From 4481fb33777660e89b77bbc614ef6757b41e6337 Mon Sep 17 00:00:00 2001
From: Jonathan Druart <jonathan.druart@bugs.koha-community.org>
Date: Fri, 4 Aug 2023 10:56:50 +0200
Subject: [PATCH] Bug 34478: Replace csrf_token input with include file

perl -p -i -n -e 's#<input type="hidden" name="csrf_token" value="\[% csrf_token \| html %]" />#[% INCLUDE '\''csrf-token.inc'\'' %]#g' **/*.tt **/*.inc

This should have actually been done at the same time as
  "Bug 30524: (QA follow-up) Only generate CSRF token if it will be used"

Signed-off-by: Jonathan Druart <jonathan.druart@bugs.koha-community.org>
---
 koha-tmpl/intranet-tmpl/prog/en/includes/circ-menu.inc      | 2 +-
 .../intranet-tmpl/prog/en/modules/basket/sendbasketform.tt  | 2 +-
 koha-tmpl/intranet-tmpl/prog/en/modules/members/apikeys.tt  | 6 +++---
 .../intranet-tmpl/prog/en/modules/members/deletemem.tt      | 2 +-
 .../intranet-tmpl/prog/en/modules/members/mancredit.tt      | 2 +-
 .../intranet-tmpl/prog/en/modules/members/maninvoice.tt     | 2 +-
 .../intranet-tmpl/prog/en/modules/members/member-flags.tt   | 2 +-
 .../prog/en/modules/members/member-password.tt              | 2 +-
 .../intranet-tmpl/prog/en/modules/members/memberentrygen.tt | 2 +-
 .../intranet-tmpl/prog/en/modules/members/paycollect.tt     | 6 +++---
 .../prog/en/modules/members/two_factor_auth.tt              | 2 +-
 .../intranet-tmpl/prog/en/modules/tools/import_borrowers.tt | 2 +-
 .../intranet-tmpl/prog/en/modules/tools/picture-upload.tt   | 2 +-
 .../opac-tmpl/bootstrap/en/modules/opac-memberentry.tt      | 2 +-
 koha-tmpl/opac-tmpl/bootstrap/en/modules/opac-messaging.tt  | 2 +-
 .../opac-tmpl/bootstrap/en/modules/opac-sendbasketform.tt   | 2 +-
 koha-tmpl/opac-tmpl/bootstrap/en/modules/opac-user.tt       | 2 +-
 17 files changed, 21 insertions(+), 21 deletions(-)

diff --git a/koha-tmpl/intranet-tmpl/prog/en/includes/circ-menu.inc b/koha-tmpl/intranet-tmpl/prog/en/includes/circ-menu.inc
index f183253d9f..9cd8271a34 100644
--- a/koha-tmpl/intranet-tmpl/prog/en/includes/circ-menu.inc
+++ b/koha-tmpl/intranet-tmpl/prog/en/includes/circ-menu.inc
@@ -262,7 +262,7 @@
                         </div>
                         <input type="hidden" name="uploadfilename" value="patron-photo.jpg" />
                         <textarea id="uploadfiletext" name="uploadfiletext" style="display:none;"></textarea>
-                        <input type="hidden" name="csrf_token" value="[% csrf_token | html %]" />
+                        [% INCLUDE 'csrf-token.inc' %]
                         <input type="hidden" name="filetype" value="image" />
                         <input type="hidden" name="cardnumber" value="[% patron.cardnumber | html %]" />
                         <input type="hidden" name="borrowernumber" value="[% patron.borrowernumber | html %]" />
diff --git a/koha-tmpl/intranet-tmpl/prog/en/modules/basket/sendbasketform.tt b/koha-tmpl/intranet-tmpl/prog/en/modules/basket/sendbasketform.tt
index 908e30418b..8dcce676cc 100644
--- a/koha-tmpl/intranet-tmpl/prog/en/modules/basket/sendbasketform.tt
+++ b/koha-tmpl/intranet-tmpl/prog/en/modules/basket/sendbasketform.tt
@@ -46,7 +46,7 @@
     </ol>
     </fieldset>
     <input type="hidden" name="bib_list" value="[% bib_list | html %]" />
-    <input type="hidden" name="csrf_token" value="[% csrf_token | html %]" />
+    [% INCLUDE 'csrf-token.inc' %]
 
