gitea
/
Koha-clms
1
0
Fork 0
Code Issues Pull Requests Packages Projects Releases Wiki Activity

Bug 20701: Add csrf protection to maninvoice.pl 

TO test:
1 - Be signed in to Koha
2 - Add a manual invoice to an account, works fine
3 - Now do it via url: http://localhost:8081/cgi-bin/koha/members/maninvoice.pl?borrowernumber=5&type=test&amount=5&add=Save
4 - Apply patches
5 - Test that everything continues to work as expected (but more securely)
6 - Try adding a new invoice via URL
7 - Should get 'internal server error' and wrong csrf token in logs

Works OK.

Signed-off-by: Amit Gupta <amit.gupta@informaticsglobal.com>

Signed-off-by: Marcel de Rooy <m.de.rooy@rijksmuseum.nl>

Signed-off-by: Nick Clemens <nick@bywatersolutions.com>
(cherry picked from commit 730d1fd57d)
Signed-off-by: Fridolin Somers <fridolin.somers@biblibre.com>
This commit is contained in:
Nick Clemens 2018-05-03 11:52:24 +00:00 committed by Fridolin Somers
parent f2dfaf59a7
commit cce493764a
2 changed files with 9 additions and 0 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

1
koha-tmpl/intranet-tmpl/prog/en/modules/members/maninvoice.tt
View File

@ -48,6 +48,7 @@ $(document).ready(function(){
[% END %]
[% ELSE %]
<form action="/cgi-bin/koha/members/maninvoice.pl" method="post" id="maninvoice"><input type="hidden" name="borrowernumber" id="borrowernumber" value="[% borrowernumber %]" />
<input type="hidden" name="csrf_token" value="[% csrf_token %]" />
<fieldset class="rows">
<legend>Manual invoice</legend>
<ol>

8
members/maninvoice.pl
View File

@ -33,6 +33,7 @@ use C4::Accounts;
use C4::Items;
use C4::Members::Attributes qw(GetBorrowerAttributes);
use Koha::Patron::Images;
use Koha::Token;
use Koha::Patron::Categories;
@ -46,6 +47,11 @@ my $borrowernumber=$input->param('borrowernumber');
my $data=GetMember('borrowernumber'=>$borrowernumber);
my $add=$input->param('add');
if ($add){
die "Wrong CSRF token"
unless Koha::Token->new->check_csrf( {
session_id => $input->cookie('CGISESSID'),
token => scalar $input->param('csrf_token'),
});
if ( checkauth( $input, 0, $flagsrequired, 'intranet' ) ) {
# print $input->header;
my $barcode=$input->param('barcode');
@ -71,6 +77,7 @@ if ($add){
if ( $error =~ /FOREIGN KEY/ && $error =~ /itemnumber/ ) {
$template->param( 'ITEMNUMBER' => 1 );
}
$template->param( csrf_token => Koha::Token->new->generate_csrf({ session_id => scalar $input->cookie('CGISESSID') }) );
$template->param( 'ERROR' => $error );
output_html_with_http_headers $input, $cookie, $template->output;
} else {
@ -120,6 +127,7 @@ if ($add){
$template->param(%$data);
$template->param(
csrf_token => Koha::Token->new->generate_csrf({ session_id => scalar $input->cookie('CGISESSID') }),
finesview => 1,
borrowernumber => $borrowernumber,
categoryname => $data->{'description'},