gitea
/
Koha-clms
1
0
Fork 0
Code Issues Pull Requests Packages Projects Releases Wiki Activity

Bug 34478: Changes for tools/import_borrowers 

Removed a csrf check in script itself.

Signed-off-by: Jonathan Druart <jonathan.druart@bugs.koha-community.org>
This commit is contained in:
Marcel de Rooy 2024-02-09 08:55:23 +00:00 committed by Jonathan Druart
parent aa7a8569a4
commit e50445fef2
No known key found for this signature in database
GPG Key ID: A085E712BEF0E0F0
2 changed files with 5 additions and 10 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

3
koha-tmpl/intranet-tmpl/prog/en/modules/tools/import_borrowers.tt
View File

@ -225,6 +225,8 @@
</ul>
<form method="post" action="[% SCRIPT_NAME | html %]" enctype="multipart/form-data">
[% INCLUDE 'csrf-token.inc' %]
<input type="hidden" name="op" value="cud-import" />
<fieldset class="rows">
<legend>Import into the borrowers table</legend>
@ -381,7 +383,6 @@
</fieldset>
<fieldset class="action">
[% INCLUDE 'csrf-token.inc' %]
<input type="submit" class="btn btn-primary" value="Import" />
</fieldset>
</form>

12
tools/import_borrowers.pl
View File

@ -61,6 +61,7 @@ push( @columnkeys, 'patron_attributes' ) if $extended;
push( @columnkeys, qw( guarantor_relationship guarantor_id ) );
my $input = CGI->new();
my $op = $input->param('op') // q{};
my ( $template, $loggedinuser, $cookie ) = get_template_and_user(
{
@ -104,12 +105,7 @@ my $patronlistname = $uploadborrowers . ' (' . $timestamp .')';
$template->param( SCRIPT_NAME => '/cgi-bin/koha/tools/import_borrowers.pl' );
if ( $uploadborrowers && length($uploadborrowers) > 0 ) {
output_and_exit( $input, $cookie, $template, 'wrong_csrf_token' )
unless Koha::Token->new->check_csrf({
session_id => scalar $input->cookie('CGISESSID'),
token => scalar $input->param('csrf_token'),
});
if ( $op eq 'cud-import' && $uploadborrowers && length($uploadborrowers) > 0 ) {
my $handle = $input->upload('uploadborrowers');
my %defaults = $input->Vars;
@ -162,8 +158,7 @@ if ( $uploadborrowers && length($uploadborrowers) > 0 ) {
total => $imported + $alreadyindb + $invalid + $overwritten,
);
}
else {
} else {
if ($extended) {
my @matchpoints = ();
my $attribute_types = Koha::Patron::Attribute::Types->search;
@ -179,4 +174,3 @@ else {
}
output_html_with_http_headers $input, $cookie, $template->output;