Using a URL like the following, you can trick a user into updating their messaging preferences - most importantly the SMSnumber. http://localhost:8080/cgi-bin/koha/opac-messaging.pl?modify=yes&1=email&digest=1&2-DAYS=5&2=email&digest=2&4=email&SMSnumber=0444444444
Created attachment 99066 [details] [review] Bug 24673: Add CSRF token support to opac-messaging.pl This patch adds CSRF token support to opac-messaging.pl, which allows users to manually update their messaging preferences, but prevents bad actors from tricking people into updating their preferences from cross-site requests. Test plan: 0. Set SMSSendDriver global system preference to "Test" if unset 1. Log into the OPAC 2. Navigate to a URL in your browser like the following: http://localhost:8080/cgi-bin/koha/opac-messaging.pl?modify=yes &1=email&digest=1&2-DAYS=5&2=email&digest=2&4=email&SMSnumber=0444444444 3. Observe that the preference and SMS number update 4. Apply the patch 5. Navigate to a URL in your browser like the following: http://localhost:8080/cgi-bin/koha/opac-messaging.pl?modify=yes &1=email&digest=1&2-DAYS=5&2=email&digest=2&4=email&SMSnumber=0444444444 6. Observe that you get an error message of "Wrong CSRF token" instead of the previous behaviour 7. Navigate to a URL in your browser like the following: http://localhost:8080/cgi-bin/koha/opac-messaging.pl 8. Update "Advance notice" to 3 and update "SMS number" to 61111111111 9. Observe that the "Advance notice" and "SMS number" fields update correctly
Created attachment 99654 [details] [review] Bug 24673: Add CSRF token support to opac-messaging.pl This patch adds CSRF token support to opac-messaging.pl, which allows users to manually update their messaging preferences, but prevents bad actors from tricking people into updating their preferences from cross-site requests. Test plan: 0. Set SMSSendDriver global system preference to "Test" if unset 1. Log into the OPAC 2. Navigate to a URL in your browser like the following: http://localhost:8080/cgi-bin/koha/opac-messaging.pl?modify=yes &1=email&digest=1&2-DAYS=5&2=email&digest=2&4=email&SMSnumber=0444444444 3. Observe that the preference and SMS number update 4. Apply the patch 5. Navigate to a URL in your browser like the following: http://localhost:8080/cgi-bin/koha/opac-messaging.pl?modify=yes &1=email&digest=1&2-DAYS=5&2=email&digest=2&4=email&SMSnumber=0444444444 6. Observe that you get an error message of "Wrong CSRF token" instead of the previous behaviour 7. Navigate to a URL in your browser like the following: http://localhost:8080/cgi-bin/koha/opac-messaging.pl 8. Update "Advance notice" to 3 and update "SMS number" to 61111111111 9. Observe that the "Advance notice" and "SMS number" fields update correctly Signed-off-by: Jonathan Druart <jonathan.druart@bugs.koha-community.org>
Trivial, skipping QA.
Pushed to 19.11.04
Backported to 18.11.x for 18.11.15
backported to 19.05.x for 19.05.09
Pushed to master