gitea
/
Koha-clms
1
0
Fork 0
Code Issues Pull Requests Packages Projects Releases Wiki Activity
Koha-clms/tools
History
Jonathan Druart 9e74db7b51 Bug 18124: Restrict CSRF token to user's session 
Currently the CSRF token generated is based on the borrowernumber, and
is valid across user's session.
We need to restrict the CSRF token to the current session.

With this patch the CSRF token is generated concatenating the id
(borrowernumber) and the CGISESSID cookie.

Test plan:
Run t/Token.t

Signed-off-by: Marcel de Rooy <m.de.rooy@rijksmuseum.nl>
Signed-off-by: Julian Maurice <julian.maurice@biblibre.com>
Signed-off-by: Mason James <mtj@kohaaloha.com>
 		2017-04-24 11:00:07 +12:00
..
csv-profiles MT2116: Addons to the CSV export 2010-02-17 07:51:33 -05:00
quotes Bug 17411: Remove 3 other occurrences of exit 1 2016-10-22 15:19:23 +02:00
ajax-inventory.pl Bug 11944: use CGI( -utf8 ) everywhere 2015-01-13 13:07:21 -03:00
automatic_item_modification_by_age.pl Bug 16154: CGI->multi_param - Declare a list 2016-04-26 23:16:42 +00:00
background-job-progress.pl Bug 14589: Adjust authorities_merge_ajax and replace some indirect syntax 2015-11-02 12:49:13 -03:00
batchMod.pl Bug 11490: Split MaxItemsForBatch into 2 prefs to clarify things 2016-08-05 08:41:40 +02:00
batch_delete_records.pl Bug 16154: CGI->multi_param - Declare a list 2016-04-26 23:16:42 +00:00
batch_record_modification.pl Bug 16154: CGI->multi_param - Declare a list 2016-04-26 23:16:42 +00:00
batch_records_ajax.pl Bug 11944: use CGI( -utf8 ) everywhere 2015-01-13 13:07:21 -03:00
cleanborrowers.pl Bug 10612: (QA followup) 2016-04-01 19:52:14 +00:00
copy-holidays.pl Bug 9978: Replace license header with the correct license (GPLv3+) 2015-04-20 09:59:38 -03:00
csv-profiles.pl Bug 9978: Replace license header with the correct license (GPLv3+) 2015-04-20 09:59:38 -03:00
exceptionHolidays.pl Bug 16154: Fix some other occurrences 2016-04-26 23:16:44 +00:00
export.pl Bug 17420 - record export fails when itemtype on biblio 2016-12-12 14:54:08 +13:00
holidays.pl Bug 16154: Fix some other occurrences 2016-04-26 23:16:44 +00:00
import_borrowers.pl Bug 18124: Restrict CSRF token to user's session 2017-04-24 11:00:07 +12:00
inventory.pl Bug 16154: Fix some other occurrences 2016-04-26 23:16:44 +00:00
koha-news.pl Bug 16550: Clean the tests 2016-05-23 17:37:48 +00:00
letter.pl Bug 16154: CGI->multi_param - Declare a list 2016-04-26 23:16:42 +00:00
manage-marc-import.pl Bug 9259: Ability to delete a staged file once it has been cleaned 2016-08-01 10:59:18 +02:00
marc_modification_templates.pl Bug 16259: Replace CGI->param with CGI->multi_param in list context - part 2 2016-05-16 17:28:06 +00:00
modborrowers.pl Bug 16681 - Allow update of opacnote via batch patron modification tool 2016-08-01 13:31:22 +02:00
newHolidays.pl Bug 14954: Remove C4::Dates from holiday related files in folder tools 2015-11-17 23:44:31 -03:00
overduerules.pl Bug 16154: CGI->multi_param - Declare a list 2016-04-26 23:16:42 +00:00
picture-upload.pl Bug 18124: Restrict CSRF token to user's session 2017-04-24 11:00:07 +12:00
quotes-upload.pl Bug 9978: Replace license header with the correct license (GPLv3+) 2015-04-20 09:59:38 -03:00
quotes.pl Bug 9978: Replace license header with the correct license (GPLv3+) 2015-04-20 09:59:38 -03:00
scheduler.pl Bug 16154: Fix some other occurrences 2016-04-26 23:16:44 +00:00
showdiffmarc.pl Bug 15005: Replace $ENV{SCRIPT_NAME} with the hardcoded script paths 2015-10-19 09:36:43 -03:00
stage-marc-import.pl Bug 15005: Replace $ENV{SCRIPT_NAME} with the hardcoded script paths 2015-10-19 09:36:43 -03:00
tools-home.pl Bug 9978: (followup) Replace license header with the correct license (GPLv3+) 2015-04-20 09:59:43 -03:00
upload-cover-image.pl Bug 14321: Integrate Upload.pm into Koha 2015-09-25 12:02:52 -03:00
upload-file.pl Bug 14686: [QA Follow-up] Move allows_add_by to Upload.pm 2016-04-27 16:14:18 +00:00
upload.pl Bug 14686: Add Upload to Tools menu 2016-04-27 16:14:17 +00:00
viewlog.pl Bug 16154: CGI->multi_param - Declare a list 2016-04-26 23:16:42 +00:00