gitea
/
Koha-clms
1
0
Fork 0
Code Issues Pull Requests Packages Projects Releases Wiki Activity
Koha-clms/opac
History
David Cook 7d0a022977 Bug 24673: Add CSRF token support to opac-messaging.pl 
This patch adds CSRF token support to opac-messaging.pl,
which allows users to manually update their messaging preferences,
but prevents bad actors from tricking people into updating their
preferences from cross-site requests.

Test plan:
0. Set SMSSendDriver global system preference to "Test" if unset
1. Log into the OPAC
2. Navigate to a URL in your browser like the following:
http://localhost:8080/cgi-bin/koha/opac-messaging.pl?modify=yes
&1=email&digest=1&2-DAYS=5&2=email&digest=2&4=email&SMSnumber=0444444444
3. Observe that the preference and SMS number update

4. Apply the patch

5. Navigate to a URL in your browser like the following:
http://localhost:8080/cgi-bin/koha/opac-messaging.pl?modify=yes
&1=email&digest=1&2-DAYS=5&2=email&digest=2&4=email&SMSnumber=0444444444
6. Observe that you get an error message of "Wrong CSRF token" instead
of the previous behaviour
7. Navigate to a URL in your browser like the following:
http://localhost:8080/cgi-bin/koha/opac-messaging.pl
8. Update "Advance notice" to 3 and update "SMS number" to 61111111111
9. Observe that the "Advance notice" and "SMS number" fields update
correctly

Signed-off-by: Jonathan Druart <jonathan.druart@bugs.koha-community.org>

Signed-off-by: Joy Nelson <joy@bywatersolutions.com>
(cherry picked from commit 35cdeadbdf)

