gitea
/
Koha-clms
1
0
Fork 0
Code Issues Pull Requests Packages Projects Releases Wiki Activity
Koha-clms/opac
History
David Cook 7f8656d0b5 Bug 24673: Add CSRF token support to opac-messaging.pl 
This patch adds CSRF token support to opac-messaging.pl,
which allows users to manually update their messaging preferences,
but prevents bad actors from tricking people into updating their
preferences from cross-site requests.

Test plan:
0. Set SMSSendDriver global system preference to "Test" if unset
1. Log into the OPAC
2. Navigate to a URL in your browser like the following:
http://localhost:8080/cgi-bin/koha/opac-messaging.pl?modify=yes
&1=email&digest=1&2-DAYS=5&2=email&digest=2&4=email&SMSnumber=0444444444
3. Observe that the preference and SMS number update

4. Apply the patch

5. Navigate to a URL in your browser like the following:
http://localhost:8080/cgi-bin/koha/opac-messaging.pl?modify=yes
&1=email&digest=1&2-DAYS=5&2=email&digest=2&4=email&SMSnumber=0444444444
6. Observe that you get an error message of "Wrong CSRF token" instead
of the previous behaviour
7. Navigate to a URL in your browser like the following:
http://localhost:8080/cgi-bin/koha/opac-messaging.pl
8. Update "Advance notice" to 3 and update "SMS number" to 61111111111
9. Observe that the "Advance notice" and "SMS number" fields update
correctly

Signed-off-by: Jonathan Druart <jonathan.druart@bugs.koha-community.org>

Signed-off-by: Joy Nelson <joy@bywatersolutions.com>
(cherry picked from commit 35cdeadbdf)