     <nav class="navbar navbar-default navbar-fixed-bottom">
         <div class="container-fluid">
diff --git a/koha-tmpl/intranet-tmpl/prog/en/modules/members/apikeys.tt b/koha-tmpl/intranet-tmpl/prog/en/modules/members/apikeys.tt
index c395de294f..1be36d8c35 100644
--- a/koha-tmpl/intranet-tmpl/prog/en/modules/members/apikeys.tt
+++ b/koha-tmpl/intranet-tmpl/prog/en/modules/members/apikeys.tt
@@ -63,7 +63,7 @@
 
                 <form id="add-api-key" action="/cgi-bin/koha/members/apikeys.pl" method="post" style="display:none">
                     <input type="hidden" name="patron_id" value="[% patron.id | html %]" />
-                    <input type="hidden" name="csrf_token" value="[% csrf_token | html %]" />
+                    [% INCLUDE 'csrf-token.inc' %]
                     <input type="hidden" name="op" value="generate" />
                     <fieldset class="brief">
                         <legend>Generate new client id/secret pair</legend>
@@ -102,14 +102,14 @@
                                             <form action="/cgi-bin/koha/members/apikeys.pl" method="post">
                                                 <input type="hidden" name="patron_id" value="[% patron.id | html %]" />
                                                 <input type="hidden" name="key" value="[% key.id | html %]" />
-                                                <input type="hidden" name="csrf_token" value="[% csrf_token | html %]" />
+                                                [% INCLUDE 'csrf-token.inc' %]
                                                 <input type="hidden" name="op" value="delete" />
                                                 <button class="btn btn-default btn-xs delete" type="submit"><i class="fa fa-trash-can"></i> Delete</button>
                                             </form>
                                             <form action="/cgi-bin/koha/members/apikeys.pl" method="post">
                                                 <input type="hidden" name="patron_id" value="[% patron.id | html %]" />
                                                 <input type="hidden" name="key" value="[% key.id | html %]" />
-                                                <input type="hidden" name="csrf_token" value="[% csrf_token | html %]" />
+                                                [% INCLUDE 'csrf-token.inc' %]
                                                 [% IF key.active %]
                                                     <input type="hidden" name="op" value="revoke" />
                                                     <button class="btn btn-default btn-xs" type="submit"><i class="fa fa-times"></i> Revoke</button>
diff --git a/koha-tmpl/intranet-tmpl/prog/en/modules/members/deletemem.tt b/koha-tmpl/intranet-tmpl/prog/en/modules/members/deletemem.tt
index ed4f4e73c6..041488f10d 100644
--- a/koha-tmpl/intranet-tmpl/prog/en/modules/members/deletemem.tt
+++ b/koha-tmpl/intranet-tmpl/prog/en/modules/members/deletemem.tt
@@ -72,7 +72,7 @@
             <h1>Are you sure you want to delete the patron [% patron.firstname | html %] [% patron.surname | html %]?</h1>
             <p>This cannot be undone.</p>
             <form action="/cgi-bin/koha/members/deletemem.pl">
-                <input type="hidden" name="csrf_token" value="[% csrf_token | html %]" />
+                [% INCLUDE 'csrf-token.inc' %]
                 <input type="hidden" name="member" value="[% patron.borrowernumber | html %]"/>
                 <input type="hidden" name="op" value="delete_confirmed" />
                 <button type="submit" class="approve"><i class="fa fa-fw fa-check"></i> Yes, delete</button>
diff --git a/koha-tmpl/intranet-tmpl/prog/en/modules/members/mancredit.tt b/koha-tmpl/intranet-tmpl/prog/en/modules/members/mancredit.tt
index 6c1914015b..057c3f6e81 100644
--- a/koha-tmpl/intranet-tmpl/prog/en/modules/members/mancredit.tt
+++ b/koha-tmpl/intranet-tmpl/prog/en/modules/members/mancredit.tt
@@ -67,7 +67,7 @@
                     <div role="tabpanel" class="tab-pane active">
                         <form action="/cgi-bin/koha/members/mancredit.pl" method="post" id="mancredit">
                             <input type="hidden" name="borrowernumber" id="borrowernumber" value="[% patron.borrowernumber | html %]" />
-                            <input type="hidden" name="csrf_token" value="[% csrf_token | html %]" />
+                            [% INCLUDE 'csrf-token.inc' %]
 
