Koha-clms/members
Jonathan Druart 0420bc9a53
Bug 21993: Display a user-friendly message when the CSRF token is wrong
Instead of dying!

Test plan:
Assuming you have a patron with borrowernumber=51 and another one that
can be deleted with borrowernumber=42

- authorities-home.pl
 * Delete an authority record
 * hit /cgi-bin/koha/authorities/authorities-home.pl?op=delete

- basket/sendbasket.pl
 * Send a basket to someone
 * hit /cgi-bin/koha/basket/sendbasket.pl?email_add=1

- members/apikeys.pl
  * Generate and delete an API key for a patron
  * hit /cgi-bin/koha/members/apikeys.pl?patron_id=51&op=delete

- members/deletemem.pl
  * Delete a patron
  * hit /cgi-bin/koha/members/deletemem.pl?member=42&op=delete_confirmed

- members/mancredit.pl
  * Add a manual credit
  * hit /cgi-bin/koha/members/mancredit.pl?borrowernumber=51&add=1

- members/maninvoice.pl
  * Add a manual invoice
  * hit /cgi-bin/koha/members/maninvoice.pl?borrowernumber=51&add=1

- members/member-flags.pl
  * Change permissions for a patron
  * hit /cgi-bin/koha/members/member-flags.pl?member=51&newflags=1

- members/member-password.pl
  * Change the password for a patron (from the staff interface)
  * hit /cgi-bin/koha/members/member-password.pl?member=51&newpassword=aA1

- members/memberentry.pl
  * Edit some patron's info
  * hit /cgi-bin/koha/members/memberentry.pl?borrowernumber=51&op=save

- members/paycollect.pl
  * Pay an individual fine
  * hit something like /cgi-bin/koha/members/paycollect.pl?borrowernumber=51&pay_individual=1&accounttype=L&amount=1.00&amountoutstanding=1.00&accountlines_id=157&paid=1
  You may need to edit some values

- tools/import_borrowers.pl
  * Import some patrons
  * hit /cgi-bin/koha/tools/import_borrowers.pl?uploadborrowers=1

- tools/picture-upload.pl
  * Upload an image for a patron
  * You will need to edit the html content
  hit Home › Tools › Upload patron images
  then locate the csrf_token input and modify its value

Note for QA:
- Opac is not done as blocking_errors.inc does not exist for this
interface
- ill/ill-requests.pl
I did not manage to replace this occurrence

Signed-off-by: Owen Leonard <oleonard@myacpl.org>
Signed-off-by: Tomas Cohen Arazi <tomascohen@theke.io>

