gitea
/
Koha-clms
1
0
Fork 0
Code Issues Pull Requests Packages Projects Releases Wiki Activity

Bug 42066: Prevent 403 after an expired OPAC session 

If a session has expired, the login form will get an empty CSRF token
and the login form will return 403

To recreate:
hit /cgi-bin/koha/sco/sco-main.pl
then hit /cgi-bin/koha/opac-main.pl
login
=> 403
Apply this patch, try again
=> Success

Signed-off-by: David Nind <david@davidnind.com>
Signed-off-by: Nick Clemens <nick@bywatersolutions.com>
Signed-off-by: Pedro Amorim <pedro.amorim@openfifth.co.uk>
This commit is contained in:
Jonathan Druart 2026-05-04 14:58:32 +02:00 committed by Pedro Amorim
parent dcbcea80e4
commit 06bac7582f
No known key found for this signature in database
GPG Key ID: 06B75BA7F3894D55
1 changed files with 4 additions and 1 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

5
C4/Auth.pm
View File

@ -275,15 +275,18 @@ sub get_template_and_user {
} }
if ($kick_out) { if ($kick_out) {
$session = get_session("");
$template = C4::Templates::gettemplate( $template = C4::Templates::gettemplate(
'opac-auth.tt', 'opac', 'opac-auth.tt', 'opac',
$in->{query} $in->{query}
); );
$template->param( sessionID => $session->id );
$cookie = $cookie_mgr->replace_in_list( $cookie = $cookie_mgr->replace_in_list(
$cookie, $cookie,
$in->{query}->cookie( $in->{query}->cookie(
-name => 'CGISESSID', -name => 'CGISESSID',
-value => '', -value => $session->id,
-HttpOnly => 1, -HttpOnly => 1,
-secure => ( C4::Context->https_enabled() ? 1 : 0 ), -secure => ( C4::Context->https_enabled() ? 1 : 0 ),
-sameSite => 'Lax', -sameSite => 'Lax',