Signed-off-by: Lucas Gass <lucas@bywatersolutions.com>
 		2020-03-24 20:50:30 +00:00
..
clubs Bug 22542: Force back button to display personal data 2019-05-02 13:43:48 +00:00
errors Bug 19991: use Modern::Perl in OPAC perl scripts 2018-08-30 13:40:32 +00:00
external/overdrive
…
rss
…
sci Bug 22739: Test SelfCheckInTimeout <> 0, not just defined 2019-04-25 10:05:00 +00:00
sco Bug 14407: Allow restricting SCO to IP or IP range 2019-05-10 11:39:50 +00:00
svc Bug 22542: Force back button to display personal data 2019-05-02 13:43:48 +00:00
ilsdi.pl Bug 23156: Add pagination to checkouts in ILS-DI GetPatronInfo service 2019-07-25 13:31:30 +02:00
maintenance.pl Bug 17989: Include full path logic in _get_template_file 2017-11-01 13:10:17 -03:00
oai.pl
…
opac-ISBDdetail.pl Bug 23248: (QA follow-up) Consolidate 404s 2019-07-25 15:41:01 +02:00
opac-MARCdetail.pl Bug 13574: Fix display of repeatable item subfields 2020-03-09 20:31:56 +00:00
opac-account-pay-paypal-return.pl Bug 22600: Add 'interface' to accountlines 2019-04-10 19:43:11 +00:00
opac-account-pay-return.pl
…
opac-account-pay.pl Bug 22542: Force back button to display personal data 2019-05-02 13:43:48 +00:00
opac-account.pl Bug 23115: Tweak display of totals on 'Fines and charges' page 2019-07-24 08:57:45 +02:00
opac-addbybiblionumber.pl Bug 22542: Force back button to display personal data 2019-05-02 13:43:48 +00:00
opac-alert-subscribe.pl Bug 22542: Force back button to display personal data 2019-05-02 13:43:48 +00:00
opac-article-request-cancel.pl Bug 22068: (QA follow-up) Return meaningful error codes 2019-04-10 19:58:31 +00:00
opac-authorities-home.pl Bug 19991: use Modern::Perl in OPAC perl scripts 2018-08-30 13:40:32 +00:00
opac-authoritiesdetail.pl Bug 21871: (QA follow-up) C4::Biblio qw(GetMarcUrls) 2019-01-30 12:12:21 +00:00
opac-basket.pl Bug 23530: Fix cart showing only hidden items 2019-09-09 10:17:35 +02:00
opac-blocked.pl
…
opac-browser.pl Bug 19991: use Modern::Perl in OPAC perl scripts 2018-08-30 13:40:32 +00:00
opac-changelanguage.pl Bug 21299: (QA follow-up) Rename module and subroutine 2018-11-07 21:52:17 +00:00
opac-course-details.pl
…
opac-course-reserves.pl
…
opac-detail.pl Bug 14419: [19.05.x] (squashed) Expanding facets (Show more) performs a new search 2020-01-10 20:41:36 +00:00
opac-discharge.pl Bug 23723: using exit inside eval to stop sending output to browser doesn't work under plack 2019-11-08 15:23:58 +01:00
opac-downloadcart.pl Bug 14385: Squash of a lot of patches rebased 2018-11-02 10:33:12 +00:00
opac-downloadshelf.pl Bug 14385: Squash of a lot of patches rebased 2018-11-02 10:33:12 +00:00
opac-export.pl Bug 22075: Fix encoding problem with RIS export in OPAC 2019-04-11 11:47:17 +00:00
opac-ics.pl Bug 19991: use Modern::Perl in OPAC perl scripts 2018-08-30 13:40:32 +00:00
opac-idref.pl Bug 19640: fix OPAC IdRef webservice display 2017-12-07 09:37:09 -03:00
opac-illrequests.pl Bug 22542: Force back button to display personal data 2019-05-02 13:43:48 +00:00
opac-image.pl Bug 19991: use Modern::Perl in OPAC perl scripts 2018-08-30 13:40:32 +00:00
opac-imageviewer.pl Bug 19991: use Modern::Perl in OPAC perl scripts 2018-08-30 13:40:32 +00:00
opac-issue-note.pl Bug 17698: (RM follow-up) Pass lang variable so letter can be translated 2019-05-23 15:43:54 +00:00
opac-main.pl Bug 22318: Example implementation: OpacNavRight system preference 2019-04-18 10:47:03 +00:00
opac-memberentry.pl Bug 21390: Send registration verification emails immediately 2019-09-24 08:46:02 +02:00
opac-messaging.pl Bug 24673: Add CSRF token support to opac-messaging.pl 2020-03-24 20:50:30 +00:00
opac-modrequest-suspend.pl Bug 19991: use Modern::Perl in OPAC perl scripts 2018-08-30 13:40:32 +00:00
opac-modrequest.pl Bug 19991: use Modern::Perl in OPAC perl scripts 2018-08-30 13:40:32 +00:00
opac-mymessages.pl Bug 19991: use Modern::Perl in OPAC perl scripts 2018-08-30 13:40:32 +00:00
opac-news-rss.pl
…
opac-overdrive-search.pl Bug 19991: use Modern::Perl in OPAC perl scripts 2018-08-30 13:40:32 +00:00
opac-passwd.pl Bug 10796: Use $category->effective_change_password in the OPAC 2019-04-12 02:32:07 +00:00
opac-password-recovery.pl Bug 21533: Do not allow password recovery for administrative locked patrons 2019-05-10 12:19:13 +00:00
opac-patron-consent.pl Bug 20819: Add your consents tab to opac-user 2018-09-20 13:45:26 +00:00
opac-patron-image.pl Bug 19991: use Modern::Perl in OPAC perl scripts 2018-08-30 13:40:32 +00:00
opac-privacy.pl Bug 19991: use Modern::Perl in OPAC perl scripts 2018-08-30 13:40:32 +00:00
opac-ratings-ajax.pl Bug 19991: use Modern::Perl in OPAC perl scripts 2018-08-30 13:40:32 +00:00
opac-ratings.pl Bug 19991: use Modern::Perl in OPAC perl scripts 2018-08-30 13:40:32 +00:00
opac-readingrecord.pl Bug 11969: Show patrons star rating on their reading history 2019-04-17 12:25:25 +00:00
opac-recordedbooks-search.pl Bug 17602: Fix few minor QA issues 2018-10-01 13:56:56 +00:00
opac-registration-verify.pl Bug 23253: Fix OpacNavRight for self reg by email 2019-08-28 15:24:30 +02:00
opac-renew.pl Bug 21206: Replace C4::Items::GetItem 2019-02-26 13:24:07 +00:00
opac-request-article.pl Bug 22542: Force back button to display personal data 2019-05-02 13:43:48 +00:00
opac-reserve.pl Bug 23467: Exit after output_html - opac-reserve.pl 2019-11-15 11:04:34 +01:00
opac-restrictedpage.pl
…
opac-retrieve-file.pl
…
opac-review.pl Bug 21986: Do not escape quotation marks when cataloguing 2018-12-14 13:33:28 +00:00
opac-routing-lists.pl Bug 21137: Replace BORROWER_INFO with logged_in_user 2018-08-14 12:43:12 +00:00
opac-search-history.pl Bug 12497: Fix OPAC search history reachable by URL even when disabled 2017-12-07 10:09:52 -03:00
opac-search.pl Bug 24506: Multibranch limit does not work with ElasticSearch 2020-03-09 20:34:54 +00:00
opac-sendbasket.pl Bug 22542: Force back button to display personal data 2019-05-02 13:43:48 +00:00
opac-sendshelf.pl Bug 22542: Force back button to display personal data 2019-05-02 13:43:48 +00:00
opac-serial-issues.pl Bug 23126: Display multi-line entries in subscrpitions correctly 2019-07-25 13:36:46 +02:00
opac-shareshelf.pl Bug 22542: Force back button to display personal data 2019-05-02 13:43:48 +00:00
opac-shelves.pl Bug 17526: Change grep to deal with malformed sortfield 2019-06-20 14:59:09 +02:00
opac-showmarc.pl Bug 20083: (follow-up) use same logic in opac-showmarc 2018-04-04 15:45:34 -03:00
opac-showreviews.pl Bug 19991: use Modern::Perl in OPAC perl scripts 2018-08-30 13:40:32 +00:00
opac-suggestions.pl Bug 22657: (QA follow-up) Restore previous version of regex 2019-05-15 16:58:50 +00:00
opac-tags.pl Bug 22420: Remove wrong calculation on approved tags 2019-05-07 10:48:23 +00:00
opac-tags_subject.pl Bug 19991: use Modern::Perl in OPAC perl scripts 2018-08-30 13:40:32 +00:00
opac-topissues.pl Bug 19991: use Modern::Perl in OPAC perl scripts 2018-08-30 13:40:32 +00:00
opac-user.pl Bug 22521: Update UI to use accountlines.status 2019-04-17 16:49:36 +00:00
tracklinks.pl Bug 23836: exit after output_error 2019-11-22 10:35:06 +00:00
unapi Bug 19991: use Modern::Perl in OPAC perl scripts 2018-08-30 13:40:32 +00:00