]> git.koha-community.org Git - koha.git/commit
Bug 18019: Add CSRF protection to authorities-home.pl (op==delete)
authorMarcel de Rooy <m.de.rooy@rijksmuseum.nl>
Tue, 7 Feb 2017 08:09:33 +0000 (09:09 +0100)
committerKyle M Hall <kyle@bywatersolutions.com>
Fri, 31 Mar 2017 13:08:24 +0000 (13:08 +0000)
commit5a7dc0749f581e4c4bc6ec68d3f3ab6bac12afd5
tree88e358b654dc6c2f7ae3105fc48fb31b35097341
parentf454013ec9beb8f6e4c382253b76bfac5ca65244
Bug 18019: Add CSRF protection to authorities-home.pl (op==delete)

Without this patch, it is possible to delete authority records with URL
manipulation.
Like: /cgi-bin/koha/authorities/authorities-home.pl?op=delete&authid=[XXX]

Test plan:
[1] Go to Authorities. Search for some authorities (without links).
[2] Delete an authority. Should work.
[3] Apply patch.
[4] Construct an URL like above to delete another authority. Should fail.
    Under Plack this results in an internal server error, the log tells
    you: Wrong CSRF token.

Signed-off-by: Marcel de Rooy <m.de.rooy@rijksmuseum.nl>
Signed-off-by: Nick Clemens <nick@bywatersolutions.com>
Amended the test plan.

Signed-off-by: Jonathan Druart <jonathan.druart@bugs.koha-community.org>
Signed-off-by: Kyle M Hall <kyle@bywatersolutions.com>
authorities/authorities-home.pl
koha-tmpl/intranet-tmpl/prog/en/modules/authorities/searchresultlist.tt