Jonathan Druart 779fa7c6da Bug 16591: Fix CSRF in opac-memberentry ... If an attacker can get an authenticated Koha user to visit their page with the code below, they can update the victim's details to arbitrary values. Test plan: Trigger /cgi-bin/koha/opac-memberentry.pl?action=update&borrower_B_city=HACKED&borrower_firstname=KOHA&borrower_surname=test => Without this patch, the update will be done (or modification request) => With this patch applied you will get a crash "Wrong CSRF token" (no need to stylish) Do some regression tests with this patch applied (Update patron infos) QA note: I am not sure it's useful to create a digest of the DB pass, but just in case... Reported by Alex Middleton at Dionach. Signed-off-by: Chris Cormack <chris@bigballofwax.co.nz> Signed-off-by: Katrin Fischer <katrin.fischer.83@web.de> Signed-off-by: Kyle M Hall <kyle@bywatersolutions.com>		2016-06-24 11:55:15 +00:00
..
PerlDependencies.pm	Bug 16591: Fix CSRF in opac-memberentry	2016-06-24 11:55:15 +00:00
PerlModules.pm	Bug 16011: $VERSION - Remove the $VERSION init	2016-03-24 17:20:28 +00:00