Signed-off-by: Nick Clemens <nick@bywatersolutions.com>
(cherry picked from commit b990b953b3)
Signed-off-by: Martin Renvoize <martin.renvoize@ptfs-europe.com>
2019-01-31 17:07:03 +00:00
..
accountline-details.pl Bug 20666: Correct executable permissions 2018-05-03 13:26:48 -03:00
apikeys.pl Bug 21993: Display a user-friendly message when the CSRF token is wrong 2019-01-31 17:07:03 +00:00
boraccount.pl Bug 20629: (QA follow-up) Remove actions_col 2018-11-06 16:32:42 +00:00
default_messageprefs.pl Bug 18403: Update permissions - borrowers => 1|* becomes borrowers => 'edit_borrowers' 2018-02-12 15:41:37 -03:00
deletemem.pl Bug 21993: Display a user-friendly message when the CSRF token is wrong 2019-01-31 17:07:03 +00:00
discharge.pl Bug 18789: Use Koha::Patron->image from the templates 2018-02-16 13:03:58 -03:00
discharges.pl Bug 18403: Patron discharges 2018-02-12 15:41:41 -03:00
files.pl Bug 20226: Centralize update child code (CATCODE_MULTI) 2018-08-14 11:58:26 +00:00
guarantor_search.pl Bug 18403: Update permissions - borrowers => 1|* becomes borrowers => 'edit_borrowers' 2018-02-12 15:41:37 -03:00
holdshistory.pl Bug 20226: Centralize update child code (CATCODE_MULTI) 2018-08-14 11:58:26 +00:00
housebound.pl Bug 20226: Centralize update child code (CATCODE_MULTI) 2018-08-14 11:58:26 +00:00
mancredit.pl Bug 21993: Display a user-friendly message when the CSRF token is wrong 2019-01-31 17:07:03 +00:00
maninvoice.pl Bug 21993: Display a user-friendly message when the CSRF token is wrong 2019-01-31 17:07:03 +00:00
member-flags.pl Bug 21993: Display a user-friendly message when the CSRF token is wrong 2019-01-31 17:07:03 +00:00
member-password.pl Bug 21993: Display a user-friendly message when the CSRF token is wrong 2019-01-31 17:07:03 +00:00
member.pl Bug 20998: Simplify the conditional statement 2018-06-29 19:05:57 +00:00
memberentry.pl Bug 21993: Display a user-friendly message when the CSRF token is wrong 2019-01-31 17:07:03 +00:00
members-home.pl Bug 18403: Update permissions - borrowers => 1|* becomes borrowers => 'edit_borrowers' 2018-02-12 15:41:37 -03:00
members-update-do.pl Bug 20287: Move ModMember to Koha::Patron 2018-07-18 15:49:50 +00:00
members-update.pl Bug 18403: Update permissions - borrowers => 1|* becomes borrowers => 'edit_borrowers' 2018-02-12 15:41:37 -03:00
merge-patrons.pl Bug 9302: Add error message if keeper patron is invalid 2018-04-20 13:34:41 -03:00
mod_debarment.pl Bug 18403: Fix few errors found with hit_pages.t 2018-02-12 15:41:43 -03:00
moremember.pl Bug 21068: Remove NorwegianPatronDB related code 2018-08-30 13:40:29 +00:00
notices.pl Bug 20226: Centralize update child code (CATCODE_MULTI) 2018-08-14 11:58:26 +00:00
patronimage.pl Bug 17423 - patronimage.pl permission is too restrictive 2016-10-17 23:44:25 +00:00
pay.pl Bug 18805: Add ability to use up account credits 2018-12-10 09:58:56 +00:00
paycollect.pl Bug 21993: Display a user-friendly message when the CSRF token is wrong 2019-01-31 17:07:03 +00:00
print_overdues.pl Bug 17553: Move GetOverduesForPatron to Koha::Patron->get_overdues 2018-04-03 11:43:06 -03:00
printfeercpt.pl Bug 20629: Remove ability to 'reverse' payments 2018-11-06 16:32:34 +00:00
printinvoice.pl Bug 20226: Centralize update child code (CATCODE_MULTI) 2018-08-14 11:58:26 +00:00
printslip.pl Bug 18403: Add sub output_and_exit_if_error - unknown_patron & cannot_see_patron_infos 2018-02-12 15:41:38 -03:00
purchase-suggestions.pl Bug 11911: Add a separate permission for managing suggestions 2018-07-23 15:34:20 +00:00
readingrec.pl Bug 20226: Centralize update child code (CATCODE_MULTI) 2018-08-14 11:58:26 +00:00
routing-lists.pl Bug 21397: Mark "Routing list" tab as active when selected 2018-09-26 16:18:16 +00:00
setstatus.pl Bug 18403: Fix few errors found with hit_pages.t 2018-02-12 15:41:43 -03:00
statistics.pl Bug 20226: Centralize update child code (CATCODE_MULTI) 2018-08-14 11:58:26 +00:00
summary-print.pl Bug 20656: Don't print lines that have no balance on print summary 2018-09-20 13:45:28 +00:00
update-child.pl Bug 20226: Centralize update child code (CATCODE_MULTI) 2018-08-14 11:58:26 +00:00