gitea
/
Koha-clms
1
0
Fork 0
Code Issues Pull Requests Packages Projects Releases Wiki Activity
Koha-clms/opac
History
Jonathan Druart 9e74db7b51 Bug 18124: Restrict CSRF token to user's session 
Currently the CSRF token generated is based on the borrowernumber, and
is valid across user's session.
We need to restrict the CSRF token to the current session.

With this patch the CSRF token is generated concatenating the id
(borrowernumber) and the CGISESSID cookie.

Test plan:
Run t/Token.t

Signed-off-by: Marcel de Rooy <m.de.rooy@rijksmuseum.nl>
Signed-off-by: Julian Maurice <julian.maurice@biblibre.com>
Signed-off-by: Mason James <mtj@kohaaloha.com>
 		2017-04-24 11:00:07 +12:00
..
errors Bug 15288: Error pages: Code duplication removal and better translatability 2016-01-27 05:57:34 +00:00
rss
…
sco Bug 12663 - SCOUserCSS and SCOUserJS ignored on selfcheck login page 2016-04-22 00:57:44 +00:00
svc Bug 17392 - opac/svc/overdrive_proxy is not plack safe 2016-10-22 14:33:17 +02:00
ilsdi.pl Bug 16476: Do not call CGI->param in list context, some more 2016-05-16 17:11:46 +00:00
maintenance.pl Bug 13758: Move the Koha version from kohaversion.pl 2015-05-07 11:39:04 -03:00
oai.pl Bug 14939: Modularize OAI Server existing classes 2015-12-31 15:15:05 +00:00
opac-ISBDdetail.pl Bug 16169: Change prototype for C4::Biblio::TransformMarcToKoha 2016-04-07 00:04:21 +00:00
opac-MARCdetail.pl Bug 5979 : OPAC : using OPACISBD systempreference to display link 2016-04-22 03:14:21 +00:00
opac-account-pay-paypal-return.pl Bug 16154: CGI->multi_param - Declare a list 2016-04-26 23:16:42 +00:00
opac-account-pay.pl Bug 16154: CGI->multi_param - Declare a list 2016-04-26 23:16:42 +00:00
opac-account.pl Bug 16154: CGI->multi_param - Force scalar context 2016-04-26 23:16:43 +00:00
opac-addbybiblionumber.pl Bug 16518: Fix Plack variable scoping problem in opac-addbybiblionumber.pl 2016-06-15 08:15:54 +02:00
opac-alert-subscribe.pl Bug 14956: C4::Dates from files opac/*.pl 2015-11-06 15:01:28 -03:00
opac-authorities-home.pl Bug 17048: Fix pagination offset for authority searches 2016-09-08 21:21:58 +02:00
opac-authoritiesdetail.pl Bug 15550: Fix authority search and detail at the OPAC 2016-01-23 18:34:06 +00:00
opac-basket.pl Bug 5371: Force no caching for private pages at the OPAC 2015-10-02 11:06:17 -03:00
opac-blocked.pl Bug 11944: use CGI( -utf8 ) everywhere 2015-01-13 13:07:21 -03:00
opac-browser.pl Bug 5371: Force no caching for private pages at the OPAC 2015-10-02 11:06:17 -03:00
opac-changelanguage.pl Bug 16776: Do not forget external language choice in language switcher 2016-08-23 11:51:49 +02:00
opac-course-details.pl Bug 9978: Replace license header with the correct license (GPLv3+) 2015-04-20 09:59:38 -03:00
opac-course-reserves.pl Bug 9978: Replace license header with the correct license (GPLv3+) 2015-04-20 09:59:38 -03:00
opac-detail.pl Bug 17367 - Showing all items must keep show holdings tab in OPAC details 2016-10-22 15:01:04 +02:00
opac-discharge.pl Bug 16464: Add FIXME 2016-09-08 22:05:19 +02:00
opac-downloadcart.pl Bug 14544: Get rid of C4::VirtualShelves and C4::VirtualShelves::Page 2015-11-05 09:58:02 -03:00
opac-downloadshelf.pl Bug 6322 - It's possible to view lists/virtualshelves even when virtualshelves is off 2016-01-27 02:31:42 +00:00
opac-export.pl Bug 16578: Fix wide character errors in opac-export.pl 2016-06-15 08:23:20 +02:00
opac-ics.pl Bug 5456 - Create a link to opac-ics.pl 2016-09-08 22:12:52 +02:00
opac-idref.pl Bug 16447: Remove occurrence of the borrow permission which does no longer exist 2016-05-05 21:28:14 +00:00
opac-image.pl Bug 16154: CGI->multi_param - Manual changes 2016-04-26 23:16:43 +00:00
