Koha-community/Koha
13
7
Fork 0
Code Issues Releases Wiki Activity
Koha/members
History
Jonathan Druart 11bf7e7bef Bug 17146: Fix CSRF in picture-upload.pl 
If an attacker can get an authenticated Koha user to visit their page
with the
url below, they can change or delete patrons' images
/tools/picture-upload.pl?op=Delete&borrowernumber=42

Test plan:
1/ Hit /tools/picture-upload.pl?op=Delete&borrowernumber=42
And confirm that you get a "Wrong CSRF token" error
2/ Go on the patron detail page with a patron's image
3/ Click on the Delete link (note the csrf_token param)
4/ The image will be deleted and you are redirected to the patron detail
page.

Regression tests:
Upload an image from the patron detail page and from the "upload patron
images" tool.

Signed-off-by: Chris Cormack <chrisc@catalyst.net.nz>

Signed-off-by: Marcel de Rooy <m.de.rooy@rijksmuseum.nl>

Signed-off-by: Kyle M Hall <kyle@bywatersolutions.com>
2016-09-15 13:33:58 +00:00
..
boraccount.pl Bug 15758: Koha::Libraries - Ultimate duel for C4::Branch 2016-09-08 14:36:04 +00:00
default_messageprefs.pl Bug 9978: Replace license header with the correct license (GPLv3+) 2015-04-20 09:59:38 -03:00
deletemem.pl Bug 15758: Koha::Libraries - Remove GetBranches 2016-09-08 14:36:03 +00:00
discharge.pl Bug 15823: Can still access patron discharge slip without having the syspref on 2016-05-06 04:20:48 +00:00
discharges.pl Bug 15548: Move new patron related code to Patron* 2016-03-03 14:38:26 -07:00
files.pl Bug 15758: Koha::Libraries - Ultimate duel for C4::Branch 2016-09-08 14:36:04 +00:00
guarantor_search.pl Bug 15758: Koha::Libraries - Remove GetBranches 2016-09-08 14:36:03 +00:00
mancredit.pl Bug 15758: Koha::Libraries - Ultimate duel for C4::Branch 2016-09-08 14:36:04 +00:00
maninvoice.pl Bug 15758: Koha::Libraries - Ultimate duel for C4::Branch 2016-09-08 14:36:04 +00:00
member-flags.pl Bug 15758: Koha::Libraries - Ultimate duel for C4::Branch 2016-09-08 14:36:04 +00:00
member-password.pl Bug 16911: (QA followup) CGI->param should not be called in list context 2016-09-09 09:45:33 +00:00
member.pl Bug 15758: Koha::Libraries - Ultimate duel for C4::Branch 2016-09-08 14:36:04 +00:00
memberentry.pl Bug 16911: Koha::Patron::Categories - Move GetExpiryDate to ->get_expiry_date 2016-09-09 09:45:31 +00:00
members-home.pl Bug 15758: Koha::Libraries - Remove GetBranchesLoop 2016-09-08 14:36:02 +00:00
members-update-do.pl Bug 15758: Koha::Libraries - Ultimate duel for C4::Branch 2016-09-08 14:36:04 +00:00
members-update.pl Bug 15758: Koha::Libraries - Ultimate duel for C4::Branch 2016-09-08 14:36:04 +00:00
mod_debarment.pl Bug 16154: CGI->multi_param - Force scalar context 2016-04-26 23:16:43 +00:00
moremember.pl Bug 17146: Fix CSRF in picture-upload.pl 2016-09-15 13:33:58 +00:00
nl-search.pl Bug 15407: Koha::Patron::Categories - replace C4::Category->all 2016-09-08 13:29:03 +00:00
notices.pl Bug 15758: Koha::Libraries - Remove GetBranchName 2016-09-08 14:36:01 +00:00
patronimage.pl Bug 15635: Koha::Patron::Images - Remove GetPatronImage 2016-03-04 12:54:15 +00:00
pay.pl Bug 15758: Koha::Libraries - Remove GetBranches 2016-09-08 14:36:03 +00:00
paycollect.pl Bug 15758: Koha::Libraries - Remove GetBranches 2016-09-08 14:36:03 +00:00
print_overdues.pl
printfeercpt.pl Bug 15758: Koha::Libraries - Ultimate duel for C4::Branch 2016-09-08 14:36:04 +00:00
printinvoice.pl Bug 15758: Koha::Libraries - Ultimate duel for C4::Branch 2016-09-08 14:36:04 +00:00
printslip.pl Bug 9978: Replace license header with the correct license (GPLv3+) 2015-04-20 09:59:38 -03:00
purchase-suggestions.pl Bug 15758: Koha::Libraries - Ultimate duel for C4::Branch 2016-09-08 14:36:04 +00:00
readingrec.pl Bug 15758: Koha::Libraries - Remove GetBranches 2016-09-08 14:36:03 +00:00
routing-lists.pl Bug 15758: Koha::Libraries - Remove GetBranches 2016-09-08 14:36:03 +00:00
setstatus.pl Bug 16911: Rename extend_subscription with renew_account 2016-09-09 09:45:32 +00:00
statistics.pl Bug 15758: Koha::Libraries - Ultimate duel for C4::Branch 2016-09-08 14:36:04 +00:00
summary-print.pl Bug 17128: Make summary-print.pl plack safe 2016-09-02 14:23:16 +00:00
update-child.pl Bug 15407: Koha::Patron::Categories - replace GetborCatFromCatType 2016-09-08 13:29:22 +00:00