{"push_id":1174185201,"size":1,"distinct_size":1,"ref":"refs/heads/master","head":"779fa7c6da03fd3173de4a5c21d5615b83ac3ee4","before":"2279a2fea05bc4d6e27b239f45c5d5733a37eef2","commits":[{"sha":"779fa7c6da03fd3173de4a5c21d5615b83ac3ee4","author":{"name":"Jonathan Druart","email":"b8e3b888c23b54255e26fdc644fc18f5231e8886@bugs.koha-community.org"},"message":"Bug 16591: Fix CSRF in opac-memberentry\n\nIf an attacker can get an authenticated Koha user to visit their page\nwith the code below, they can update the victim's details to arbitrary\nvalues.\n\nTest plan:\n\nTrigger\n/cgi-bin/koha/opac-memberentry.pl?action=update&borrower_B_city=HACKED&borrower_firstname=KOHA&borrower_surname=test\n\n=> Without this patch, the update will be done (or modification\nrequest)\n=> With this patch applied you will get a crash \"Wrong CSRF token\" (no\nneed to stylish)\n\nDo some regression tests with this patch applied (Update patron infos)\n\nQA note: I am not sure it's useful to create a digest of the DB pass,\nbut just in case...\n\nReported by Alex Middleton at Dionach.\n\nSigned-off-by: Chris Cormack <chris@bigballofwax.co.nz>\n\nSigned-off-by: Katrin Fischer <katrin.fischer.83@web.de>\n\nSigned-off-by: Kyle M Hall <kyle@bywatersolutions.com>","distinct":true,"url":"https://api.github.com/repos/Koha-Community/Koha/commits/779fa7c6da03fd3173de4a5c21d5615b83ac3ee4"}]}
{"actor":{"display_login":"gmcharlt"}}