empty line removal (no need to create
unecessary conflicts)

Signed-off-by: Jonathan Druart <jonathan.druart@bugs.koha-community.org>
Comment 5 Marcel de Rooy 2023-07-25 10:54:02 UTC
Created attachment 153866 [details] [review]
Bug 34368: Add CSRF token to Content Management pages

This change adds a CSRF token to the Content Management pages
at additional-contents.pl.

Test plan:
0. Apply patch
1. koha-plack --restart kohadev
2. Try to add "News", "HTML customizations", and "Pages".
3. Try to delete these new content entries
4. Note that you were successful in your endeavours

JD amended patch: remove empty line removal (no need to create
unecessary conflicts)

Signed-off-by: Jonathan Druart <jonathan.druart@bugs.koha-community.org>

Signed-off-by: Marcel de Rooy <m.de.rooy@rijksmuseum.nl>
Comment 6 Tomás Cohen Arazi (tcohen) 2023-07-27 18:44:56 UTC
Pushed to master for 23.11.

Nice work everyone, thanks!
Comment 7 Lucas Gass (lukeg) 2023-07-28 14:52:13 UTC
Created attachment 154043 [details] [review]
Bug 34368: [22.05.x] Add CSRF token to Content Management pages
Comment 8 Fridolin Somers 2023-08-08 06:23:36 UTC
Pushed to 23.05.x for 23.05.02
Comment 9 David Cook 2023-11-03 00:03:55 UTC
Looks like this one didn't get fully backported to all supported versions?
Comment 10 David Cook 2023-11-03 00:07:28 UTC
(In reply to David Cook from comment #9)
> Looks like this one didn't get fully backported to all supported versions?

22.11 maybe is the only one missing after 23.11 is released?
Comment 11 Matt Blenkinsop 2023-11-13 14:15:55 UTC
Hi David, 

This was included in the security release back in July for 22.11 - I just never got round to updating the bug! Just checked the branch and it is definitely included
Comment 12 David Cook 2023-11-13 22:43:55 UTC
(In reply to Matt Blenkinsop from comment #11)
> Hi David, 
> 
> This was included in the security release back in July for 22.11 - I just
> never got round to updating the bug! Just checked the branch and it is
> definitely included

Thanks for following up, Matt. Appreciated! Shall we update "Version(s) released in"? 

Is that field usually updated manually or automatically?
Comment 13 Matt Blenkinsop 2023-11-14 09:22:27 UTC
Good spot, normally that is done automatically but not for a security release