gitea
/
Koha-clms
1
0
Fork 0
Code Issues Pull Requests Packages Projects Releases Wiki Activity

Bug 34478: op =~ ^cud- 

Signed-off-by: Jonathan Druart <jonathan.druart@bugs.koha-community.org>
This commit is contained in:
Jonathan Druart 2023-09-22 10:55:29 +02:00
parent bf9830d354
commit 4e1372b77c
No known key found for this signature in database
GPG Key ID: A085E712BEF0E0F0
5 changed files with 19 additions and 19 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

6
C4/Auth.pm
View File

@ -634,7 +634,8 @@ sub get_template_and_user {
$template->param( logged_in_user => $patron );
$template->param( sessionID => $sessionID );
if ( $in->{query}->param('op-cud') ) {
my $op = $in->{query}->param('op');
if ( defined $op && $op =~ m{^cud-} ) {
C4::Output::output_and_exit( $in->{query}, $cookie, $template, 'wrong_csrf_token' )
unless Koha::Token->new->check_csrf(
{
@ -1342,7 +1343,8 @@ sub checkauth {
my $patron = $userid ? Koha::Patrons->find({ userid => $userid }) : undef;
$patron->update_lastseen('login') if $patron;
if ( $query->param('op-cud') ) {
my $op = $query->param('op');
if ( defined $op && $op =~ m{^cud-} ) {
die "Cannot use GET for this request"
if $request_method eq 'GET';

4
admin/branches.pl
View File

@ -58,7 +58,7 @@ if ( $op eq 'add_form' ) {
$template->param(
library => $library,
);
} elsif ( $op eq 'add_validate' ) {
} elsif ( $op eq 'cud-add_validate' ) {
my @fields = qw(
branchname
branchaddress1
@ -191,7 +191,7 @@ if ( $op eq 'add_form' ) {
patrons_count => $patrons_count,
);
}
} elsif ( $op eq 'delete_confirmed' ) {
} elsif ( $op eq 'cud-delete_confirmed' ) {
my $library = Koha::Libraries->find($branchcode);
my $deleted = eval { $library->delete; };

18
debian/templates/plack.psgi vendored
View File

@ -48,16 +48,14 @@ use CGI qw(-utf8 ); # we will loose -utf8 under plack, otherwise
Koha::Caches->flush_L1_caches();
Koha::Cache::Memory::Lite->flush();
$original_op_cud = $q->param('op-cud');
$request_method = $q->request_method // q{};
if ( $request_method eq 'GET' && defined $original_op_cud ) {
warn "Programming error - op-cud must not be passed with GET";
$q->param( 'op-cud', undef );
} elsif ( $request_method ne 'GET' && defined $q->param('op') ) {
warn "Programming error - op can only be passed with GET";
$q->param( 'op', undef );
} else {
$q->param( 'op', $original_op_cud );
my $original_op = $q->param('op');
my $request_method = $q->request_method // q{};
if ( $request_method eq 'GET' && defined $original_op && $original_op =~ m{^cud-} ) {
warn "Programming error - op '$original_op' must not start with 'cud-' with GET";
$q->param( 'op', '' );
} elsif ( $request_method ne 'GET' && defined $q->param('op') && $original_op !~ m{^cud-} ) {
warn "Programming error - op '$original_op' must start with 'cud-' for $request_method";
$q->param( 'op', '' );
}
return $q;

4
koha-tmpl/intranet-tmpl/prog/en/includes/csrf-token.inc
View File

@ -1,3 +1,3 @@
[%- USE Koha %]
[%- USE raw %]
[%- USE Koha -%]
[%- USE raw -%]
<input type="hidden" name="csrf_token" value="[% Koha.GenerateCSRF | $raw %]" />

6
koha-tmpl/intranet-tmpl/prog/en/modules/admin/branches.tt
View File

@ -129,7 +129,7 @@
<form action="/cgi-bin/koha/admin/branches.pl" id="Aform" name="Aform" class="validated" method="post">
[% INCLUDE 'csrf-token.inc' %]
<fieldset class="rows">
<input type="hidden" name="op-cud" value="add_validate" />
<input type="hidden" name="op" value="cud-add_validate" />
[% IF library %]
<input type="hidden" name="is_a_modif" value="1" />
[% END %]
@ -321,7 +321,7 @@
<form action="/cgi-bin/koha/admin/branches.pl" method="post">
[% INCLUDE 'csrf-token.inc' %]
<h1>Are you sure you want to delete [% library.branchname | html %] ([% library.branchcode | html %])?</h1>
<input type="hidden" name="op-cud" value="delete_confirmed" />
<input type="hidden" name="op" value="cud-delete_confirmed" />
<input type="hidden" name="branchcode" value="[% library.branchcode | html %]" />
<input type="hidden" name="branchname" value="[% library.branchname | html %]">
<button type="submit" class="approve"><i class="fa fa-fw fa-check"></i> Yes, delete</button>
@ -645,7 +645,7 @@
"data": function( row, type, val, meta ) {
var result = '<a class="btn btn-default btn-xs" href="/cgi-bin/koha/admin/branches.pl?op=add_form&amp;branchcode='+encodeURIComponent(row.library_id)+'" role="button"><i class="fa-solid fa-pencil" aria-hidden="true"></i> '+_("Edit")+'</a>';
result += '<form action="/cgi-bin/koha/admin/branches.pl" method="post">';
result += '<form action="/cgi-bin/koha/admin/branches.pl" method="get">';
result += '<input type="hidden" name="branchcode" value="'+row.library_id.escapeHtml()+'" />'+"\n";
result += '<input type="hidden" name="op" value="delete_confirm" />';
result += '<button type="submit" id="delete_library_'+row.library_id.escapeHtml()+'" class="btn btn-default btn-xs" role="button"><i class="fa fa-trash-can" aria-hidden="true"></i> '+_("Delete")+'</button></form>';