Signed-off-by: Hayley Mapley <hayleymapley@catalyst.net.nz>

Signed-off-by: Hayley Mapley <hayleymapley@catalyst.net.nz>
 		2020-03-24 14:33:11 +13:00
..
clubs Bug 22542: Force back button to display personal data 2019-05-02 14:26:23 +01:00
errors Bug 19991: use Modern::Perl in OPAC perl scripts 2018-08-30 13:40:32 +00:00
external/overdrive bug_16034 Koha::ExternalContent::OverDrive - a wrapper around WebService::ILS::Overdrive::Patron 2017-02-21 19:58:20 +00:00
rss
…
sci Bug 22739: Test SelfCheckInTimeout <> 0, not just defined 2019-04-26 16:11:56 +01:00
sco Bug 19991: use Modern::Perl in OPAC perl scripts 2018-08-30 13:40:32 +00:00
svc Bug 22010: Check preferences for ebook integration 2019-05-08 15:11:06 +01:00
ilsdi.pl Bug 23156: [18.11] Add pagination to checkouts in ILS-DI GetPatronInfo service 2019-07-25 20:43:05 +00:00
maintenance.pl Bug 17989: Include full path logic in _get_template_file 2017-11-01 13:10:17 -03:00
oai.pl Bug 14939: Modularize OAI Server existing classes 2015-12-31 15:15:05 +00:00
opac-ISBDdetail.pl Bug 22735: Resolve internal server error on missing item type 2019-04-26 15:48:00 +01:00
opac-MARCdetail.pl Bug 22735: Resolve internal server error on missing item type 2019-04-26 15:48:00 +01:00
opac-account-pay-paypal-return.pl Bug 19991: use Modern::Perl in OPAC perl scripts 2018-08-30 13:40:32 +00:00
opac-account-pay-return.pl Bug 19173: Make OPAC online payments pluggable 2017-09-19 14:15:52 -03:00
opac-account-pay.pl Bug 22542: Force back button to display personal data 2019-05-02 14:26:23 +01:00
opac-account.pl Bug 21137: Replace BORROWER_INFO with logged_in_user 2018-08-14 12:43:12 +00:00
opac-addbybiblionumber.pl Bug 22542: Force back button to display personal data 2019-05-02 14:26:23 +01:00
opac-alert-subscribe.pl Bug 22542: Force back button to display personal data 2019-05-02 14:26:23 +01:00
opac-article-request-cancel.pl Bug 22068: (QA follow-up) Return meaningful error codes 2019-04-15 11:57:43 +01:00
opac-authorities-home.pl Bug 19991: use Modern::Perl in OPAC perl scripts 2018-08-30 13:40:32 +00:00
opac-authoritiesdetail.pl Bug 19991: use Modern::Perl in OPAC perl scripts 2018-08-30 13:40:32 +00:00
opac-basket.pl Bug 23530: Fix cart showing only hidden items 2019-09-21 16:49:14 +00:00
opac-blocked.pl Bug 11944: use CGI( -utf8 ) everywhere 2015-01-13 13:07:21 -03:00
opac-browser.pl Bug 19991: use Modern::Perl in OPAC perl scripts 2018-08-30 13:40:32 +00:00
opac-changelanguage.pl Bug 21299: (QA follow-up) Rename module and subroutine 2018-11-07 21:52:17 +00:00
opac-course-details.pl Bug 9978: Replace license header with the correct license (GPLv3+) 2015-04-20 09:59:38 -03:00
opac-course-reserves.pl Bug 9978: Replace license header with the correct license (GPLv3+) 2015-04-20 09:59:38 -03:00
opac-detail.pl Bug 12537: Don't retrieve XISBN results for the same biblionumber 2019-08-06 04:35:29 +00:00
opac-discharge.pl Bug 20953: Prevent several discharge requests on OPAC 2018-07-13 10:34:28 +00:00
opac-downloadcart.pl Bug 14385: Squash of a lot of patches rebased 2018-11-02 10:33:12 +00:00
opac-downloadshelf.pl Bug 14385: Squash of a lot of patches rebased 2018-11-02 10:33:12 +00:00
opac-export.pl Bug 22075: Fix encoding problem with RIS export in OPAC 2019-04-15 13:09:02 +01:00
opac-ics.pl Bug 19991: use Modern::Perl in OPAC perl scripts 2018-08-30 13:40:32 +00:00
opac-idref.pl Bug 19640: fix OPAC IdRef webservice display 2017-12-07 09:37:09 -03:00
opac-illrequests.pl Bug 22542: Force back button to display personal data 2019-05-02 14:26:23 +01:00
opac-image.pl Bug 19991: use Modern::Perl in OPAC perl scripts 2018-08-30 13:40:32 +00:00
opac-imageviewer.pl Bug 19991: use Modern::Perl in OPAC perl scripts 2018-08-30 13:40:32 +00:00
opac-issue-note.pl Bug 17698: (RM follow-up) Pass lang variable so letter can be translated 2019-05-30 21:11:47 +01:00
opac-main.pl Bug 19892: Replace numbersphr variable with Koha.Preference('OPACNumbersPreferPhrase') in OPAC 2018-04-02 18:08:07 -03:00
