gitea
/
Koha-clms
1
0
Fork 0
Code Issues Pull Requests Packages Projects Releases Wiki Activity

Bug 41662: Prevent CSRF on opac-patron-consent.pl 

This change prevents CSRF on opac-patron-consent.pl by
adding checking of the "op".

Test plan:
0. Apply the patch and koha-plack --restart kohadev
1. Set system preference PrivacyPolicyConsent to "permissive"
2. Log into the OPAC and go to this path:
/cgi-bin/koha/opac-patron-consent.pl?check_GDPR_PROCESSING=1
3. Note that it doesn't change the consent
4. Go to this path:
/cgi-bin/koha/opac-patron-consent.pl?check_GDPR_PROCESSING=0
5. Note that it doesn't change the consent
6. Click the "Yes" radio button and click "Save"
7. Note it changes the consent to Yes
8. Click the "No" radio button and click "Save"
9. Note it changes the consent to No

Signed-off-by: Marcel de Rooy <m.de.rooy@rijksmuseum.nl>
Signed-off-by: Lucas Gass <lucas@bywatersolutions.com>
This commit is contained in:
David Cook 2026-01-19 23:29:01 +00:00 committed by Lucas Gass
parent c1d863902a
commit c3169205ec
No known key found for this signature in database
GPG Key ID: 60B447398B0D36CA
1 changed files with 19 additions and 16 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

35
opac/opac-patron-consent.pl
View File

@ -48,24 +48,27 @@ foreach my $consent_type ( sort keys %$consent_types ) {
push @consents, $patron->consent($consent_type);
}
# Handle saves here
my $needs_redirect;
foreach my $consent (@consents) {
my $check = $vars->{ "check_" . $consent->type };
next if !defined($check); # no choice made
$needs_redirect = 1
if $consent->type eq q/GDPR_PROCESSING/
&& !$check
&& C4::Context->preference('PrivacyPolicyConsent') eq 'Enforced';
next if $consent->given_on && $check || $consent->refused_on && !$check;
# No update if no consent change
$consent->set(
{
given_on => $check ? dt_from_string() : undef,
refused_on => $check ? undef : dt_from_string(),
}
)->store;
# Handle saves here
if ( $op && $op eq 'cud-save' ) {
foreach my $consent (@consents) {
my $check = $vars->{ "check_" . $consent->type };
next if !defined($check); # no choice made
$needs_redirect = 1
if $consent->type eq q/GDPR_PROCESSING/
&& !$check
&& C4::Context->preference('PrivacyPolicyConsent') eq 'Enforced';
next if $consent->given_on && $check || $consent->refused_on && !$check;
# No update if no consent change
$consent->set(
{
given_on => $check ? dt_from_string() : undef,
refused_on => $check ? undef : dt_from_string(),
}
)->store;
}
}
# If user refused GDPR consent and we enforce GDPR, logout (when saving)