Koha/svc/config/systempreferences
David Cook 649c9785f5 Bug 34369: Require CSRF token for updating system preferences
This patch adds the requirements that updating a system preference
requires a CSRF token. (Also, adding and deleting local system preferences.)

0. Apply patch
1. koha-plack --reload kohadev
2. Add local system preference
3. Update local system preference
4. Delete local system preference
5. Update normal system preference
6. Note no errors

Signed-off-by: Jonathan Druart <jonathan.druart@bugs.koha-community.org>

Signed-off-by: Marcel de Rooy <m.de.rooy@rijksmuseum.nl>
Signed-off-by: Tomas Cohen Arazi <tomascohen@theke.io>
(cherry picked from commit c6ef2aba6b)
Signed-off-by: Fridolin Somers <fridolin.somers@biblibre.com>
2023-09-26 21:29:27 -10:00

156 lines
3.2 KiB
Perl
Executable file

#!/usr/bin/perl
# Copyright 2009 Jesse Weaver
#
# This file is part of Koha.
#
# Koha is free software; you can redistribute it and/or modify it
# under the terms of the GNU General Public License as published by
# the Free Software Foundation; either version 3 of the License, or
# (at your option) any later version.
#
# Koha is distributed in the hope that it will be useful, but
# WITHOUT ANY WARRANTY; without even the implied warranty of
# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
# GNU General Public License for more details.
#
# You should have received a copy of the GNU General Public License
# along with Koha; if not, see <http://www.gnu.org/licenses>.
#
use Modern::Perl;
use C4::Context;
use C4::Service;
use C4::Log;
use Koha::Token;
=head1 NAME
svc/config/systempreferences - Web service for setting system preferences
=head1 SYNOPSIS
POST /svc/config/systempreferences/
=head1 DESCRIPTION
This service is used to set system preferences, either one at a time or in
batches.
=head1 METHODS
=cut
our ( $query, $response ) = C4::Service->init( parameters => 'manage_sysprefs' );
=head2 set_preference
=over 4
=item url path
POST /svc/config/systempreferences/$preference
=item url query
value=$value
=back
Used to set a single system preference.
=cut
sub set_preference {
my ( $preference ) = @_;
die "wrong_csrf_token\n" unless Koha::Token->new->check_csrf(
{
session_id => scalar $query->cookie('CGISESSID'),
token => scalar $query->param('csrf_token'),
}
);
my $value = join( ',', $query->param( 'value' ) );
C4::Context->set_preference( $preference, $value );
C4::Service->return_success( $response );
}
=head2 get_preference
=over 4
=item url path
GET /svc/config/systempreferences/$preference
=item url query
preference=$pref_name
=back
Used to get a single system preference.
=cut
sub get_preference {
my $preference = scalar $query->param('pref');
my $value = C4::Context->preference( $preference );
$response->param( value => $value );
C4::Service->return_success( $response );
}
=head2 set_preferences
=over 4
=item url path
POST /svc/config/systempreferences/
=item url query
pref_$pref1=$value1&pref_$pref2=$value2
=back
Used to set several system preferences at once. Each preference you want to set
should be sent prefixed with pref. If you wanted to turn off the
virtualshelves syspref, for instance, you would POST the following:
pref_virtualshelves=0
=cut
sub set_preferences {
die "wrong_csrf_token\n" unless Koha::Token->new->check_csrf(
{
session_id => scalar $query->cookie('CGISESSID'),
token => scalar $query->param('csrf_token'),
}
);
foreach my $param ( $query->param() ) {
my ( $pref ) = ( $param =~ /pref_(.*)/ );
next if ( !defined( $pref ) );
my $value = join( ',', $query->multi_param( $param ) );
C4::Context->set_preference( $pref, $value );
}
C4::Service->return_success( $response );
}
C4::Service->dispatch(
[ 'POST /([A-Za-z0-9_-]+)', [ 'value' ], \&set_preference ],
[ 'POST /', [], \&set_preferences ],
[ 'GET /', [ 'pref' ], \&get_preference],
);