diff --git a/authorities/authorities-home.pl b/authorities/authorities-home.pl index 6e0a8fe88d..9b3a55e2c7 100755 --- a/authorities/authorities-home.pl +++ b/authorities/authorities-home.pl @@ -36,6 +36,7 @@ use C4::Search::History; use Koha::Authority::Types; use Koha::SearchEngine::Search; use Koha::SearchEngine::QueryBuilder; +use Koha::Token; my $query = new CGI; my $dbh = C4::Context->dbh; @@ -58,6 +59,12 @@ if ( $op eq "delete" ) { debug => 1, } ); + + die "Wrong CSRF token" unless Koha::Token->new->check_csrf({ + session_id => scalar $query->cookie('CGISESSID'), + token => scalar $query->param('csrf_token'), + }); + &DelAuthority( $authid, 1 ); if ( $query->param('operator') ) { @@ -111,6 +118,12 @@ if ( $op eq "do_search" ) { } ); + $template->param( + csrf_token => Koha::Token->new->generate_csrf({ + session_id => scalar $query->cookie('CGISESSID'), + }), + ); + # search history if (C4::Context->preference('EnableSearchHistory')) { if ( $startfrom == 1) { diff --git a/koha-tmpl/intranet-tmpl/prog/en/modules/authorities/searchresultlist.tt b/koha-tmpl/intranet-tmpl/prog/en/modules/authorities/searchresultlist.tt index 563c44e721..76e45895fa 100644 --- a/koha-tmpl/intranet-tmpl/prog/en/modules/authorities/searchresultlist.tt +++ b/koha-tmpl/intranet-tmpl/prog/en/modules/authorities/searchresultlist.tt @@ -19,7 +19,8 @@ function confirm_deletion(id) { + "&orderby=[% orderby %]" + "&value=[% value |url %]" + "&startfrom=[% startfrom %]" - + "&resultsperpage=[% resultsperpage %]"; + + "&resultsperpage=[% resultsperpage %]" + + "&csrf_token=[% csrf_token %]"; } }