The "News", "HTML customizations", and "Pages" need urgent CSRF protection to prevent external XSS injection.
Created attachment 153859 [details] [review] Bug 34368: Add CSRF token to Content Management pages This change adds a CSRF token to the Content Management pages at additional-contents.pl. Test plan: 0. Apply patch 1. koha-plack --restart kohadev 2. Try to add "News", "HTML customizations", and "Pages". 3. Try to delete these new content entries 4. Note that you were successful in your endeavours
Created attachment 153860 [details] [review] Bug 34368: Add CSRF token to Content Management pages This change adds a CSRF token to the Content Management pages at additional-contents.pl. Test plan: 0. Apply patch 1. koha-plack --restart kohadev 2. Try to add "News", "HTML customizations", and "Pages". 3. Try to delete these new content entries 4. Note that you were successful in your endeavours JD amended patch: remove empty line removal (no need to create unecessary conflicts) Signed-off-by: Jonathan Druart <jonathan.druart@bugs.koha-community.org>
Created attachment 153866 [details] [review] Bug 34368: Add CSRF token to Content Management pages This change adds a CSRF token to the Content Management pages at additional-contents.pl. Test plan: 0. Apply patch 1. koha-plack --restart kohadev 2. Try to add "News", "HTML customizations", and "Pages". 3. Try to delete these new content entries 4. Note that you were successful in your endeavours JD amended patch: remove empty line removal (no need to create unecessary conflicts) Signed-off-by: Jonathan Druart <jonathan.druart@bugs.koha-community.org> Signed-off-by: Marcel de Rooy <m.de.rooy@rijksmuseum.nl>
Pushed to master for 23.11. Nice work everyone, thanks!
Created attachment 154043 [details] [review] Bug 34368: [22.05.x] Add CSRF token to Content Management pages
Pushed to 23.05.x for 23.05.02
Looks like this one didn't get fully backported to all supported versions?
(In reply to David Cook from comment #9) > Looks like this one didn't get fully backported to all supported versions? 22.11 maybe is the only one missing after 23.11 is released?
Hi David, This was included in the security release back in July for 22.11 - I just never got round to updating the bug! Just checked the branch and it is definitely included
(In reply to Matt Blenkinsop from comment #11) > Hi David, > > This was included in the security release back in July for 22.11 - I just > never got round to updating the bug! Just checked the branch and it is > definitely included Thanks for following up, Matt. Appreciated! Shall we update "Version(s) released in"? Is that field usually updated manually or automatically?
Good spot, normally that is done automatically but not for a security release