                             <fieldset class="rows">
                                 <legend>Manual credit</legend>
diff --git a/koha-tmpl/intranet-tmpl/prog/en/modules/members/maninvoice.tt b/koha-tmpl/intranet-tmpl/prog/en/modules/members/maninvoice.tt
index c5e10dec7e..cfdb92536d 100644
--- a/koha-tmpl/intranet-tmpl/prog/en/modules/members/maninvoice.tt
+++ b/koha-tmpl/intranet-tmpl/prog/en/modules/members/maninvoice.tt
@@ -76,7 +76,7 @@
                 [% END %]
                 <form action="/cgi-bin/koha/members/maninvoice.pl" method="post" id="maninvoice">
                     <input type="hidden" name="borrowernumber" id="borrowernumber" value="[% patron.borrowernumber | html %]" />
-                    <input type="hidden" name="csrf_token" value="[% csrf_token | html %]" />
+                    [% INCLUDE 'csrf-token.inc' %]
                     <fieldset class="rows">
                         <legend>Manual invoice</legend>
                         <ol>
diff --git a/koha-tmpl/intranet-tmpl/prog/en/modules/members/member-flags.tt b/koha-tmpl/intranet-tmpl/prog/en/modules/members/member-flags.tt
index 388db1c909..2ca70f299a 100644
--- a/koha-tmpl/intranet-tmpl/prog/en/modules/members/member-flags.tt
+++ b/koha-tmpl/intranet-tmpl/prog/en/modules/members/member-flags.tt
@@ -41,7 +41,7 @@
 [% INCLUDE 'members-toolbar.inc' %]
 
 <form id="flag_form" method="post" action="/cgi-bin/koha/members/member-flags.pl">
-    <input type="hidden" name="csrf_token" value="[% csrf_token | html %]" />
+    [% INCLUDE 'csrf-token.inc' %]
     <input type="hidden" name="member" id="borrowernumber" value="[% patron.borrowernumber | html %]" />
     <input type="hidden" name="newflags" value="1" />
     <h1>Set permissions for [% INCLUDE 'patron-title.inc' no_html = 1 %]</h1>
diff --git a/koha-tmpl/intranet-tmpl/prog/en/modules/members/member-password.tt b/koha-tmpl/intranet-tmpl/prog/en/modules/members/member-password.tt
index 24ba4e5f8c..bdf39028a1 100644
--- a/koha-tmpl/intranet-tmpl/prog/en/modules/members/member-password.tt
+++ b/koha-tmpl/intranet-tmpl/prog/en/modules/members/member-password.tt
@@ -106,7 +106,7 @@
 	</ol>
 </fieldset>
     <fieldset class="action">
-        <input type="hidden" name="csrf_token" value="[% csrf_token | html %]" />
+        [% INCLUDE 'csrf-token.inc' %]
         <input type="submit" class="btn btn-primary" value="Save" />
         <a class="cancel" href="/cgi-bin/koha/members/moremember.pl?borrowernumber=[% patron.borrowernumber | html %]">Cancel</a>
     </fieldset>
diff --git a/koha-tmpl/intranet-tmpl/prog/en/modules/members/memberentrygen.tt b/koha-tmpl/intranet-tmpl/prog/en/modules/members/memberentrygen.tt
index eda22f1f86..2eeddb0463 100644
--- a/koha-tmpl/intranet-tmpl/prog/en/modules/members/memberentrygen.tt
+++ b/koha-tmpl/intranet-tmpl/prog/en/modules/members/memberentrygen.tt
@@ -249,7 +249,7 @@ legend:hover {
                             <input type="hidden" name="check_member" value="[% check_member | html %]" />
                             <input type="hidden" name="borrowernumber" value="[% borrowernumber | html UNLESS opduplicate %]" />
                             <input type="hidden" name="nodouble"  value="[% nodouble | html UNLESS opduplicate %]" />
-                            <input type="hidden" name="csrf_token" value="[% csrf_token | html %]" />
+                            [% INCLUDE 'csrf-token.inc' %]
                             [% IF ( step ) %]
                                 <input type="hidden" name="step"  value="[% step | html %]" />
                             [% END %]
diff --git a/koha-tmpl/intranet-tmpl/prog/en/modules/members/paycollect.tt b/koha-tmpl/intranet-tmpl/prog/en/modules/members/paycollect.tt
index 83218e24b5..68c331646c 100644
--- a/koha-tmpl/intranet-tmpl/prog/en/modules/members/paycollect.tt
+++ b/koha-tmpl/intranet-tmpl/prog/en/modules/members/paycollect.tt
@@ -136,7 +136,7 @@
     </ul>
 