opac-imageviewer.pl Bug 7976: Remove the borrow permission 2015-06-05 13:43:34 -03:00
opac-main.pl Bug 14305: View arbitrary branch's news 2016-04-29 12:44:08 +00:00
opac-memberentry.pl Bug 18124: Restrict CSRF token to user's session 2017-04-24 11:00:07 +12:00
opac-messaging.pl Bug 12528: redirect to 404 if at least 1 pref is off 2016-04-29 17:54:10 +00:00
opac-modrequest-suspend.pl Bug 7976: Remove the borrow permission 2015-06-05 13:43:34 -03:00
opac-modrequest.pl Bug 7976: Remove the borrow permission 2015-06-05 13:43:34 -03:00
opac-mymessages.pl Bug 5371: Force no caching for private pages at the OPAC 2015-10-02 11:06:17 -03:00
opac-news-rss.pl Bug 16447: Remove occurrence of the borrow permission which does no longer exist 2016-05-05 21:28:14 +00:00
opac-overdrive-search.pl Bug 11944: use CGI( -utf8 ) everywhere 2015-01-13 13:07:21 -03:00
opac-passwd.pl Bug 15344: Remove some other calls of GetMemberDetails from pl scripts 2015-12-30 11:53:18 +00:00
opac-password-recovery.pl Bug 18025: Simplify logic and avoid 1 call to ValidateBorrowernumber 2017-02-23 10:26:47 +13:00
opac-patron-image.pl Bug 15635: Koha::Patron::Images - Remove GetPatronImage 2016-03-04 12:54:15 +00:00
opac-privacy.pl Bug 15548: Move new patron related code to Patron* 2016-03-03 14:38:26 -07:00
opac-ratings-ajax.pl Bug 14553: Silencing warn triggered when clearing item rating on OPAC 2015-11-11 11:08:50 -03:00
opac-ratings.pl Bug 16179: Do not crash if "rate me" is clicked and not rate selected 2016-04-20 19:50:00 +00:00
opac-readingrecord.pl Bug 14100: Fix 3 occurrences more 2015-10-27 12:34:07 -03:00
opac-registration-verify.pl Bug 15548: Move new patron related code to Patron* 2016-03-03 14:38:26 -07:00
opac-renew.pl Bug 16154: CGI->multi_param - Declare a list 2016-04-26 23:16:42 +00:00
opac-reserve.pl Bug 15533 [QA Followup] - All itemtypes for all items showing in OPAC multi-hold 2016-04-29 10:26:05 +00:00
opac-restrictedpage.pl Bug 16447: Remove occurrence of the borrow permission which does no longer exist 2016-05-05 21:28:14 +00:00
opac-retrieve-file.pl Bug 14321: Integrate Upload.pm into Koha 2015-09-25 12:02:52 -03:00
opac-review.pl Bug 16154: CGI->multi_param - Force scalar context 2016-04-26 23:16:43 +00:00
opac-search-history.pl Bug 16593: Do not allow patrons to delete search history of others patrons 2016-08-01 08:53:51 +02:00
opac-search.pl Bug_17484 Search with date range limit (lower and upper) does not work 2016-12-12 14:54:14 +13:00
opac-sendbasket.pl Bug 18124: Restrict CSRF token to user's session 2017-04-24 11:00:07 +12:00
opac-sendshelf.pl Bug 14306: Remove call to GetMarcNotes from sendshelf 2016-03-07 17:58:33 +00:00
opac-serial-issues.pl Bug 16154: CGI->multi_param - Force scalar context 2016-04-26 23:16:43 +00:00
opac-shareshelf.pl Bug 16317 - Attempt to share private list results in error 2016-04-22 22:47:34 +00:00
opac-shelves.pl Bug 17901: Force context to scalar 2017-01-31 11:21:48 +13:00
opac-showmarc.pl Bug 11944: use CGI( -utf8 ) everywhere 2015-01-13 13:07:21 -03:00
opac-showreviews.pl Bug 14956: C4::Dates from files opac/*.pl 2015-11-06 15:01:28 -03:00
opac-suggestions.pl Bug 16154: CGI->multi_param - Declare a list 2016-04-26 23:16:42 +00:00
opac-tags.pl Bug 15263: (QA followup) Use the new XSLTParse4Display everywhere 2016-05-04 13:40:35 +00:00
opac-tags_subject.pl Bug 14412: SQL injection possible 2015-06-22 11:00:10 -03:00
opac-topissues.pl Bug 16154: CGI->multi_param - Force scalar context 2016-04-26 23:16:43 +00:00
opac-user.pl Bug 16464: Add FIXME 2016-09-08 22:05:19 +02:00
tracklinks.pl Bug 9978: Replace license header with the correct license (GPLv3+) 2015-04-20 09:59:38 -03:00
unapi Bug 15162 Add for Unimarc XSL trans for RDF-DC & SRW-DC 2016-01-27 06:00:35 +00:00