gitea
/
Koha-clms
1
0
Fork 0
Code Issues Pull Requests Packages Projects Releases Wiki Activity
Koha-clms/members
History
Jonathan Druart 8aa1e40953 Bug 17146: Fix CSRF in picture-upload.pl 
If an attacker can get an authenticated Koha user to visit their page
with the
url below, they can change or delete patrons' images
/tools/picture-upload.pl?op=Delete&borrowernumber=42

Test plan:
1/ Hit /tools/picture-upload.pl?op=Delete&borrowernumber=42
And confirm that you get a "Wrong CSRF token" error
2/ Go on the patron detail page with a patron's image
3/ Click on the Delete link (note the csrf_token param)
4/ The image will be deleted and you are redirected to the patron detail
page.

Regression tests:
Upload an image from the patron detail page and from the "upload patron
images" tool.

Signed-off-by: Chris Cormack <chrisc@catalyst.net.nz>

Signed-off-by: Marcel de Rooy <m.de.rooy@rijksmuseum.nl>
Signed-off-by: Mason James <mtj@kohaaloha.com>
 		2017-05-03 14:35:48 +12:00
..
boraccount.pl Bug 18423 - Followup - enable Add child button for institutional borrowers 2017-04-30 23:19:58 +12:00
default_messageprefs.pl Bug 9978: Replace license header with the correct license (GPLv3+) 2015-04-20 09:59:38 -03:00
deletemem.pl Bug 18124: add to members/deletemem.pl 2017-05-03 14:07:02 +12:00
discharge.pl Bug 15823: Can still access patron discharge slip without having the syspref on 2016-05-06 04:20:48 +00:00
discharges.pl Bug 15548: Move new patron related code to Patron* 2016-03-03 14:38:26 -07:00
files.pl Bug 18423 - Followup - enable Add child button for institutional borrowers 2017-04-30 23:19:58 +12:00
guarantor_search.pl Bug 15109: Make name the default sort order for all patron searches 2015-11-17 09:49:21 -03:00
mancredit.pl Bug 18423 - Followup - enable Add child button for institutional borrowers 2017-04-30 23:19:58 +12:00
maninvoice.pl Bug 18423 - Followup - enable Add child button for institutional borrowers 2017-04-30 23:19:58 +12:00
member-flags.pl Bug 18423 - Followup - enable Add child button for institutional borrowers 2017-04-30 23:19:58 +12:00
member-password.pl Bug 18423 - Followup - enable Add child button for institutional borrowers 2017-04-30 23:19:58 +12:00
member.pl Bug 17375: Search by dateofbirth - handle invalid dates 2016-11-02 17:58:26 +00:00
memberentry.pl Bug 18124: [16.05.x] remove HouseboundModule code 2017-05-03 12:43:21 +12:00
members-home.pl Bug 15548: Move new patron related code to Patron* 2016-03-03 14:38:26 -07:00
members-update-do.pl Bug 15548: Move new patron related code to Patron* 2016-03-03 14:38:26 -07:00
members-update.pl Bug 15548: Move new patron related code to Patron* 2016-03-03 14:38:26 -07:00
mod_debarment.pl Bug 16154: CGI->multi_param - Force scalar context 2016-04-26 23:16:43 +00:00
moremember.pl Bug 17146: Fix CSRF in picture-upload.pl 2017-05-03 14:35:48 +12:00
nl-search.pl Bug 16154: CGI->multi_param - Force scalar context 2016-04-26 23:16:43 +00:00
notices.pl Bug 18423 - Followup - enable Add child button for institutional borrowers 2017-04-30 23:19:58 +12:00
patronimage.pl Bug 17423 - patronimage.pl permission is too restrictive 2016-10-22 14:59:53 +02:00
pay.pl Bug 18423 - Followup - enable Add child button for institutional borrowers 2017-04-30 23:19:58 +12:00
paycollect.pl Bug 18423 - Followup - enable Add child button for institutional borrowers 2017-04-30 23:19:58 +12:00
print_overdues.pl Bug 12933: (QA followup) Rename GetOverdues to GetOverduesForPatron 2015-11-04 12:41:29 -03:00
printfeercpt.pl Bug 18423 - Followup - enable Add child button for institutional borrowers 2017-04-30 23:19:58 +12:00
printinvoice.pl Bug 18423 - Followup - enable Add child button for institutional borrowers 2017-04-30 23:19:58 +12:00
printslip.pl Bug 9978: Replace license header with the correct license (GPLv3+) 2015-04-20 09:59:38 -03:00
purchase-suggestions.pl Bug 15635: Koha::Patron::Images - Remove GetPatronImage 2016-03-04 12:54:15 +00:00
readingrec.pl Bug 18423 - Followup - enable Add child button for institutional borrowers 2017-04-30 23:19:58 +12:00
routing-lists.pl Bug 18423 - Followup - enable Add child button for institutional borrowers 2017-04-30 23:19:58 +12:00
setstatus.pl Bug 14910: Redirect to the circulation module after a renew 2015-10-02 14:22:16 -03:00
statistics.pl Bug 18423 - Followup - enable Add child button for institutional borrowers 2017-04-30 23:19:58 +12:00
summary-print.pl Bug 17128: Make summary-print.pl plack safe 2016-09-08 21:56:35 +02:00
update-child.pl Bug 9978: Replace license header with the correct license (GPLv3+) 2015-04-20 09:59:38 -03:00