     <form name="payindivfine" id="payindivfine" method="post" action="/cgi-bin/koha/members/paycollect.pl">
-    <input type="hidden" name="csrf_token" value="[% csrf_token | html %]" />
+    [% INCLUDE 'csrf-token.inc' %]
     <input type="hidden" name="borrowernumber" id="borrowernumber" value="[% patron.borrowernumber | html %]" />
     <input type="hidden" name="pay_individual" id="pay_individual" value="[% pay_individual | html %]" />
     <input type="hidden" name="itemnumber" id="itemnumber" value="[% itemnumber | html %]" />
@@ -232,7 +232,7 @@
     </ul>
 
     <form name="woindivfine" id="woindivfine" action="/cgi-bin/koha/members/pay.pl" method="post" >
-    <input type="hidden" name="csrf_token" value="[% csrf_token | html %]" />
+    [% INCLUDE 'csrf-token.inc' %]
     <fieldset class="rows">
     <legend>Write off an individual charge</legend>
     <input type="hidden" name="borrowernumber" id="borrowernumber" value="[% patron.borrowernumber | html %]" />
@@ -299,7 +299,7 @@
     [% END %]
 
     <form name="payfine" id="payfine" method="post" action="/cgi-bin/koha/members/paycollect.pl">
-    <input type="hidden" name="csrf_token" value="[% csrf_token | html %]" />
+    [% INCLUDE 'csrf-token.inc' %]
     <input type="hidden" name="borrowernumber" id="borrowernumber" value="[% patron.borrowernumber | html %]" />
     <input type="hidden" name="selected_accts" id="selected_accts" value="[% selected_accts | html %]" />
     <input type="hidden" name="total" id="total" value="[% total | html %]" />
diff --git a/koha-tmpl/intranet-tmpl/prog/en/modules/members/two_factor_auth.tt b/koha-tmpl/intranet-tmpl/prog/en/modules/members/two_factor_auth.tt
index 426c747589..b769485f5b 100644
--- a/koha-tmpl/intranet-tmpl/prog/en/modules/members/two_factor_auth.tt
+++ b/koha-tmpl/intranet-tmpl/prog/en/modules/members/two_factor_auth.tt
@@ -59,7 +59,7 @@
                             <div class="two-factor-status">Status: Enabled</div>
 
                             <form id="two-factor-auth" action="/cgi-bin/koha/members/two_factor_auth.pl" method="post">
-                                <input type="hidden" name="csrf_token" value="[% csrf_token | html %]" />
+                                [% INCLUDE 'csrf-token.inc' %]
                                 <input type="hidden" name="op" value="disable-2FA" />
                                 <input type="submit" value="Disable two-factor authentication" />
                             </form>
diff --git a/koha-tmpl/intranet-tmpl/prog/en/modules/tools/import_borrowers.tt b/koha-tmpl/intranet-tmpl/prog/en/modules/tools/import_borrowers.tt
index 01c5482a5d..8e7b34ce70 100644
--- a/koha-tmpl/intranet-tmpl/prog/en/modules/tools/import_borrowers.tt
+++ b/koha-tmpl/intranet-tmpl/prog/en/modules/tools/import_borrowers.tt
@@ -381,7 +381,7 @@
         </fieldset>
 
