gitea
/
Koha-clms
1
0
Fork 0
Code Issues Pull Requests Packages Projects Releases Wiki Activity

Bug 17830: CSRF - Handle unicode characters in userid 

If the userid of the logged in user contains unicode characters, the token
will not be generated correctly and Koha will crash with:
  Wide character in subroutine entry at /usr/share/perl5/Digest/HMAC.pm line 63.

Test plan:
- Edit a superlibrarian user and set his/her userid to '❤' or any other strings
with unicode characters.
- Login using this patron
- Search for patrons and click on a result.

=> Without this patch, you will get a software error (with "Wide
character in subroutine entry" in the logs).
=> With this patch, everything will go fine

You can also test the other files modified by this patch.

Signed-off-by: Karam Qubsi <karamqubsi@gmail.com>

Signed-off-by: Kyle M Hall <kyle@bywatersolutions.com>
This commit is contained in:
Jonathan Druart 2016-12-29 17:54:40 +01:00 committed by Kyle M Hall
parent f43a73597e
commit 4e40339db3
9 changed files with 20 additions and 20 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

4
basket/sendbasket.pl
View File

@ -52,7 +52,7 @@ my $dbh = C4::Context->dbh;
if ( $email_add ) {
die "Wrong CSRF token" unless Koha::Token->new->check_csrf({
id => C4::Context->userenv->{id},
id => Encode::encode( 'UTF-8', C4::Context->userenv->{id} ),
secret => md5_base64( Encode::encode( 'UTF-8', C4::Context->config('pass') ) ),
token => scalar $query->param('csrf_token'),
});
@ -177,7 +177,7 @@ else {
suggestion => C4::Context->preference("suggestion"),
virtualshelves => C4::Context->preference("virtualshelves"),
csrf_token => Koha::Token->new->generate_csrf(
{ id => C4::Context->userenv->{id},
{ id => Encode::encode( 'UTF-8', C4::Context->userenv->{id} ),
secret => md5_base64( Encode::encode( 'UTF-8', C4::Context->config('pass') ) ),
}
),

4
members/deletemem.pl
View File

@ -148,7 +148,7 @@ if ( $op eq 'delete_confirm' or $countissues > 0 or $flags->{'CHARGES'} or $is_
$template->param(
op => 'delete_confirm',
csrf_token => Koha::Token->new->generate_csrf(
{ id => C4::Context->userenv->{id},
{ id => Encode::encode( 'UTF-8', C4::Context->userenv->{id} ),
secret => md5_base64( Encode::encode( 'UTF-8', C4::Context->config('pass') ) ),
}
),
@ -158,7 +158,7 @@ if ( $op eq 'delete_confirm' or $countissues > 0 or $flags->{'CHARGES'} or $is_
die "Wrong CSRF token"
unless Koha::Token->new->check_csrf({
id => C4::Context->userenv->{id},
id => Encode::encode( 'UTF-8', C4::Context->userenv->{id} ),
secret => md5_base64( Encode::encode( 'UTF-8', C4::Context->config('pass') ) ),
token => scalar $input->param('csrf_token'),
});

4
members/member-password.pl
View File

@ -69,7 +69,7 @@ if ( $newpassword && !scalar(@errors) ) {
die "Wrong CSRF token"
unless Koha::Token->new->check_csrf({
id => C4::Context->userenv->{id},
id => Encode::encode( 'UTF-8', C4::Context->userenv->{id} ),
secret => md5_base64( Encode::encode( 'UTF-8', C4::Context->config('pass') ) ),
token => scalar $input->param('csrf_token'),
});
@ -151,7 +151,7 @@ $template->param(
minPasswordLength => $minpw,
RoutingSerials => C4::Context->preference('RoutingSerials'),
csrf_token => Koha::Token->new->generate_csrf({
id => C4::Context->userenv->{id},
id => Encode::encode( 'UTF-8', C4::Context->userenv->{id} ),
secret => md5_base64( Encode::encode( 'UTF-8', C4::Context->config('pass') ) ),
}),
);

4
members/memberentry.pl
View File

@ -290,7 +290,7 @@ if ($op eq 'save' || $op eq 'insert'){
die "Wrong CSRF token"
unless Koha::Token->new->check_csrf({
id => C4::Context->userenv->{id},
id => Encode::encode( 'UTF-8', C4::Context->userenv->{id} ),
secret => md5_base64( Encode::encode( 'UTF-8', C4::Context->config('pass') ) ),
token => scalar $input->param('csrf_token'),
});
@ -753,7 +753,7 @@ $template->param(
# Generate CSRF token
$template->param(
csrf_token => Koha::Token->new->generate_csrf(
{ id => C4::Context->userenv->{id},
{ id => Encode::encode( 'UTF-8', C4::Context->userenv->{id} ),
secret => md5_base64( Encode::encode( 'UTF-8', C4::Context->config('pass') ) ),
}
),

2
members/moremember.pl
View File

@ -273,7 +273,7 @@ $template->param( picture => 1 ) if $patron_image;
# Generate CSRF token for upload and delete image buttons
$template->param(
csrf_token => Koha::Token->new->generate_csrf({
id => C4::Context->userenv->{id},
id => Encode::encode( 'UTF-8', C4::Context->userenv->{id} ),
secret => md5_base64( Encode::encode( 'UTF-8', C4::Context->config('pass') ) ),
}),
);

