Bug 42066: Prevent 403 after an expired OPAC session
If a session has expired, the login form will get an empty CSRF token and the login form will return 403 To recreate: hit /cgi-bin/koha/sco/sco-main.pl then hit /cgi-bin/koha/opac-main.pl login => 403 Apply this patch, try again => Success Signed-off-by: David Nind <david@davidnind.com> Signed-off-by: Nick Clemens <nick@bywatersolutions.com> Signed-off-by: Pedro Amorim <pedro.amorim@openfifth.co.uk>
This commit is contained in:
parent
dcbcea80e4
commit
06bac7582f
|
|
@ -275,15 +275,18 @@ sub get_template_and_user {
|
|||
}
|
||||
|
||||
if ($kick_out) {
|
||||
$session = get_session("");
|
||||
$template = C4::Templates::gettemplate(
|
||||
'opac-auth.tt', 'opac',
|
||||
$in->{query}
|
||||
);
|
||||
$template->param( sessionID => $session->id );
|
||||
|
||||
$cookie = $cookie_mgr->replace_in_list(
|
||||
$cookie,
|
||||
$in->{query}->cookie(
|
||||
-name => 'CGISESSID',
|
||||
-value => '',
|
||||
-value => $session->id,
|
||||
-HttpOnly => 1,
|
||||
-secure => ( C4::Context->https_enabled() ? 1 : 0 ),
|
||||
-sameSite => 'Lax',
|
||||
|
|
|
|||
Loading…
Reference in New Issue