         <fieldset class="action">
-            <input type="hidden" name="csrf_token" value="[% csrf_token | html %]" />
+            [% INCLUDE 'csrf-token.inc' %]
             <input type="submit" class="btn btn-primary" value="Import" />
         </fieldset>
     </form>
diff --git a/koha-tmpl/intranet-tmpl/prog/en/modules/tools/picture-upload.tt b/koha-tmpl/intranet-tmpl/prog/en/modules/tools/picture-upload.tt
index b174ca2681..fd97615e46 100644
--- a/koha-tmpl/intranet-tmpl/prog/en/modules/tools/picture-upload.tt
+++ b/koha-tmpl/intranet-tmpl/prog/en/modules/tools/picture-upload.tt
@@ -156,7 +156,7 @@
                         </ol>
 	            </fieldset>
                     <fieldset class="action">
-                        <input type="hidden" name="csrf_token" value="[% csrf_token | html %]" />
+                        [% INCLUDE 'csrf-token.inc' %]
                         <input type="hidden" name="op" value="Upload" />
                         <input type="submit" class="btn btn-primary" value="Upload" />
 						<a href="/cgi-bin/koha/tools/tools-home.pl" class="cancel">Cancel</a>
diff --git a/koha-tmpl/opac-tmpl/bootstrap/en/modules/opac-memberentry.tt b/koha-tmpl/opac-tmpl/bootstrap/en/modules/opac-memberentry.tt
index 986448629b..949227a597 100644
--- a/koha-tmpl/opac-tmpl/bootstrap/en/modules/opac-memberentry.tt
+++ b/koha-tmpl/opac-tmpl/bootstrap/en/modules/opac-memberentry.tt
@@ -1081,7 +1081,7 @@
                                 [% IF OPACPatronDetails %]
                                     <fieldset class="action">
                                         <input type="hidden" name="action" value="update" />
-                                        <input type="hidden" name="csrf_token" value="[% csrf_token | html %]" />
+                                        [% INCLUDE 'csrf-token.inc' %]
                                         <input type="submit" class="btn btn-primary" value="Submit update request" />
                                     </fieldset>
                                 [% END %]
diff --git a/koha-tmpl/opac-tmpl/bootstrap/en/modules/opac-messaging.tt b/koha-tmpl/opac-tmpl/bootstrap/en/modules/opac-messaging.tt
index 3b5d5e95a7..33564e2443 100644
--- a/koha-tmpl/opac-tmpl/bootstrap/en/modules/opac-messaging.tt
+++ b/koha-tmpl/opac-tmpl/bootstrap/en/modules/opac-messaging.tt
@@ -38,7 +38,7 @@
                         <div class="alert alert-success"><p><strong>Settings updated</strong></p></div>
                         [% END %]
                         <form action="/cgi-bin/koha/opac-messaging.pl" method="post" name="opacmessaging">
-                            <input type="hidden" name="csrf_token" value="[% csrf_token | html %]" />
+                            [% INCLUDE 'csrf-token.inc' %]
                             <input type="hidden" name="modify" value="yes" />
 
                             [% IF Koha.Preference( 'EnhancedMessagingPreferencesOPAC' )  %]
diff --git a/koha-tmpl/opac-tmpl/bootstrap/en/modules/opac-sendbasketform.tt b/koha-tmpl/opac-tmpl/bootstrap/en/modules/opac-sendbasketform.tt
index 577f149503..2f1ef6bbce 100644
--- a/koha-tmpl/opac-tmpl/bootstrap/en/modules/opac-sendbasketform.tt
+++ b/koha-tmpl/opac-tmpl/bootstrap/en/modules/opac-sendbasketform.tt
@@ -35,7 +35,7 @@
                                     <label for="comment">Comment:</label>
                                     <textarea id="comment" name="comment" rows="4" cols="40" class="form-control"></textarea>
                                     <input type="hidden" name="bib_list" value="[% bib_list | html %]" />
-                                    <input type="hidden" name="csrf_token" value="[% csrf_token | html %]" />
+                                    [% INCLUDE 'csrf-token.inc' %]
                                 </fieldset>
                                 [% IF Koha.Preference('OPACHoldRequests') || Koha.Preference('OpacRenewalAllowed') %]<p id="donotrequestbymail">Please do not use this mail to request or renew books.</p>[% END %]
                                 <fieldset class="action">
diff --git a/koha-tmpl/opac-tmpl/bootstrap/en/modules/opac-user.tt b/koha-tmpl/opac-tmpl/bootstrap/en/modules/opac-user.tt
index 996e466fc7..88e72888fe 100644
--- a/koha-tmpl/opac-tmpl/bootstrap/en/modules/opac-user.tt
+++ b/koha-tmpl/opac-tmpl/bootstrap/en/modules/opac-user.tt
@@ -240,7 +240,7 @@
                                         <input type="radio" id="no-autorenew_checkouts" name="borrower_autorenew_checkouts" value="0" checked="checked" />
                                     </label>
                                 [% END %]
-                        <input type="hidden" name="csrf_token" value="[% csrf_token | html %]" />
+                        [% INCLUDE 'csrf-token.inc' %]
                         <input type="hidden" name="update_arc" value="1" />
                         <input type="submit" value="Update auto-renewal preference" />
                     </form>
-- 
2.39.5