David Cook
649c9785f5
This patch adds the requirements that updating a system preference
requires a CSRF token. (Also, adding and deleting local system preferences.)
0. Apply patch
1. koha-plack --reload kohadev
2. Add local system preference
3. Update local system preference
4. Delete local system preference
5. Update normal system preference
6. Note no errors
Signed-off-by: Jonathan Druart <jonathan.druart@bugs.koha-community.org>
Signed-off-by: Marcel de Rooy <m.de.rooy@rijksmuseum.nl>
Signed-off-by: Tomas Cohen Arazi <tomascohen@theke.io>
(cherry picked from commit c6ef2aba6b)
Signed-off-by: Fridolin Somers <fridolin.somers@biblibre.com>
156 lines
3.2 KiB
Perl
Executable file
156 lines
3.2 KiB
Perl
Executable file
#!/usr/bin/perl
|
|
|
|
# Copyright 2009 Jesse Weaver
|
|
#
|
|
# This file is part of Koha.
|
|
#
|
|
# Koha is free software; you can redistribute it and/or modify it
|
|
# under the terms of the GNU General Public License as published by
|
|
# the Free Software Foundation; either version 3 of the License, or
|
|
# (at your option) any later version.
|
|
#
|
|
# Koha is distributed in the hope that it will be useful, but
|
|
# WITHOUT ANY WARRANTY; without even the implied warranty of
|
|
# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
|
|
# GNU General Public License for more details.
|
|
#
|
|
# You should have received a copy of the GNU General Public License
|
|
# along with Koha; if not, see <http://www.gnu.org/licenses>.
|
|
#
|
|
|
|
use Modern::Perl;
|
|
|
|
use C4::Context;
|
|
use C4::Service;
|
|
use C4::Log;
|
|
use Koha::Token;
|
|
|
|
=head1 NAME
|
|
|
|
svc/config/systempreferences - Web service for setting system preferences
|
|
|
|
=head1 SYNOPSIS
|
|
|
|
POST /svc/config/systempreferences/
|
|
|
|
=head1 DESCRIPTION
|
|
|
|
This service is used to set system preferences, either one at a time or in
|
|
batches.
|
|
|
|
=head1 METHODS
|
|
|
|
=cut
|
|
|
|
our ( $query, $response ) = C4::Service->init( parameters => 'manage_sysprefs' );
|
|
|
|
=head2 set_preference
|
|
|
|
=over 4
|
|
|
|
=item url path
|
|
|
|
POST /svc/config/systempreferences/$preference
|
|
|
|
=item url query
|
|
|
|
value=$value
|
|
|
|
=back
|
|
|
|
Used to set a single system preference.
|
|
|
|
=cut
|
|
|
|
sub set_preference {
|
|
my ( $preference ) = @_;
|
|
die "wrong_csrf_token\n" unless Koha::Token->new->check_csrf(
|
|
{
|
|
session_id => scalar $query->cookie('CGISESSID'),
|
|
token => scalar $query->param('csrf_token'),
|
|
}
|
|
);
|
|
|
|
my $value = join( ',', $query->param( 'value' ) );
|
|
C4::Context->set_preference( $preference, $value );
|
|
|
|
C4::Service->return_success( $response );
|
|
}
|
|
|
|
=head2 get_preference
|
|
|
|
=over 4
|
|
|
|
=item url path
|
|
|
|
GET /svc/config/systempreferences/$preference
|
|
|
|
=item url query
|
|
|
|
preference=$pref_name
|
|
|
|
=back
|
|
|
|
Used to get a single system preference.
|
|
|
|
=cut
|
|
|
|
sub get_preference {
|
|
my $preference = scalar $query->param('pref');
|
|
|
|
my $value = C4::Context->preference( $preference );
|
|
$response->param( value => $value );
|
|
|
|
C4::Service->return_success( $response );
|
|
}
|
|
|
|
|
|
|
|
=head2 set_preferences
|
|
|
|
=over 4
|
|
|
|
=item url path
|
|
|
|
POST /svc/config/systempreferences/
|
|
|
|
=item url query
|
|
|
|
pref_$pref1=$value1&pref_$pref2=$value2
|
|
|
|
=back
|
|
|
|
Used to set several system preferences at once. Each preference you want to set
|
|
should be sent prefixed with pref. If you wanted to turn off the
|
|
virtualshelves syspref, for instance, you would POST the following:
|
|
|
|
pref_virtualshelves=0
|
|
|
|
=cut
|
|
|
|
sub set_preferences {
|
|
die "wrong_csrf_token\n" unless Koha::Token->new->check_csrf(
|
|
{
|
|
session_id => scalar $query->cookie('CGISESSID'),
|
|
token => scalar $query->param('csrf_token'),
|
|
}
|
|
);
|
|
|
|
foreach my $param ( $query->param() ) {
|
|
my ( $pref ) = ( $param =~ /pref_(.*)/ );
|
|
|
|
next if ( !defined( $pref ) );
|
|
|
|
my $value = join( ',', $query->multi_param( $param ) );
|
|
|
|
C4::Context->set_preference( $pref, $value );
|
|
}
|
|
|
|
C4::Service->return_success( $response );
|
|
}
|
|
|
|
C4::Service->dispatch(
|
|
[ 'POST /([A-Za-z0-9_-]+)', [ 'value' ], \&set_preference ],
|
|
[ 'POST /', [], \&set_preferences ],
|
|
[ 'GET /', [ 'pref' ], \&get_preference],
|
|
);
|