8
opac/opac-memberentry.pl
View File

@ -200,7 +200,7 @@ elsif ( $action eq 'update' ) {
my $borrower = GetMember( borrowernumber => $borrowernumber );
die "Wrong CSRF token"
unless Koha::Token->new->check_csrf({
id => $borrower->{userid},
id => Encode::encode( 'UTF-8', $borrower->{userid} ),
secret => md5_base64( Encode::encode( 'UTF-8', C4::Context->config('pass') ) ),
token => scalar $cgi->param('csrf_token'),
});
@ -221,7 +221,7 @@ elsif ( $action eq 'update' ) {
invalid_form_fields => $invalidformfields,
borrower => \%borrower,
csrf_token => Koha::Token->new->generate_csrf({
id => $borrower->{userid},
id => Encode::encode( 'UTF-8', $borrower->{userid} ),
secret => md5_base64( Encode::encode( 'UTF-8', C4::Context->config('pass') ) ),
}),
);
@ -262,7 +262,7 @@ elsif ( $action eq 'update' ) {
nochanges => 1,
borrower => GetMember( borrowernumber => $borrowernumber ),
csrf_token => Koha::Token->new->generate_csrf({
id => $borrower->{userid},
id => Encode::encode( 'UTF-8', $borrower->{userid} ),
secret => md5_base64( Encode::encode( 'UTF-8', C4::Context->config('pass') ) ),
}),
);
@ -285,7 +285,7 @@ elsif ( $action eq 'edit' ) { #Display logged in borrower's data
guarantor => scalar Koha::Patrons->find($borrowernumber)->guarantor(),
hidden => GetHiddenFields( $mandatory, 'modification' ),
csrf_token => Koha::Token->new->generate_csrf({
id => $borrower->{userid},
id => Encode::encode( 'UTF-8', $borrower->{userid} ),
secret => md5_base64( Encode::encode( 'UTF-8', C4::Context->config('pass') ) ),
}),
);

4
opac/opac-sendbasket.pl
View File

@ -54,7 +54,7 @@ my $dbh = C4::Context->dbh;
if ( $email_add ) {
die "Wrong CSRF token" unless Koha::Token->new->check_csrf({
id => C4::Context->userenv->{id},
id => Encode::encode( 'UTF-8', C4::Context->userenv->{id} ),
secret => md5_base64( Encode::encode( 'UTF-8', C4::Context->config('pass') ) ),
token => scalar $query->param('csrf_token'),
});
@ -197,7 +197,7 @@ else {
suggestion => C4::Context->preference("suggestion"),
virtualshelves => C4::Context->preference("virtualshelves"),
csrf_token => Koha::Token->new->generate_csrf(
{ id => C4::Context->userenv->{id},
{ id => Encode::encode( 'UTF-8', C4::Context->userenv->{id} ),
secret => md5_base64( Encode::encode( 'UTF-8', C4::Context->config('pass') ) ),
}
),

4
tools/import_borrowers.pl
View File

@ -112,7 +112,7 @@ $template->param( SCRIPT_NAME => '/cgi-bin/koha/tools/import_borrowers.pl' );
if ( $uploadborrowers && length($uploadborrowers) > 0 ) {
die "Wrong CSRF token"
unless Koha::Token->new->check_csrf({
id => C4::Context->userenv->{id},
id => Encode::encode( 'UTF-8', C4::Context->userenv->{id} ),
secret => md5_base64( Encode::encode( 'UTF-8', C4::Context->config('pass') ) ),
token => scalar $input->param('csrf_token'),
});
@ -391,7 +391,7 @@ if ( $uploadborrowers && length($uploadborrowers) > 0 ) {
$template->param(
csrf_token => Koha::Token->new->generate_csrf(
{ id => C4::Context->userenv->{id},
{ id => Encode::encode( 'UTF-8', C4::Context->userenv->{id} ),
secret => md5_base64( Encode::encode( 'UTF-8', C4::Context->config('pass') ) ),
}
),

6
tools/picture-upload.pl
View File

@ -88,7 +88,7 @@ if ( ( $op eq 'Upload' ) && $uploadfile ) {
die "Wrong CSRF token"
unless Koha::Token->new->check_csrf({
id => C4::Context->userenv->{id},
id => Encode::encode( 'UTF-8', C4::Context->userenv->{id} ),
secret => md5_base64( Encode::encode( 'UTF-8', C4::Context->config('pass') ) ),
token => scalar $input->param('csrf_token'),
});
@ -176,7 +176,7 @@ elsif ( ( $op eq 'Upload' ) && !$uploadfile ) {
elsif ( $op eq 'Delete' ) {
die "Wrong CSRF token"
unless Koha::Token->new->check_csrf({
id => C4::Context->userenv->{id},
id => Encode::encode( 'UTF-8', C4::Context->userenv->{id} ),
secret => md5_base64( Encode::encode( 'UTF-8', C4::Context->config('pass') ) ),
token => scalar $input->param('csrf_token'),
});
@ -195,7 +195,7 @@ if ( $borrowernumber && !%errors && !$template->param('ERRORS') ) {
else {
$template->param(
csrf_token => Koha::Token->new->generate_csrf({
id => C4::Context->userenv->{id},
id => Encode::encode( 'UTF-8', C4::Context->userenv->{id} ),
secret => md5_base64( Encode::encode( 'UTF-8', C4::Context->config('pass') ) ),
}),
);