opac-memberentry.pl Bug 23431: Don't nullify DOB if it's hidden by sysprefs 2019-08-27 23:45:59 +00:00
opac-messaging.pl Bug 24673: Add CSRF token support to opac-messaging.pl 2020-03-24 14:33:11 +13:00
opac-modrequest-suspend.pl Bug 19991: use Modern::Perl in OPAC perl scripts 2018-08-30 13:40:32 +00:00
opac-modrequest.pl Bug 19991: use Modern::Perl in OPAC perl scripts 2018-08-30 13:40:32 +00:00
opac-mymessages.pl Bug 19991: use Modern::Perl in OPAC perl scripts 2018-08-30 13:40:32 +00:00
opac-news-rss.pl Bug 16447: Remove occurrence of the borrow permission which does no longer exist 2016-05-05 21:28:14 +00:00
opac-overdrive-search.pl Bug 19991: use Modern::Perl in OPAC perl scripts 2018-08-30 13:40:32 +00:00
opac-passwd.pl Bug 22047: Fix opac/opac-passwd.pl call 2019-01-31 16:48:42 +00:00
opac-password-recovery.pl Bug 21771: (follow-up) Revert the shift statement 2018-11-06 17:42:20 +00:00
opac-patron-consent.pl Bug 20819: Add your consents tab to opac-user 2018-09-20 13:45:26 +00:00
opac-patron-image.pl Bug 19991: use Modern::Perl in OPAC perl scripts 2018-08-30 13:40:32 +00:00
opac-privacy.pl Bug 19991: use Modern::Perl in OPAC perl scripts 2018-08-30 13:40:32 +00:00
opac-ratings-ajax.pl Bug 19991: use Modern::Perl in OPAC perl scripts 2018-08-30 13:40:32 +00:00
opac-ratings.pl Bug 19991: use Modern::Perl in OPAC perl scripts 2018-08-30 13:40:32 +00:00
opac-readingrecord.pl Bug 19991: use Modern::Perl in OPAC perl scripts 2018-08-30 13:40:32 +00:00
opac-recordedbooks-search.pl Bug 17602: Fix few minor QA issues 2018-10-01 13:56:56 +00:00
opac-registration-verify.pl Bug 23428: (bug 23151 follow-up) Fix self registration with a verification email 2019-08-28 00:03:36 +00:00
opac-renew.pl Bug 19991: use Modern::Perl in OPAC perl scripts 2018-08-30 13:40:32 +00:00
opac-request-article.pl Bug 22542: Force back button to display personal data 2019-05-02 14:26:23 +01:00
opac-reserve.pl Bug 22542: Force back button to display personal data 2019-05-02 14:26:23 +01:00
opac-restrictedpage.pl Bug 16447: Remove occurrence of the borrow permission which does no longer exist 2016-05-05 21:28:14 +00:00
opac-retrieve-file.pl Bug 17501: Move getCategories and httpheaders from Upload.pm 2017-01-20 14:20:05 +00:00
opac-review.pl Bug 21986: Do not escape quotation marks when cataloguing 2018-12-17 12:06:41 +00:00
opac-routing-lists.pl Bug 21137: Replace BORROWER_INFO with logged_in_user 2018-08-14 12:43:12 +00:00
opac-search-history.pl Bug 12497: Fix OPAC search history reachable by URL even when disabled 2017-12-07 10:09:52 -03:00
opac-search.pl Bug 16111: (QA follow-up) Few additional corrections 2019-10-01 00:08:32 +00:00
opac-sendbasket.pl Bug 22542: Force back button to display personal data 2019-05-02 14:26:23 +01:00
opac-sendshelf.pl Bug 22542: Force back button to display personal data 2019-05-02 14:26:23 +01:00
opac-serial-issues.pl Bug 19991: use Modern::Perl in OPAC perl scripts 2018-08-30 13:40:32 +00:00
opac-shareshelf.pl Bug 22542: Force back button to display personal data 2019-05-02 14:26:23 +01:00
opac-shelves.pl Revert "Bug 22478: (QA follow-up) Handle category in opac-shelves like a boolean" 2019-05-30 08:03:31 +01:00
opac-showmarc.pl Bug 20083: (follow-up) use same logic in opac-showmarc 2018-04-04 15:45:34 -03:00
opac-showreviews.pl Bug 19991: use Modern::Perl in OPAC perl scripts 2018-08-30 13:40:32 +00:00
opac-suggestions.pl Bug 22800: (bug 22550 follow-up) Do not raw filter when not necessary (OPAC suggestions) 2019-05-08 16:47:18 +01:00
opac-tags.pl Bug 22420: Remove wrong calculation on approved tags 2019-05-08 15:15:10 +01:00
opac-tags_subject.pl Bug 19991: use Modern::Perl in OPAC perl scripts 2018-08-30 13:40:32 +00:00
opac-topissues.pl Bug 19991: use Modern::Perl in OPAC perl scripts 2018-08-30 13:40:32 +00:00
opac-user.pl Bug 15494: Update display of renewal errors 2018-11-07 21:39:38 +00:00
tracklinks.pl Bug 23836: exit after output_error 2019-11-22 17:34:56 +00:00
unapi Bug 19991: use Modern::Perl in OPAC perl scripts 2018-08-30 13:40:32 +00:00