Jonathan Druart 11bf7e7bef Bug 17146: Fix CSRF in picture-upload.pl ... If an attacker can get an authenticated Koha user to visit their page with the url below, they can change or delete patrons' images /tools/picture-upload.pl?op=Delete&borrowernumber=42 Test plan: 1/ Hit /tools/picture-upload.pl?op=Delete&borrowernumber=42 And confirm that you get a "Wrong CSRF token" error 2/ Go on the patron detail page with a patron's image 3/ Click on the Delete link (note the csrf_token param) 4/ The image will be deleted and you are redirected to the patron detail page. Regression tests: Upload an image from the patron detail page and from the "upload patron images" tool. Signed-off-by: Chris Cormack <chrisc@catalyst.net.nz> Signed-off-by: Marcel de Rooy <m.de.rooy@rijksmuseum.nl> Signed-off-by: Kyle M Hall <kyle@bywatersolutions.com>		2016-09-15 13:33:58 +00:00
..
boraccount.pl	Bug 15758: Koha::Libraries - Ultimate duel for C4::Branch	2016-09-08 14:36:04 +00:00
default_messageprefs.pl
deletemem.pl	Bug 15758: Koha::Libraries - Remove GetBranches	2016-09-08 14:36:03 +00:00
discharge.pl	Bug 15823: Can still access patron discharge slip without having the syspref on	2016-05-06 04:20:48 +00:00
discharges.pl	Bug 15548: Move new patron related code to Patron*	2016-03-03 14:38:26 -07:00
files.pl	Bug 15758: Koha::Libraries - Ultimate duel for C4::Branch	2016-09-08 14:36:04 +00:00
guarantor_search.pl	Bug 15758: Koha::Libraries - Remove GetBranches	2016-09-08 14:36:03 +00:00
mancredit.pl	Bug 15758: Koha::Libraries - Ultimate duel for C4::Branch	2016-09-08 14:36:04 +00:00
maninvoice.pl	Bug 15758: Koha::Libraries - Ultimate duel for C4::Branch	2016-09-08 14:36:04 +00:00
member-flags.pl	Bug 15758: Koha::Libraries - Ultimate duel for C4::Branch	2016-09-08 14:36:04 +00:00
member-password.pl	Bug 16911: (QA followup) CGI->param should not be called in list context	2016-09-09 09:45:33 +00:00
member.pl	Bug 15758: Koha::Libraries - Ultimate duel for C4::Branch	2016-09-08 14:36:04 +00:00
memberentry.pl	Bug 16911: Koha::Patron::Categories - Move GetExpiryDate to ->get_expiry_date	2016-09-09 09:45:31 +00:00
members-home.pl	Bug 15758: Koha::Libraries - Remove GetBranchesLoop	2016-09-08 14:36:02 +00:00
members-update-do.pl	Bug 15758: Koha::Libraries - Ultimate duel for C4::Branch	2016-09-08 14:36:04 +00:00
members-update.pl	Bug 15758: Koha::Libraries - Ultimate duel for C4::Branch	2016-09-08 14:36:04 +00:00
mod_debarment.pl	Bug 16154: CGI->multi_param - Force scalar context	2016-04-26 23:16:43 +00:00
moremember.pl	Bug 17146: Fix CSRF in picture-upload.pl	2016-09-15 13:33:58 +00:00
nl-search.pl	Bug 15407: Koha::Patron::Categories - replace C4::Category->all	2016-09-08 13:29:03 +00:00
notices.pl	Bug 15758: Koha::Libraries - Remove GetBranchName	2016-09-08 14:36:01 +00:00
patronimage.pl	Bug 15635: Koha::Patron::Images - Remove GetPatronImage	2016-03-04 12:54:15 +00:00
pay.pl	Bug 15758: Koha::Libraries - Remove GetBranches	2016-09-08 14:36:03 +00:00
paycollect.pl	Bug 15758: Koha::Libraries - Remove GetBranches	2016-09-08 14:36:03 +00:00
print_overdues.pl	Bug 12933: (QA followup) Rename GetOverdues to GetOverduesForPatron	2015-11-04 12:41:29 -03:00
printfeercpt.pl	Bug 15758: Koha::Libraries - Ultimate duel for C4::Branch	2016-09-08 14:36:04 +00:00
printinvoice.pl	Bug 15758: Koha::Libraries - Ultimate duel for C4::Branch	2016-09-08 14:36:04 +00:00
printslip.pl
purchase-suggestions.pl	Bug 15758: Koha::Libraries - Ultimate duel for C4::Branch	2016-09-08 14:36:04 +00:00
readingrec.pl	Bug 15758: Koha::Libraries - Remove GetBranches	2016-09-08 14:36:03 +00:00
routing-lists.pl	Bug 15758: Koha::Libraries - Remove GetBranches	2016-09-08 14:36:03 +00:00
setstatus.pl	Bug 16911: Rename extend_subscription with renew_account	2016-09-09 09:45:32 +00:00
statistics.pl	Bug 15758: Koha::Libraries - Ultimate duel for C4::Branch	2016-09-08 14:36:04 +00:00
summary-print.pl	Bug 17128: Make summary-print.pl plack safe	2016-09-02 14:23:16 +00:00
update-child.pl	Bug 15407: Koha::Patron::Categories - replace GetborCatFromCatType	2016-09-08 13:29:22 +00:00